Privacy policy
Last updated 1 October 2026. This policy explains what personal data MiccaDev collects when you visit micca.dev or contact me, why it is collected, how long it is kept and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the ePrivacy rules on cookies and the Estonian Personal Data Protection Act.
1. Who is responsible for your data
The controller of your personal data is Spectrovibe OÜ, registry code 12739331, VAT number EE102235278, registered in Tallinn, Harju County, Estonia, trading as MiccaDev. For any question about this policy or your data, write to info@micca.dev. Contracts and invoices are handled through info@spectrovibe.com. No data protection officer is appointed, as the criteria in Article 37 GDPR do not apply.
2. What data is collected, why, and on what legal basis
Only data that is needed for the purpose is collected. Nothing is sold, and no automated decision-making or profiling with legal effects takes place.
Your name, your company name (if you add one), email address, the project type and budget you select, and whatever you write in the message. Purpose: to answer you and to prepare an offer. Legal basis: steps taken at your request before entering a contract (Article 6(1)(b)), or legitimate interest in replying to enquiries (Article 6(1)(f)). What you submit is stored on my server and forwarded by email to info@micca.dev, and a copy is emailed to the address you gave so you can see what you sent.
IP address, date and time, requested page, referrer, browser and operating system. Purpose: to operate the site securely, detect abuse and diagnose faults. Legal basis: legitimate interest in the security and availability of the service (Article 6(1)(f)).
Page address, referring site, browser and operating system type, device type and screen size, language, and the country and region derived from your IP address. Purpose: to see which pages are useful. The software is Umami, self-hosted on a server controlled by Spectrovibe OÜ, so nothing is shared with any analytics or advertising company. Umami sets no cookie and stores nothing on your device. It does not store your IP address either: to tell visits apart it derives a short-lived, non-reversible hash from it, and that hash changes every month, so you cannot be followed over time. Legal basis: your consent (Article 6(1)(a) and the ePrivacy rules). Nothing is loaded until you accept, and you can withdraw consent at any time through the "Cookie settings" link in the footer; tracking then stops from the next page you open.
If we work together, the contract, invoices and correspondence. Legal basis: performance of a contract (Article 6(1)(b)) and legal obligations such as accounting law (Article 6(1)(c)). Where I access systems that contain your customers' data, I act as a processor under a separate data processing agreement.
3. Cookies and similar technology
This section explains what is stored on your device when you visit micca.dev, why, and how to change your mind at any time. It follows the ePrivacy rules on storage and consent. Analytics runs on self-hosted Umami software, so no third-party tracking is installed on this site.
What a cookie is here
A cookie is a small text file a site stores in your browser. This site also uses local storage, which works the same way for your privacy: a small value kept on your device. Both are covered by this policy and both are described below.
No tracking without your yes
Nothing optional is loaded before you accept. There is no advertising network, no cross-site tracking, no social media pixels and no fingerprinting. Rejecting optional storage costs you nothing: the site works exactly the same.
What is stored
| Name | Purpose | Type | Kept for |
|---|---|---|---|
| micca-cookie-consent | Remembers whether you accepted or rejected optional storage, so you are not asked again. | Strictly necessary, no consent needed | Until you clear it or change your choice |
| micca-lang | Remembers the language you chose in the header. | Strictly necessary, no consent needed | Until you clear it |
| Umami analyticsself-hosted, first-party, sets no cookie | Counts visits and which pages are read, in aggregate, without cookies or any identifier stored on your device. Loaded only after you accept. | Optional, consent required | Nothing is stored in your browser |
The web server also keeps standard access logs (IP address, time, page, browser). Those are not cookies and are not set in your browser; they are described in section 2 above.
Changing or withdrawing your choice
Use the Cookie settings link in the footer of any page to reopen the banner and change your answer. You can also delete stored data at any time in your browser settings, usually under "Privacy" or "Site data". Withdrawing consent is as easy as giving it, and does not affect anything already collected lawfully before you withdrew.
Most browsers also let you block cookies entirely. If you block the strictly necessary ones, the site still works, but it will ask about cookies on every visit and will not remember your language.
Who can see this data
Strictly necessary values never leave your device. Optional analytics data is collected by self-hosted Umami software on a server controlled by Spectrovibe OÜ, and is never shared with or sold to analytics or advertising companies. No third-party tracking scripts are used.
4. Who else can see your data
The websites and the email server are self-hosted on servers operated by Spectrovibe OÜ, and accounting is done in-house. No hosting, email or accounting company processes your data on my behalf. Fonts are also served from my own server, so opening a page sends no request to Google or any other third party. Data may also be disclosed where the law requires it. The footer links to LinkedIn, Instagram and YouTube are plain links: nothing from those platforms is loaded until you click one, and once you do, their own privacy policies apply.
5. How long data is kept
Enquiries that do not lead to a project are deleted within 12 months. Contracts, invoices and accounting records are kept for 7 years as Estonian accounting law requires. Server logs are kept up to 90 days. Analytics data is kept for at least 14 months, so that each period can be compared with the year before. It contains no cookie, no IP address and no identifier that could be linked back to you, so under the GDPR it counts as anonymous statistics (Recital 26) and may be kept longer for that purpose. You can still ask me to delete it: I delete anything that can be attributed to you (Article 17), and on request also the analytics records for the pages and days you name. Your cookie choice and language stay on your device until you clear them or change your choice.
6. Your rights
Under the GDPR you may request access to your data, correction of inaccurate data, erasure, restriction of processing, and a copy of the data you provided in a portable format. You may object to processing based on legitimate interest, and withdraw consent at any time without affecting processing already carried out. Write to info@micca.dev and you will receive an answer within one month, free of charge.
If you believe your data is handled unlawfully, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or to the supervisory authority in your own country of residence.
7. Security
Traffic is encrypted with TLS, access to systems is limited to what is necessary and protected by strong authentication, and data is stored on self-encrypting NVMe drives. If a breach is likely to put your rights at risk, the supervisory authority is notified within 72 hours and you are informed without undue delay.
8. Children
This site is not directed at children. No data is knowingly collected from anyone under 16. If you believe a child has sent personal data, write to me and it will be deleted.
9. Changes to this policy
If this policy changes, the date at the top is updated. Material changes that affect your rights are announced on this page before they take effect.
Write to info@micca.dev. Requests about your rights are answered within one month, as described in section 6.