Maia Karnecka — karnecka.dev
The responsible party (POPIA) and data controller (GDPR) for this site is:
Maia Karnecka, trading as karnecka.devInformation Officer (POPIA s56): Maia Karnecka, contactable at the address above.
| What | Why I collect it | Legal basis |
|---|---|---|
| What you type into either chat | To generate the reply you asked for. There is no other way to hold the conversation | POPIA s11(1)(b) performance of a contract / pre-contractual steps at your request; GDPR Art. 6(1)(b) |
| Your enquiry answers, if you press Send | To email myself your enquiry so I can respond to it | POPIA s11(1)(b); GDPR Art. 6(1)(b) |
| Any email address you type while answering | It may become the reply-to address and appear in the subject line of the email I send myself | POPIA s11(1)(f) legitimate interests; GDPR Art. 6(1)(f) |
| The network (IP) address your browser sends | To stop the chat being flooded by bots, and to keep my costs bounded | POPIA s11(1)(f); GDPR Art. 6(1)(f) |
| Your palette and light/dark choice | So the site looks the way you left it. Stored in your own browser; it never reaches me | Not personal information in my hands — it never leaves your device |
Supplying any of this is entirely voluntary (POPIA s18(1)(d)). If you supply nothing, nothing happens to you: you can read every page of this site without typing anything. The only consequence of not using the chat or the enquiry form is that I cannot answer you through them — you can email me directly instead (POPIA s18(1)(e)).
No law requires me to collect any of it (POPIA s18(1)(f)).
Read this part even if you skip the rest.
Every message you send in either chat is transmitted to Anthropic PBC (United States) the moment you send it — not when you finish the conversation, and not when you press "Send to Maia". By the time the Send button appears, everything you typed has already left South Africa.
The Send button only emails me the conversation. It is not the moment your information travels.
This page also sends the single word "ping" to my own server when it loads, to check the chat is working. Nothing about you or your visit is in that check.
Your information is transferred to the United States (Anthropic) and to the European Union, Ireland (Resend, eu-west-1).
The ground I rely on (POPIA s72(1)(c)): the transfer is necessary for the performance of a contract between you and me, or for pre-contractual measures taken at your request. You asked the agent a question; sending your words to the model is the only way to answer it.
The level of protection there (POPIA s18(1)(g)):
Anthropic (US) — the United States has no POPIA adequacy finding and no EU adequacy decision of general application. Protection rests on Anthropic's own contractual terms and security commitments, not on US law being equivalent to POPIA. Stated plainly because s18(1)(g) requires the level of protection to be disclosed, not assumed.
Resend (EU, Ireland) — inside the EU, subject to the GDPR.
| Recipient | What they get | Where |
|---|---|---|
| Anthropic PBC | Everything you type into either chat | United States |
| Resend | The enquiry email — full conversation content, and your address if you gave one | EU (Ireland) |
| Google (Workspace) | The enquiry email, once it arrives in my inbox | Google infrastructure |
| Vercel | Hosting. On an error, a short fragment of an error message may appear in hosting logs | United States / global edge |
I do not sell your information, and I do not share it for advertising.
| Held by | Period |
|---|---|
| Anthropic | Deleted within 30 days — unless flagged for review under their usage policy, in which case up to 2 years |
| Resend | 30 days, and this includes the content of the email, not only its metadata |
| My inbox (Google) | Indefinitely, until I delete it — it is ordinary business correspondence |
| The IP address | Held only in server memory, never written to a database. The chat keeps it for a rolling one-minute window; the enquiry form keeps it for a rolling one-hour window. Both are lost entirely whenever the server restarts |
| Your browser storage | Until you clear it. It never reaches me |
I do not currently log conversations to any database of my own, and I run no analytics on this site. If that changes, this policy changes first.
Under POPIA you may: access the information I hold about you (s23) · ask me to correct or delete it (s24) · object to processing carried out on the legitimate-interests basis in §2, on grounds relating to your particular situation (s11(3)) · and complain to the Information Regulator.
Under the GDPR, where it applies to you, you additionally have rights of restriction, portability, and to object, and you may complain to your own national supervisory authority.
To exercise any of these, email maia@karnecka.dev.
One honest limitation. Nothing on this site identifies which conversation is yours — there is no account, no session identifier, no cookie that ties a conversation to a person. So I cannot look up "your" conversation on request. If you want something removed, tell me roughly when you spoke to the agent and what it was about, and I will act on that. This is a deliberate consequence of collecting as little as possible.
The agents on this site answer questions and collect enquiry details. They do not make any decision that produces a legal effect for you or similarly significantly affects you (POPIA s71; GDPR Art. 22). Whether I take on work, and on what terms, is decided by me, in person.
Information in transit is encrypted (HTTPS). My email account uses multi-factor authentication. No system is perfectly secure. Should a security compromise occur, POPIA s22 requires me to notify the Information Regulator and, where required, you.
This site is not directed at children, and I do not knowingly collect the personal information of anyone under 18. Please do not use the chat if you are under 18.
I will update this policy the day anything above changes — not before, not after — and change the "Last updated" date at the top.
PAIA manual →