Privacy
Privacy Policy
Last updated on November 5, 2026.
1. Who we are
This Privacy Policy explains how Affarit Studio SRL ("we", "us", "our") collects and processes personal data through https://andrasferencz.ro (the "website"), the personal website of András Ferencz. Affarit Studio SRL runs the website and is the data controller for your personal data.
Affarit Studio SRL (CUI RO40374098)
Str. Bistritei Nr. 6A, Targu Mures, Mures
Romania
Email: hello@andrasferencz.ro
2. Scope
This policy covers personal data we process about visitors to the website, people who contact us, and people who sign up for a free resource or the newsletter. Read it together with our Cookie Policy and Terms and Conditions.
3. What information we collect
We collect only the data you choose to give us, plus limited technical data needed to run the site securely.
- Contact data: when you send a message through the contact form, your name, email address and message, and your browser's user-agent.
- Signup data: when you unlock a free resource or sign up for the newsletter, your email address, your name if you give it, your consent choices, the time you confirmed, and the IP address and browser user-agent of the signup.
- Resource usage: when you open a free resource, we record which resource and part you viewed, unlocked or downloaded, with the time, your subscriber record if you are signed up, and the IP address and user-agent of the request. We use this to see which resources are useful and to prevent abuse.
- Technical data: our hosting provider processes standard information such as your IP address, browser type and the pages you request, for security, abuse prevention and reliability.
- Analytics data: only if you allow the analytics category, Vercel Web Analytics records aggregated, cookieless usage data such as page views and the general type of device and browser. It does not identify you and does not track you across other websites.
- Where you came from: if you arrive through a tagged link (for example one with "utm_source" in the address), the page keeps that tag and the page you landed on in memory while the tab is open, and sends them only if you submit a form here, so we know which link worked. Nothing is stored on your device for this, it is never shared, and nothing is tracked across other websites.
- Consent and progress in your browser: your cookie choice and the boxes you tick in a checklist stay in your own browser (see the Cookie Policy). Checklist ticks are never sent to us.
We do not knowingly collect data from children, and we do not intentionally collect special categories of personal data.
4. How and why we use your data
Under the EU/UK General Data Protection Regulation (GDPR) we rely on these legal bases:
| Purpose | Data used | Legal basis |
|---|---|---|
| Replying to your message | Contact data | Steps taken at your request before a contract, and our legitimate interest in replying to you |
| Confirming your signup and giving you the free resources | Signup data | Your request (performance of the service you asked for) |
| Sending you occasional emails about new resources and updates | Signup data | Your consent, given by ticking the box at signup |
| Knowing which resources and links are useful | Resource usage, where you came from | Our legitimate interest in improving the website, balanced against your rights |
| Operating and securing the website | Technical data, IP address and user-agent | Our legitimate interest in a secure, reliable website |
| Measuring how the website is used | Analytics data | Your consent |
| Remembering your cookie choice | Consent data | Our legal obligation to respect your choice |
Where we rely on consent, you can withdraw it at any time without affecting processing carried out before.
5. Emails and marketing
Every email we send after a signup has a one-click unsubscribe link. We send marketing emails only if you ticked the box for them. We do not sell your personal data and we do not run advertising or behavioural tracking. The Engineering OS newsletter is read on Substack and eBooks are sold on Gumroad; their own privacy policies apply there.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers ("processors") that help us run the website, under contracts that require them to protect it and use it only on our instructions:
- Vercel Inc.: website hosting and content delivery, and (only with your consent) cookieless Web Analytics.
- Supabase: secure database hosting for contact messages, signups and resource usage, and administrator sign-in.
- Resend: sending emails such as your signup confirmation and replies to your message.
We may also disclose data where the law requires it, to protect our rights, or in a business transfer such as a merger.
7. International transfers
Some providers may process data outside the European Economic Area. Where that happens we rely on safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.
8. How long we keep your data
- Contact messages: as long as needed to handle your request, and a reasonable period afterwards in case you write again.
- Signups: while you stay subscribed. When you unsubscribe we stop emailing you at once and keep only what we need to honour that choice; ask us and we delete the rest.
- Resource usage and technical logs: for a limited period, then deleted or anonymised.
9. How we protect your data
We use appropriate technical and organisational measures, including encryption in transit (HTTPS), a signed cookie for unlocked resources, access controls on our admin area, and providers with their own security programmes. No transmission or storage is completely secure, but we work to protect your data and to handle any incident promptly.
10. Your rights
Subject to applicable law, you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing, including direct marketing;
- receive your data in a portable format;
- withdraw consent at any time where processing is based on consent.
To exercise any of these, email hello@andrasferencz.ro. We reply within the time limits the law sets, and may first need to confirm it is you.
11. Complaints
If you have a concern, please contact us first so we can try to resolve it. You also have the right to complain to a data protection supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or the authority in your country of residence.
12. Third-party links
The website links to sites we do not control, such as Substack, Gumroad, Google Calendar, LinkedIn and affarit.com. Their own privacy policies apply there.
13. Changes to this policy
We may update this policy. When we make material changes we revise the date above and, where appropriate, tell you.
14. Contact us
Affarit Studio SRL (CUI RO40374098)
Str. Bistritei Nr. 6A, Targu Mures, Mures
Romania
Email: hello@andrasferencz.ro
Website: https://andrasferencz.ro