Privacy notice
Last updated: 24/Sep/2026
This is a courtesy translation. The notice is governed by Mexican law and the original is in Spanish. If there is any discrepancy between the two, the Spanish version prevails.
The essentials, in four lines
This website is a personal portfolio. Browsing it creates no record about you: there is no analytics, no first-party cookies and no trackers. Data is stored only if you choose to write to me through a form, and it is stored to reply to you. Nothing else.
1. Who processes your data
Juan Rodríguez, an individual operating this site under the brand rdgzlabs, is the data controller.
- Contact email: [email protected]
- Address: San Pedro Tlaquepaque, Jalisco, México
This site is a professional portfolio of my own projects. It does not sell products or services, shows no advertising, does not belong to any company and is not part of any commercial activity. Its purpose is to let anyone evaluating my professional profile see my work.
2. What is collected, and when
Two things that are often confused are worth separating.
If you only browse: nothing is collected. Your visit is not logged, nor which pages you view, how long you stay, or where you came from. There is no analytics or traffic statistics. You can go through the whole site and no data about you will remain.
If you submit a form: what appears in the tables below is collected. It is the only collection point in the entire site.
2.1. What you type
| Data | Required? | Why it is requested |
|---|---|---|
| Name | Yes | To know who I am replying to and how to address you |
| Email address | Yes | It is the only way I can reply to you |
| Company or organization | No | To understand where you are writing from |
| Message | Yes | It is the reason for the contact |
You decide what you write. If an optional field is not relevant, leave it blank: the form is sent anyway.
2.2. What is recorded without you typing it
You do not type these two items: one is sent by your browser in any request to any website, and the other is noted by the server when it receives the message.
| Data | Why it is kept |
|---|---|
| IP address | To limit how many submissions a single origin can make and to stop automated spam |
| Date and time of submission | To order messages and to apply the retention period |
An IP address is personal data and is treated as such. It is not published, not combined with any other source, not shared with anyone, and not used to identify you or to build any profile about you. It exists for one reason only: so that this form does not become a spam tool.
Your browser sends more things with every request —which browser and operating system you use, which page you wrote from—. None of that is stored. It is discarded when the message is received, because it is not needed to reply to you.
2.3. What is noted internally
Two management flags are stored alongside your message: whether I have already replied and when, and whether the internal notification for that message reached my inbox correctly. They say nothing about you; they exist so that no message goes unanswered.
2.4. What is never collected
Sensitive data is neither requested nor processed: health, racial or ethnic origin, religious beliefs, political opinions, trade-union membership, sex life or orientation, genetic or biometric data. Nor is any financial or asset-related data.
The message field is free text, so technically you can write anything in it. If you include sensitive information on your own initiative, it will be treated for the same purpose and for the same period as the rest of the text — but I recommend you do not: it is not needed for a first professional contact.
2.5. Screenshots
The projects are illustrated with screenshots. Everything that appears in them is made up: the names, emails and records are test data created for the images. They do not correspond to real people and do not come from any system in use.
3. What they are used for
Three purposes, and all three are necessary for the form to make sense:
- Replying to you. Reading your message and answering by email.
- Protecting the form. Limiting submissions per origin and discarding automated ones.
- Not losing the thread. Keeping the message so I can resume the conversation and know which ones I have already answered.
There are no secondary purposes. Your data is not used for advertising, newsletters, profiling, automated decisions, scoring, analytics or training any model. It is not sold, rented or transferred to anyone for commercial purposes — neither now nor later without telling you first.
4. Legal basis
For those writing from Mexico, under the Federal Law on the Protection of Personal Data Held by Private Parties in force since 21 March 2025: by submitting the form, having had this notice available to you beforehand, you give your consent to the processing described here. None of the purposes requires express written consent, because no sensitive or asset-related data is processed.
For those writing from the European Union or the EEA, under the GDPR:
| Data | Legal basis |
|---|---|
| Name, email, company, message | Art. 6.1.b — necessary to handle a request you yourself initiated. In the alternative, art. 6.1.a, the consent you give by pressing "Send" |
| IP, user agent, originating page | Art. 6.1.f — legitimate interest in keeping the form free of abuse. It is the minimum information that achieves this, and it does not override your rights because it is not used to identify you |
Providing this data is not a legal or contractual obligation: you are free not to write to me. The only consequence of not doing so is that there will be no conversation.
5. How long it is kept
Twelve months from submission. Once that period has passed, the record is deleted automatically, without you having to ask for anything.
Some details I would rather tell you before you ask:
- Each submission also generates a notification email to my inbox, which is a copy of your message. When you request deletion, both are deleted: the database record and that email.
- The database is backed up daily and each backup is kept for fourteen days. A deleted record —because the period expired or because you requested it— may remain inside the backups for those two weeks, until they delete themselves.
- If the conversation goes on to become a professional relationship, the data needed for it will be kept for as long as it lasts. If that moment comes I will tell you expressly; it is not something that happens silently.
6. Who else sees it
Nobody receives your data for their own purposes. Five providers take part as processors, each in the technical part that corresponds to it:
| Provider | What it does | What it can see |
|---|---|---|
| Vultr | Server where the website and the database run | Everything stored, like any hosting provider |
| Cloudflare | DNS, TLS encryption and domain protection; it also forwards the domain's email | Traffic in transit, the connecting IP and the content of the notification email while forwarding it |
| Resend | Sends the notification email | The content of that email: your name, your address and your message |
| Mailbox where the notification ends up | The content of that email, while it is in the mailbox | |
| DigitalOcean | Stores the database backups | Everything stored, inside each backup, during the fourteen days it is kept |
All five process the information on servers located outside Mexico and the European Union, mainly in the United States. For those writing from the EU or the EEA, those international transfers rely on the European Commission's standard contractual clauses and, for providers that hold it, on their EU–U.S. Data Privacy Framework certification.
Apart from these five, your data would only be disclosed if a competent authority required it in the exercise of its powers.
7. Cookies and tracking
This site does not set first-party cookies, does not use analytics, does not embed third-party content (no external fonts, maps, videos or iframes) and has no advertising trackers. There is no preference to configure, which is why you will not see a cookie banner either: there would be nothing to consent to.
Cloudflare, which protects the domain, may set a strictly necessary technical cookie to tell automated traffic from human traffic. It is not used for advertising or to follow you across sites.
8. Your rights
If you write from Mexico, you can exercise your ARCO rights —access, rectification, cancellation and objection (in Spanish: acceso, rectificación, cancelación y oposición)—, as well as withdraw your consent and limit the use or disclosure of your data.
If you write from the EU or the EEA, you also have the rights of erasure, restriction of processing, objection and portability under articles 15 to 22 of the GDPR, and the right to object to processing based on legitimate interest.
How to exercise them: write to [email protected] saying what you want and which address you sent the form from. That is enough for me to find your data; you do not need to provide any document or fill in any form. Only if the request came from an address different from the original submission would I ask for some verification, and only so as not to hand your data to someone else.
Deadlines: twenty business days under Mexican law, one month under the GDPR. In practice I reply within days. It is always free.
9. If you are not satisfied
If you write from Mexico, you can go to the Secretaría Anticorrupción y Buen Gobierno (the Ministry of Anti-Corruption and Good Governance), which since 21 March 2025 is the competent authority for the protection of personal data held by private parties, replacing the now-defunct INAI. If you live in the European Union, go to the supervisory authority of your country.
I would appreciate it if you wrote to me first: on a personal portfolio, practically everything is resolved with an email.
10. Minors
The site is not aimed at minors and does not knowingly collect their data. If I notice that a message comes from a minor, I will delete the record.
11. Security
Data travels encrypted end to end (TLS) and is stored in a database that is not exposed to the internet: there is no panel, no query API and no public address from which it can be read. Access is exclusively mine, from the server. Backups are stored in private storage with no public access.
No system is infallible. If a breach affecting your data occurred, I would write to you without delay —I have your address, so you would not depend on reading a notice on this page— explaining what happened, which of your data was affected and what real risk it poses. And I would notify the competent authority in the cases and within the deadlines that the applicable law requires.
You should know the maximum scope of that scenario: there are no passwords here, no bank details and no identity documents. The worst that can leak is your name, your email and the message you wrote.
12. Changes to this notice
Any change will be published on this same page, updating the date in the header. If the change substantially affected what your data is used for, I would also flag it next to the forms.