Privacy Document
Version 3.1 | Updated March 2026 — PPL Amendment 13 & CCPA 2026 Compliant
Privacy At a Glance
Lead data retention
IP address TTL
Breach notification
DSR response window
This website is operated by Daniel Mashkov, Licensed Business (Israel). This policy explains how I collect, use, retain, and protect personal data in accordance with the Israeli Privacy Protection Law 5741-1981 including Amendment 13 (in force from 2025), the Privacy Protection Regulations (Data Security) 2017, and the California Consumer Privacy Act (CCPA) as amended by CPRA 2026.
Statutory classification — enhanced protection mandatory
Legal basis: Privacy Protection Law 5741-1981 §3 (sensitive data schedule) as expanded by PPL Amendment 13 (2025). Processing this category requires Records of Processing Activities (ROPA) documentation, a Data Protection Impact Assessment (DPIA), and enhanced technical safeguards.
I do not sell, rent, or share your personal information with third parties for marketing purposes.
I use the following third-party services to process data on my behalf:
| Service | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website hosting, CDN, edge functions | USA / EU (edge) |
| Supabase Inc. | Contact form & lead magnet submissions (leads table, RLS enforced) | USA / EU-West |
| Airtable Inc. | Portfolio project data — CRM reference (no form submissions stored) | USA |
| Resend Inc. | Transactional email delivery | USA |
| Upstash Inc. | Rate limiting (Redis, 60-second TTL) | USA |
| Google LLC (GA4) | Usage analytics (consent-gated) | USA |
| Sentry Inc. | Error monitoring and performance | USA |
| Vercel Speed Insights | Performance monitoring — Core Web Vitals (always active) | USA |
| Calendly Inc. | Appointment scheduling (on-demand, user-initiated) | USA |
Data transfers to the USA are made under Data Processing Agreements (DPAs) incorporating Standard Contractual Clauses (SCCs) as required by PPL Amendment 13 for cross-border data transfers.
24 months
Contact & lead submissions (Supabase)
Automatically purged after this period
60 seconds
IP addresses (Upstash Redis)
Automatically deleted by Redis TTL
14 months
GA4 data
Google's default retention setting
Until cleared
Cookie consent state
Stored in localStorage
5 years
Consent audit log (consent_logs, Supabase)
Anonymous audit records required by GDPR Art. 7 & PPL Am. 13 — no IP, no email stored
5 years
DSR requests (dsr_requests, Supabase)
Retained for legal audit trail — no IP stored
To exercise any of these rights, use our secure form: Submit a DSR Request
Essential functionality uses a locale cookie (next-intl, HTTP session cookie) and localStorage keys for consent state (cookie-consent) and GPC detection (cookie-consent-gpc). Session storage keys (exit_intent_shown, converted_this_session, calculator_intent) expire on tab close. Analytics cookies (GA4) are consent-gated and loaded only after your explicit opt-in via the consent banner. You may change or withdraw your analytics consent at any time by clicking "Cookie Settings" in the site footer, or by clearing your browser's localStorage.
I do not sell, rent, or share the personal information of California residents with third parties for cross-context behavioral advertising or targeted advertising purposes. California residents have the right to: know what data is collected, request deletion, request correction, opt out of sale/sharing, and non-discrimination for exercising these rights.
Submit a DSR RequestPPL Amendment 13 §17c mandates notification to the PPA within 72 hours of discovery. The following protocol governs my response:
Phase 1 — Detect & Contain (0–4 h)
Phase 2 — Assess Severity (4–24 h)
Phase 3 — Notify PPA (24–72 h)
Phase 4 — Notify Individuals (without undue delay)
This protocol complies with PPL Amendment 13 §17c, the Privacy Protection Regulations (Data Security) 2017, and CERT-IL cyber incident reporting guidelines.
I may update this policy from time to time. Material changes will be posted on this page with a new "Last updated" date. Continued use of the site after an update constitutes acceptance of the revised policy.
For privacy-related questions or data subject requests:
Submit a DSR RequestOr email: privacy@danielmashkov.com
This alias is configured and may be pending DNS activation. For urgent requests: info@danielmashkov.com