Privacy Policy

Overview

This is the personal portfolio website of Marcelo Otero Zamora, professionally known as "Marcelo Otero" ("I", "me", "my"), located at marcelootero.com. I respect your privacy and am committed to being transparent about how this site works. This policy explains what data is collected and how it is used.

Analytics and Tracking

This site uses PostHog to understand how visitors interact with the site. This tool may collect:

• Pages visited and navigation patterns
• Click and scroll behavior
• Browser type, device, and screen size
• Referring URL
• Approximate geographic location (country/region level)
• Web performance metrics (page load times, core web vitals)

PostHog may also record anonymized session replays (mouse movements, clicks, and scrolling) and generate heatmaps to help me understand how visitors navigate the site. These recordings do not capture passwords, payment details, or other sensitive form inputs. I have conducted a balancing test and determined that the limited nature of this data (anonymized, no sensitive inputs captured) supports a legitimate interest basis. You can opt out at any time by enabling "Do Not Track" in your browser or using an ad blocker.

Analytics data is used solely to improve this website. It is not sold to or shared with third parties for advertising purposes.

Contact Form

When you submit the contact form, I collect your name, email address, and message. This information is sent via Resend and delivered directly to my email. I use it only to respond to your inquiry. Your contact details are not added to any mailing list, database, or marketing system.

AI Chat Widget

This site includes an AI-powered chat widget that can answer questions about my professional experience. Messages you send are processed by OpenAI's API to generate responses. Your chat messages are not stored on my servers. OpenAI processes them as a data processor under my instructions, subject to a data processing agreement. OpenAI's handling of data is further governed by their privacy policy. Free-form messages you type are not stored on my servers or tracked by analytics. If you click one of the suggested starter questions, the question text is recorded as an analytics event to help me understand which topics visitors are interested in.

Cookies and Local Storage

PostHog uses cookies and local storage to distinguish unique visitors and maintain session continuity. These are functional cookies used for analytics purposes only.

This site respects the "Do Not Track" browser setting. If your browser sends a DNT signal, analytics are disabled automatically. You can also block analytics by using a browser ad blocker.

This site does not use advertising cookies or third-party tracking pixels.

Legal Basis for Processing

Where the EU General Data Protection Regulation (GDPR) applies, the legal bases for processing your data are:

• Legitimate interest for analytics cookies and session recordings (based on a documented balancing test), used to improve the site experience
• Legitimate interest for processing contact form submissions to respond to your inquiry
• Legitimate interest for processing AI chat messages to provide the chat functionality you initiated

Data Retention

• Analytics data: PostHog retains session recordings for 90 days. Other analytics data is retained in accordance with PostHog's standard retention policies.
• Contact form submissions: your name, email, and message are delivered to my email inbox and retained there until I delete them. No separate database stores this information.
• Chat messages: not stored on my servers. OpenAI may retain data per their own policies.

Third-Party Services

This site relies on the following third-party services:

• Vercel for hosting, deployment, and performance monitoring (Speed Insights)
• PostHog for product analytics, session replays, and heatmaps
• OpenAI for processing AI chat responses
• Resend for processing and delivering contact form emails

Each service operates as a data processor and has its own privacy policy governing how they handle data. I have data processing agreements in place with each provider to ensure your data is handled in compliance with applicable data protection laws.

International Data Transfers

All third-party services used by this site (Vercel, PostHog, OpenAI, Resend) are based in the United States. If you are visiting from outside the US, your data may be transferred to and processed in the US. These transfers are safeguarded by Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework, as implemented by each service provider.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Opt out of analytics: enable "Do Not Track" in your browser or use an ad blocker
• Access: request a copy of any personal data I hold about you
• Deletion: request that I delete personal data associated with your visit
• Rectification: request correction of inaccurate data
• Portability: request your data in a portable format

California residents may also have rights under the CCPA, including the right to know what personal information is collected and the right to request deletion. This site does not sell personal information.

To exercise any of these rights, please contact me. I aim to respond within 30 days (or 45 days for California residents, as permitted under the CCPA).

Right to Complain

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed in violation of applicable law.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, I will notify affected individuals and relevant authorities as required by applicable law, including within 72 hours where required by the GDPR.

Children's Privacy

This site is not directed at children under the age of 13. I do not knowingly collect personal information from children. If you believe a child has provided personal data through this site, please contact me so I can remove it.

Changes to This Policy

I may update this policy from time to time. Changes will be reflected on this page with an updated date.

Contact

If you have questions about this policy, reach out at privacy@marcelootero.com.