Privacy policy.

This policy explains what personal data alexyhmedia.com handles, why, who else sees it, how long it is kept, and what you can do about it. It is written in plain language on purpose. If anything here is unclear, email me and I will explain it.

1. My privacy posture

The things most privacy policies bury, stated first:

• I have never sold personal data, and I never will. There is no arrangement under which anyone pays me for it.
• I do not share your data for anyone else's advertising, and I do not run retargeting on people who visit this site.
• Analytics only runs if you agree to it. Decline and no request is made to Google at all.
• There is no advertising pixel, no session recording, no heatmap tool, and no cross-site tracking on this site.
• Contacting me does not put you on a mailing list.

Everything else I hold is what you deliberately sent me.

2. Who is responsible for your data

The data controller is Ay Marketer LLC, a Wyoming limited liability company trading as AlexYh Media, run by Alex Yh, who works from Thailand. There is no privacy department and no data protection officer, because there is one person here. Email alex@alexyhmedia.com and it reaches me.

3. Information I collect

3.1 What you give me

The contact form collects your name, email address, business name, and your message. Business name is optional; the rest are needed for me to reply.

The form also contains a hidden field that humans never see. If it is filled in, the submission is treated as automated and discarded without being read or stored. There is also a minimum fill time; anything submitted faster than a person could type is discarded the same way.

If you book a call, the calendar collects whatever you enter into it, which is typically your name, email address, and any notes you add.

3.2 What is collected automatically

Server logs, kept by the host, record IP address, browser user agent, the page requested, and the time of the request. These exist for security and reliability.

When a contact form submission is emailed to me, the originating IP address is included so that abuse can be identified and rate limited.

If you accept analytics, Google Analytics 4 records the pages you view, approximate location derived from IP at city level, device and browser type, and how you arrived — for example from a search engine or a link. Advertising features and Google Signals are not enabled.

3.3 What I do not collect

• No payment details. Nothing is sold on this site and no card is ever entered here.
• No accounts and no passwords. There is nothing to register for.
• No special category data as defined by the GDPR — health, biometrics, political opinions, religion, sexuality, and the rest. Please do not send any.
• No data bought from brokers, scraped, or appended from third-party sources.

4. How I use your information, and on what basis

Each purpose, the data it uses, and the lawful basis under Article 6 of the GDPR:

• Replying to your enquiry — name, email, business name, message. Basis: legitimate interest in responding to someone who contacted me.
• Holding and preparing for a booked call — booking details. Basis: steps taken at your request before entering a contract.
• Carrying out the work, if we go on to work together — whatever the engagement requires. Basis: performance of a contract.
• Keeping the site working and blocking abuse — IP address, user agent, request logs. Basis: legitimate interest in security. Submissions are rate limited to five per IP address per hour.
• Understanding which pages are worth keeping — analytics data. Basis: your consent, which you can withdraw at any time.
• Meeting accounting and tax obligations — records of actual client work. Basis: legal obligation.

Where the basis is legitimate interest, you can object and I will stop unless I have a compelling reason not to. Where the basis is consent, withdrawing it is as easy as giving it.

5. Cookies and similar technologies

This site sets no cookie of its own. Analytics cookies are set only after you accept them, and the consent prompt appears before anything loads.

The preferences panel separates cookies into categories, and states plainly which are actually in use here:

• Essential — always on. This site sets none of its own; the embedded booking calendar sets its own if you interact with it.
• Analytics — Google Analytics. Off until you accept. This is the only category that does anything on this site.
• Personalisation — not used.
• Marketing — not used.

You can change your choice at any time using the Cookie preferences link in the footer of every page. Declining after previously accepting deletes the analytics cookies already set and stops the tag from sending anything further. Your choice is stored in your browser and re-asked after twelve months.

You can also block cookies in your browser, use a content blocker, or install Google's opt-out add-on. None of that affects your ability to use the site or contact me. Because analytics is opt-in here, Do Not Track and Global Privacy Control signals do not change anything: nothing loads unless you actively agree.

6. Who else sees your data

These are the only third parties involved, what each one receives, and their own privacy terms:

• Vercel — hosts the site and keeps the server logs described above. Privacy policy
• Resend — delivers contact form submissions to my inbox. Receives the contents of your message. Privacy policy
• LeadConnector (HighLevel) — runs the booking calendar. Receives whatever you enter into it. Privacy policy
• Google Analytics — receives analytics data, and only if you accept. Privacy policy
• Google Fonts — serves one typeface; receives your IP address as part of the request. Privacy policy
• Fontshare — serves the body typeface; receives your IP address as part of the request. Privacy policy

Beyond these, I share your information only where the law requires it, or where it is necessary to establish or defend a legal claim. If the business were ever sold, any data would transfer with it and you would be told before that happened.

7. Where your data goes

Ay Marketer LLC is registered in the United States, I work from Thailand, and the providers above run on infrastructure in the United States and elsewhere. If you are in the EU, EEA, or UK, your personal data therefore leaves your home jurisdiction when you contact me, book a call, or accept analytics.

Those transfers rely on the safeguards each provider publishes, which for the providers above means the European Commission's Standard Contractual Clauses together with their own supplementary measures. Their data processing terms are linked in the previous section. I do not make onward transfers of my own beyond what is described here.

8. How long I keep it

• Enquiries that do not become work — deleted once the conversation has clearly ended, and in any case within 24 months.
• Records relating to actual client work — kept for 7 years after the engagement ends, which is what accounting and tax obligations require, then deleted.
• Server logs — kept on the host's own schedule, which is a matter of days, not months.
• Analytics data — retained by Google for 14 months, the shortest retention GA4 offers.
• Your cookie choice — stored in your browser for 12 months, then re-asked.

If you ask me to delete something sooner, I will, unless I am legally required to keep it — in which case I will tell you which record and why.

9. Data security

Concretely, rather than in the abstract:

• The whole site is served over HTTPS. There is no unencrypted route to it.
• Form submissions are validated and length-limited in the browser and again on the server, so an oversized or malformed submission is rejected rather than stored.
• Control characters are stripped from submitted fields, which blocks email header injection.
• Submissions are delivered to me as plain text, so nothing submitted can execute anywhere downstream.
• API credentials exist only as server-side environment variables. None are present in the pages, the scripts, or any response the browser can see.
• Submissions are rate limited per IP address.
• The amount of personal data held here is deliberately small. The least risky data is the data you never collected.

No system is perfectly secure and I will not claim otherwise. If a breach ever affected your data and posed a real risk to you, I would tell you and the relevant authority within 72 hours of becoming aware, as the GDPR requires.

10. Automated decision-making

There is none. Nothing on this site profiles you, scores you, or makes a decision about you automatically. A person — me — reads every enquiry.

11. Your rights

11.1 If you are in the EU, EEA, or UK

• Access — a copy of the personal data I hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion of it.
• Restriction — a pause on what I do with it.
• Portability — a copy in a structured, machine-readable format.
• Objection — to processing based on legitimate interest, at any time.
• Withdrawal of consent — for analytics, at any time, without affecting what was lawful before.

11.2 If you are in California

Under the CCPA as amended by the CPRA you have the right to know what is collected and why, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these.

I do not sell personal information and I do not share it for cross-context behavioural advertising, as those terms are defined in that law. I do not collect sensitive personal information. There is nothing to opt out of, but the rights above stand regardless.

11.3 Everywhere else

I extend the rights in 11.1 to everyone who contacts me, whatever jurisdiction you are in. Splitting people into those who get privacy rights and those who do not seems a poor way to run a business.

11.4 How to use them

Email alex@alexyhmedia.com. There is no form and no fee. I may ask a question to confirm you are who you say you are, which is to stop someone else requesting your data, and I will respond within 30 days. If a request is genuinely complex and needs longer, I will tell you before that deadline rather than after it.

You can ask someone to make a request on your behalf; I will need to see that they are authorised.

12. Complaints

If I have handled your data badly, tell me first and I will try to put it right. If that does not satisfy you, you can complain to your national data protection authority if you are in the EU or EEA, to the Information Commissioner's Office if you are in the UK, or to your state Attorney General if you are in the United States. Complaining to them does not require my permission and does not affect any other right you have.

13. Children's privacy

This site sells business services and is not directed at children. I do not knowingly collect personal data from anyone under 16. If you believe a child has sent me information, email me and I will delete it promptly.

14. Changes to this policy

If this policy changes, the date at the top of this page changes with it. Material changes will be obvious rather than quietly slipped in, and where a change requires your consent I will ask for it rather than assume it.

15. How to contact me

Ay Marketer LLC, trading as AlexYh Media
Email: alex@alexyhmedia.com

Questions about this policy are welcome, and so are complaints. I would rather hear one directly than read it somewhere else.