Privacy and cookies

Who is responsible

Torio ehf. is the data controller for Jakob’s portfolio. For privacy enquiries, access or deletion requests, contact hello@jakobinn.com.

• Contact about privacy

Your optional choices

Visit and click statistics: PostHog and Vercel measure page visits, navigation and contact-link clicks. Heatmaps and session replay: Microsoft Clarity records page interactions, clicks and scrolling to help understand how the site is used.

Both purposes are off until you opt in. The legal basis is consent under Article 6(1)(a) GDPR. Accept all enables both; Reject all disables both; Save preferences applies only your selected purposes. Reading this policy, continuing to browse or contacting me does not grant consent. No advertising tags are configured; Clarity receives advertising storage consent as denied.

A decision lasts 180 days, without being renewed on each visit. Use Cookie settings in the footer or on this page to change or withdraw either purpose. Closing settings without saving discards your changes. Withdrawal stops future collection, removes accessible storage for that purpose and reloads when needed. It does not erase earlier provider-held data or affect the lawfulness of processing before withdrawal.

The local ad-blocker check makes no provider requests. When it detects a cosmetic blocking rule, it leaves analytics off for that page visit without recording an explicit consent decision. You can still open settings. Existing saved choices take precedence.

PostHog statistics

PostHog receives page-view and page-leave events, browser/device information, pseudonymous identifiers, and named WhatsApp or business-card link events. This implementation disables automatic capture of form/element content, session recording, heatmaps, surveys and advertising campaign identifiers. It removes query strings and fragments from URL properties and sends referrers as origins only.

The project uses PostHog’s US service. Its event-data retention period is one year. That period concerns analytics events; it is not a promise that exports or all account data are deleted at that point. Cookie expiry and provider retention are different. Requests to delete existing data can be sent to the privacy contact above.

• PostHog privacy
• PostHog event retention

Vercel Analytics

Vercel measures visits and clicks only when statistics are enabled. It receives page URLs, referrer and device information, and click metadata. Our page URL filter removes query strings and fragments. Custom click events omit form fields, contact addresses and external URL paths and queries.

Vercel describes a cookie-free visitor identifier discarded after 24 hours. This is not a maximum retention period for the analytics data. Vercel may retain data beyond the dashboard reporting window. Its published documentation does not establish a fixed maximum deletion deadline for this project. We require consent rather than claiming a cookie exemption.

• Vercel Analytics privacy
• Reporting windows and retention

Microsoft Clarity replay

Clarity receives page URLs, device information, pseudonymous identifiers and interactions to produce heatmaps and session recordings. Data is shared with Microsoft, which processes it under its Privacy Statement, including to provide and improve its services. Microsoft describes itself as a controller for Clarity data. This purpose is independently optional.

Microsoft publishes 30 days for playback data and nine months for click/heatmap data and labelled or favourite sessions. The consent interface is masked from recordings. Do not include sensitive information in website URLs. Browser-cookie lifetimes are listed below.

• Microsoft Privacy Statement
• Clarity data retention
• Clarity cookie details

Hosting, contact and external links

Vercel also hosts the website and processes technical requests, including IP addresses, to deliver and protect it. Necessary delivery and security are based on the legitimate interest in operating this website. They are separate from optional Vercel Analytics.

Email, WhatsApp and LinkedIn links open services you choose to contact me through. Those services apply their own privacy notices; this site’s choices do not automatically transfer to them. I use the contact details and message you send to respond and discuss your request, based on steps you request before a contract or the legitimate interest in responding to other enquiries. Analytics consent is not required to contact me. Retention of correspondence and client records depends on the purpose and applicable obligations; a specific client engagement may need separate information.

International processing

PostHog uses its US endpoint for this project. Microsoft and Vercel may also process data outside the European Economic Area. Their published terms describe safeguards such as adequacy decisions and standard contractual clauses where applicable. You can request information and copies of applicable safeguards through the privacy contact. Consent to analytics is separate from the safeguards required for international transfers.

• PostHog processing terms
• Vercel processing terms
• Clarity privacy and transfers

Your rights and updates

Where applicable, you can request access, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent. Contact the email above; I may need information to locate your pseudonymous records and verify the request. You may complain to the supervisory authority where you live or work or where an alleged infringement occurred, including the AEPD in Spain.

This notice is updated when the site or processing changes. Material changes to optional purposes or providers require a new consent choice. Existing bundled acceptances are not reused for the new separate purposes.

• AEPD: data protection rights

Browser storage

Cookies are small files stored by your browser. Local storage stays in that browser until removed; session storage normally lasts for the tab’s session. A provider’s cookie on this site’s domain still involves that third party.

portfolio-analytics-consent-v2

Necessary local storage: records each purpose, notice version and decision date. Valid for 180 days; expiry is checked when the site runs. The old v1 acceptance is not reused.

NEXT_LOCALE

Necessary language preference cookie, normally a browser session cookie under the current language configuration.

card-welcome-dismissed

Necessary session storage: remembers that you closed the business-card contact panel, normally until the tab’s session ends.

payload-theme

Legacy theme preference, if present in local storage. The current site uses the light theme. A stored preference remains until it is cleared.

ph_* / __ph_opt_in_out_*

Statistics only: PostHog visitor/session identifiers and SDK state. Its analytics cookie is configured for 180 days from a write, with no sharing across subdomains. Session data may last for the tab; legacy local storage and SDK consent markers can remain until cleared. Withdrawal or consent expiry clears accessible PostHog storage.

_clck / _clsk

Replay only: Clarity visitor preferences/identifier (_clck, up to one year) and session grouping (_clsk, up to one day). Withdrawal removes these accessible first-party cookies. Microsoft lists any additional provider-domain cookies in its cookie documentation.