Privacy policy
This site sets no cookies and stores nothing in your browser, and it loads no fonts or scripts from other domains. The only personal data it processes is what you type into the enquiry form, plus anonymous page-view statistics and the technical data every web server records.
Controller
Manuel Merki, 8706 Meilen, Switzerland — hello@manuelmerki.com
Processing is governed by the Swiss Federal Act on Data Protection (FADP). Where you are in the EU or EEA, the GDPR applies in addition.
Enquiry form
When you submit the form, the following is sent to me by email: your name, your company (optional), your email address, and your description of what you want to achieve. Your IP address and the time of submission are added to that email so that abuse can be traced.
- Purpose: answering your enquiry and preparing a possible engagement.
- Legal basis: steps taken at your request before entering into a contract, and my legitimate interest in responding to business enquiries and keeping the form free of abuse. Under the GDPR, where it applies, this is Art. 6(1)(b) and (f); under the FADP, processing in direct connection with the negotiation of a contract is justified under Art. 31(2)(a).
- Retention: no fixed period. Enquiry emails stay in my mailbox for as long as the enquiry or the engagement arising from it gives reason to keep them — an open conversation, a running mandate, or its documentation. Once none of that applies, the email is deleted. Where an enquiry leads to a contract, the statutory ten-year retention period for business records applies (Art. 958f CO).
- Voluntary: providing this data is voluntary. Without an email address I cannot reply.
Spam protection
Three measures keep the form usable, all based on my legitimate interest in not being flooded:
- Submissions from the same IP address are limited to roughly five per ten minutes. The IP is held in the server's working memory to count them.
- The form carries a field that is hidden from you but visible to automated scripts. If it is filled in, the submission is discarded.
- The form records when it was opened, and a submission completed in under 2.5 seconds is discarded as automated. No other behaviour of yours is measured.
Discarded submissions are neither stored nor sent on. Be aware that in the last two cases the page still shows a confirmation — this is deliberate, so that automated scripts learn nothing from the response. If you do not hear back from me, please write to hello@manuelmerki.com directly.
Hosting and server logs
The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, acting as my processor. Delivering a web page necessarily involves processing technical data — IP address, requested URL, time of the request, referrer and browser user agent — to serve the site and defend it against attacks. That is my legitimate interest in secure, functioning hosting. See vercel.com/legal/privacy-policy.
The enquiry form is processed by a server function located in Frankfurt, Germany. The pages themselves are delivered over Vercel's global edge network, so the page you are reading may have been served from a location closer to you.
Each successful submission writes your email address and company name to that provider's function log, so that deliveries can be traced. If the email cannot be sent, or if the form is not configured, the complete submission — including your IP address and everything you wrote — is written to the log instead, so that your enquiry is not lost and I can answer it by hand. These logs are deleted on the provider's own schedule.
Email delivery
Form submissions are delivered by Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA, acting as my processor. See resend.com/legal/privacy-policy. Once the email reaches me, it is held by my email provider, likewise as a processor.
Transfers abroad
Both providers named above are based in the United States and are certified under the EU–U.S. Data Privacy Framework. Their data processing agreements additionally incorporate the EU Standard Contractual Clauses, which also carry the transfer from Switzerland.
Cookies
None. No cookies are set, no data about you is stored in your browser, and no advertising networks are involved. The fonts are served from this domain, so browsing the site sends no request to Google Fonts or any other third party.
Analytics
To see which pages are read, I use Vercel Web Analytics, provided by the host named above and acting as my processor. It is cookieless: rather than storing an identifier on your device, it derives a hash from your request, which is discarded after 24 hours.
Each page view records the page address, the referring site, an approximate location derived from your IP address, your device type, and your browser and operating system. The IP address itself is not stored. The result is aggregated statistics that cannot identify you, build a profile, or follow you to other websites. This rests on my legitimate interest in understanding which parts of the site are useful.
External links
The site links to LinkedIn, and this page links to the two providers named above. Once you follow such a link, the privacy policy of that provider applies.
Your rights
You may ask me whether I hold personal data about you and request a copy of it. You may also have it corrected, deleted or its processing restricted, object to processing based on legitimate interest, and receive the data you gave me in a machine-readable format.
Write to hello@manuelmerki.com. I answer within 30 days and free of charge. If I need to establish who you are before answering, I will ask.
You can also lodge a complaint — in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU or EEA with your local supervisory authority.
Security
The site is served over HTTPS and instructs your browser to use it for a year, so what you type into the form is encrypted in transit.
Changes
This policy describes what the site does today. It will be updated when that changes. Last updated: 28 July 2026.