The data this site collects, and what it does not.
This site sets no cookies, runs no advertising trackers, and shows no consent banner because there is nothing to consent to. I never sell, rent or share anything collected here for marketing. Last updated 2026-09-26.
Who is responsible
The data controller is David Kabel, trading as Wardio, Slagelse, Denmark. Send questions about anything on this page, or any request under the rights listed below, to hello@wardio.net. The same person who runs the servers answers them.
Data collected
| Source | Data | Purpose | Retention |
|---|---|---|---|
| Contact form | Name, email address, an optional line about your provider or setup, your message, your IP address and the country your request came from. | To read your message and reply to it. Without it there is no way to answer you. | Held in the mailbox it is delivered to for as long as the enquiry or the client relationship is live, then deleted. |
| Spam checks | A timestamp written when the page loads, and a hidden field people never see. | To tell a person from a script without making you solve a puzzle. | Not stored. Evaluated on the request and discarded. |
| Server request log | Requested path, HTTP status, method, country, browser user-agent string, the referring site (its domain only, never the full address) and a campaign tag if the link carried one. IP address only for requests classified as automated, never for ordinary visits. | To see which pages are served, which crawlers read them, and to spot attacks against the site. | Aggregated counters, retained by Cloudflare for up to 90 days. |
| Site analytics | Page visited, referring site, country, device type, browser. No cookies and no identifier that follows you between visits or between sites. | To see which pages are read and which are ignored. | Retained by Ahrefs as aggregate counts. |
| Session recordings | Pointer movement, clicks, scrolling and page layout, recorded by Microsoft Clarity after your first interaction. Clarity runs in strict masking mode, so page text and anything you type are masked in your browser and never sent. No cookies, so each page view is recorded as a separate, unlinked session. | To see where pages confuse people or lose them, which counts alone cannot show. | Retained by Microsoft for 30 days. |
That is the complete list. There is no newsletter, no account to create, no profile built across visits, and no attempt to identify you as an individual from analytics.
Lawful basis for holding it
I process contact form data under GDPR Article 6(1)(b), to take steps at your request before entering a contract. The request log and the analytics counts rest on legitimate interest, Article 6(1)(f): keeping the site available, defending it against attack, and knowing which pages are worth writing. Both are limited to what that purpose needs. That is why the log records ordinary visits without an IP address.
Who else sees it
| Processor | Role | Location |
|---|---|---|
| Cloudflare | Hosting, CDN and the request log | EU and global edge network |
| Resend | Delivers contact form messages as email | EU region |
| Ahrefs | Cookieless site analytics | EU and United States |
| Microsoft | Clarity session recordings and heatmaps, cookieless | United States |
Each is a processor acting on documented instructions, under the standard contractual clauses where a transfer leaves the EEA. Nobody else receives anything, except where the law requires it of me.
Your rights
Under GDPR you may ask for a copy of what is held about you, ask for it to be corrected or erased, ask for processing to be restricted, object to processing based on legitimate interest, and ask to receive your data in a portable form. Email hello@wardio.net and you will get an answer within thirty days, usually the same week.
If the answer does not satisfy you, you can complain to the Danish Data Protection Agency, Datatilsynet, at datatilsynet.dk.
Servers I manage for clients
This page covers the website. A managed server is different. There I act as a processor for whatever personal data your systems hold, on your instructions, under a separate data processing agreement signed before any access is granted. Ask for it during the review and you will have it before anything is touched.