Privacy

This is the privacy policy for ulrichlehner.com (also served at www.ulrichlehner.com), the personal portfolio of Ulrich Lehner. It is a static, pre-rendered site with no user accounts or logins. This page documents the actual deployed behavior, not aspirational copy from a template. If you find a discrepancy between this page and what the site actually does, that's a bug.

Who is responsible (controller)

The data controller for this site is Ulrich Lehner. The full legal imprint, including postal address and the contact for legal and privacy matters, is hosted at www.inspirespace.co/imprint/; this site does not host a separate imprint. To exercise a data-subject right or ask a privacy question, see the Contact section at the end of this page.

What we collect and why

The site uses Matomo for visitor analytics, configured to need no cookie banner under GDPR and ePrivacy. Concretely, the Matomo client integration:

• Sets no cookies. The disableCookies flag is on. There is no persistent identifier stored in the browser between visits.
• Anonymises IP addresses at the source. IPv4 addresses are truncated to /16 (the last two octets are dropped); IPv6 addresses are truncated to /80. The full IP never reaches the analytics database.
• Does not perform cross-session visitor identification. No User-ID tracking, no fingerprinting, no behavioural profile assembly across visits.
• Honors the Do-Not-Track signal. If your browser sends DNT: 1, no page-view event is recorded for you. (Most modern browsers no longer expose DNT in their UI; the implementation still honors it where browsers send it.)
• Excludes features that would require explicit consent. Heatmaps, session recording, A/B testing, and marketing-attribution tracking are not installed.

For each page view that does get recorded, the following data is collected: the URL viewed, the referrer URL (the page you arrived from, if any), your browser's User-Agent string, your screen size, the rough country derived from the anonymised IP, and a UTC timestamp. The purpose is limited to understanding which content is read and how visitors arrive, so the site can be maintained and improved.

Legal basis

For visitors in the EU/EEA, the lawful basis for the analytics described above is legitimate interest under GDPR Article 6(1)(f): the operator's interest in understanding aggregate usage of the site. Because the analytics are cookieless, IP-anonymised, honor Do-Not-Track, and build no cross-session profile, the impact on your privacy is minimal and is not outweighed by that interest. No processing on this site relies on consent, because nothing here requires it.

Cookies and local storage

This site sets no cookies. Matomo runs in its cookieless mode (see What we collect and why above), so no visitor, session, or referrer cookie is written to your browser.

The site does store two first-party functional values in your browser's local storage. Neither is a tracking identifier:

• theme holds your light or dark appearance choice.
• matomo-optout is set only when you use the analytics opt-out below, so your preference is remembered across visits.

Both stay on your device, are never sent to a server, and you can clear them at any time through your browser settings.

The only additional browser storage that can be set comes from third-party video embeds, and only if you choose to load and play them. See Third-party processors below.

Third-party processors

The following parties process data on behalf of, or as a consequence of, this site:

• Cloudflare (hosting and CDN). Serves the static site. As the network layer, it may process connection metadata such as your IP address and User-Agent in transient server logs to deliver content and protect against abuse.
• Self-hosted Matomo (analytics). Runs on a server operated for this site, not on Matomo Cloud or any third-party analytics service. Your page-view data is not handed to Matomo's company (InnoCraft), an ad network, or any other processor. The operator of this site is the sole controller of the analytics data, and the specific instance hostname is configured at deploy time.
• Vimeo and YouTube (video embeds). Loaded only on portfolio pages that embed a video, and only when the embed enters view. Details below.

Fonts are self-hosted (bundled with the site via @fontsource-variable), so no request is made to Google Fonts or any other font CDN and no font provider receives your IP address.

Video embeds

Some portfolio entries embed videos hosted by third parties. Viewing such a page loads a player iframe from the provider's domain, and that provider independently collects data once the player loads or you interact with it. Two providers are used:

• Vimeo. The player iframe loads from player.vimeo.com. Vimeo collects data when the embed loads and when you interact with it. See Vimeo's privacy policy.
• YouTube. Embeds use the privacy-enhanced youtube-nocookie.com domain, so YouTube does not set tracking cookies until you press play. It still collects data once you start the video. See Google's privacy policy.

In both cases the player is lazy-loaded: nothing is fetched from the provider until the iframe scrolls into view. If you don't want to load a video player, navigate away from the page before scrolling down to the embed.

No other third-party scripts, fonts, trackers, advertisements, or social widgets are loaded.

Your rights

If you are in the EU/EEA (or a jurisdiction with comparable law), you have the right to access, rectification, erasure, restriction, objection, and data portability for any personal data processed about you, and the right to lodge a complaint with a supervisory authority. Given how little this site collects (cookieless, IP-anonymised analytics with no cross-session identifier), there is usually no record tied to you as an individual to act on. To exercise any right, use the contact at the end of this page.

You can opt out of analytics at any time. The toggle below stops Matomo from loading on any page you visit, and your choice is remembered in local storage (not a cookie). You can also turn on Do Not Track in your browser, which the tracker honors before it loads, or block it with a browser extension (uBlock Origin, Privacy Badger, similar). The site works identically either way.

Changes to this policy

This page documents the deployed configuration. When the analytics integration changes (for example, if the Matomo instance moves to a different host, or a new third-party script is added), this page is updated to reflect reality before the change ships. The "Last updated" date shown on this page tracks the most recent substantive change.

Contact

For privacy-related inquiries or data-subject requests (access, correction, deletion of any data the site's self-hosted Matomo holds about you), contact the person responsible via the email address listed on the imprint page.