Privacy Policy — yellowflash.dev

1. Data We Collect

yellowflash.dev collects the minimum data needed for operations:

Contact form data: name, email, message subject, budget range (optional), message body. Stored for project follow-up.
Analytics data: aggregate visitor data via Google Analytics 4 + Cloudflare Analytics — anonymous, to improve UX.
Technical cookies: session cookie, theme preference (localStorage), CSRF token. No third-party tracking cookies.

2. How Data Is Used

Contact form → replying to client questions, project follow-up.
Analytics → understanding popular pages + improving less relevant content.
No sale of data to third parties.
No behavioral profiling for ads.

3. Data Storage

Contact form data is stored on our servers for a maximum of 24 months (for project audit). After that it is anonymized or deleted. Database backups are encrypted at-rest.

4. Your Rights (PDP Law)

Under Indonesia's Personal Data Protection Law (Law No. 27 / 2022), you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request data deletion (right to be forgotten).
Withdraw consent at any time.

For requests, email hello@yellowflash.dev — we respond within 14 business days.

5. Cookies

We use cookies for:

Session: admin login. Ends when the browser closes.
localStorage: theme preference (dark/light). Can be cleared via browser settings.
CSRF token: security for form submission.
Google Analytics: aggregate visitor data — can be opted out via Google Opt-out.

6. Third Parties

We use the following third-party services that have their own privacy policies:

Google Analytics 4 — visitor analytics.
Cloudflare — CDN, security, analytics.
Hosting provider (Cloudways/Hostinger) — per their privacy policy.

7. Policy Changes

This policy may be updated from time to time. The last update date is shown above. Material changes will be notified by email to active clients.

8. Contact

Questions about this privacy policy? Email hello@yellowflash.dev.