Privacy policy
At a glance
- This site sets no tracking cookies and shows no cookie banner.
- Visits are counted with Umami, which works without cookies and doesn’t store your IP address.
- If you write through the contact form or book a call, I receive what you enter. I use it to respond to you and prepare our conversation, nothing else.
- I don’t sell your data or use it for advertising.
Who is responsible
This website is operated by FlashAdvance Pte. Ltd., 30 Petain Road, Singapore 208099 (UEN 201433315M), represented by its director, Christian Thomas Hennigfeld. The company is responsible for the personal data described here (the “controller” under the GDPR). Where this policy says “I”, it means the company.
For any question about your data, or to use your rights, write to chris@chrishennigfeld.com. The sections below name each service I use, where it processes your data, and how transfers outside the EU are protected.
Data protection officer under Singapore’s Personal Data Protection Act: Christian Thomas Hennigfeld, chris@chrishennigfeld.com.
Hosting
This site is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you open a page, your browser sends Cloudflare technical data: your IP address, the page you asked for, the time, and your browser and operating system. Cloudflare needs this to deliver the page and to protect the site from attacks and keeps it in its logs for a short time.
Legal basis: my legitimate interest in a site that works and is secure (Art. 6(1)(f) GDPR). Cloudflare processes this data on my behalf under its data processing addendum. Data may be processed in the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework.
Visit statistics
I count visits with Umami Cloud, run by Umami Software, Inc., USA. Umami sets no cookies and stores nothing on your device.
When you open a page, Umami records the page, the page you came from (including campaign tags such as utm_source), the time, your browser, operating system, device type, screen size, and language, and your approximate location (country, region, and city). Umami uses your IP address briefly to tell visits apart and to look up the location, but doesn’t store it with the statistics. It also records when someone clicks “Book a call” or sends the contact form, without what was entered.
Legal basis: my legitimate interest in knowing how the site is used, so I can improve it (Art. 6(1)(f) GDPR). Umami processes this data on my behalf under its data processing agreement. The statistics are stored in the EU (Frankfurt, Germany). Because Umami is a US company, data may also be accessed from the USA; the agreement includes the EU standard contractual clauses for this. The statistics are kept for six months.
Contact form
If you send the contact form, I receive your name, email address, and message. If you fill them in, I also receive your company or website and how you heard about me. I use them to respond to you and, if we talk, to prepare our conversation.
Legal basis: steps you ask for before a possible contract (Art. 6(1)(b) GDPR), and otherwise my legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
Three services are involved:
- Spam check: Cloudflare Turnstile checks that a person is sending the form, not a bot. It loads only once you start filling in the form. Turnstile collects technical signals such as your IP address and browser, and may set cookies that are strictly necessary for the check. Cloudflare processes these signals on my behalf and also uses them for its own purposes to improve its bot detection. Details: Turnstile privacy addendum.
- Sending: Resend (Plus Five Five, Inc., USA) sends the form’s content to me as an email, from its EU region. Resend keeps the email and its logs for 30 days and processes them on my behalf under its data processing agreement. Resend is certified under the EU-U.S. Data Privacy Framework.
- Inbox: the email arrives in my mailbox at Google Workspace (see the section “Email” below).
Booking a call
The “Book a call” buttons take you to my booking page at Cal.com (Cal.com, Inc., USA). When you book, Cal.com receives your name and email address, the time you choose and your time zone, how you heard about me, and any notes you add. If you add guests, it also receives their email addresses, and they get the invitation too. Cal.com adds the call to my Google Calendar, creates a Google Meet link for it, and sends both of us the invitation. Google processes the call itself in Google Meet.
Legal basis: steps you ask for before a possible contract (Art. 6(1)(b) GDPR). Cal.com processes this data on my behalf under its data processing agreement; the data is stored in the USA, and Cal.com is certified under the EU-U.S. Data Privacy Framework. On its own pages Cal.com also collects technical data for its own purposes, described in Cal.com’s privacy policy.
Calls
With your agreement, I use Granola (Granola, Inc., USA) to transcribe our calls and draft notes, so I can listen instead of writing. I ask at the start of the call and turn it off if you prefer. Granola transcribes as we talk and doesn’t keep the audio. I’ve turned off the setting that would let Granola use our calls to train its AI. The transcript and notes are stored in the USA and kept like other emails and notes about our conversation (see the section “How long data is kept”).
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, also during the call. Granola processes this data on my behalf under its data processing agreement, which includes the EU standard contractual clauses for transfers to the USA.
If you write to me by email, I receive your email address and what you write, and use them to respond to you. My email, calendar, and Google Meet run on Google Workspace, so the contact form’s emails, booked calls, and calls in Google Meet are processed by Google too.
Legal basis: steps you ask for before a possible contract and our work together (Art. 6(1)(b) GDPR), and otherwise my legitimate interest in responding to messages (Art. 6(1)(f) GDPR). Google processes this data on my behalf under its Cloud Data Processing Addendum. Data may be processed in the USA; Google is certified under the EU-U.S. Data Privacy Framework.
How long data is kept
I keep enquiries, bookings, emails, and call notes as long as I need them to respond and for any work that follows. If no work follows, I delete them at the latest two years after our last contact. Where the law requires me to keep business records longer, I keep them for that period.
The services above keep their data for these periods:
- Cloudflare’s logs: a short time
- Visit statistics in Umami: six months
- Emails sent through Resend: 30 days
Your rights
You can ask me at any time:
- which data about you I have (access)
- to correct it
- to delete it
- to limit how I use it (restriction)
- for a copy in a common format, for you or another provider (portability)
Where I rely on my legitimate interest, you can object to the processing. Where I rely on your consent, you can withdraw it at any time; this doesn’t affect what happened before.
To use any of these rights, write to chris@chrishennigfeld.com. I respond within one month, free of charge. You also have the right to complain to a data protection authority, in particular in the EU country where you live or work.
Changes
I update this policy when the site or the services I use change.
Last updated: 20 October 2026