# Privacy & cookies — Konstantinos Toulis

Canonical page: https://ktoulis.com/privacy.html

Updated 29 October 2026.

This portfolio is operated by Konstantinos Toulis. For privacy questions and requests, contact [kt@ktoulis.com](mailto:kt@ktoulis.com).

## Optional visit statistics

Google Analytics is optional. Its script loads only after Analytics is accepted on the production website. Rejecting it leaves the portfolio and Solution Lab available. Local and preview addresses do not load Analytics, including after acceptance.

The site strips query strings and fragments from the page address and referrer supplied to Analytics. Its Analytics code does not send business challenges or generated blueprints as events. Advertising storage, advertising personalisation and Google signals are disabled in this implementation.

Analytics can use `_ga` and `_ga_9GMWXWKC2K` cookies. Cookie settings in every page’s footer allow rejection or withdrawal. Withdrawal disables further Analytics in the page, attempts to remove accessible Analytics cookies and reloads the page when rejection has been saved, removing the loaded tag. It cannot recall data already sent.

Read [Google’s privacy policy](https://policies.google.com/privacy) and [how Google uses information from sites using its services](https://business.safety.google/privacy/).

## Browser preference

The accepted or rejected choice is kept in browser local storage for up to 180 days, with a notice version and timestamp. It applies a preference and is not used for profiling. Clearing browser data, using a different browser or expiration may cause another prompt. Storage failure never grants consent automatically. An explicit current-page choice still applies, and the interface explains when it cannot be saved.

## Optional Gemini Solution Lab

The four curated examples make no AI request. When personalised blueprints are enabled, submitting a challenge sends the description and selected public portfolio facts to Google Gemini. Leave out personal or confidential information, passwords and API keys. Blueprints are drafts for human review.

The application does not persist challenge descriptions or generated answers. They remain in the page during use. Google’s handling, retention and use depend on the API account, billing status and applicable terms. Application behavior does not establish Google’s retention. See [Gemini API terms](https://ai.google.dev/gemini-api/terms) and [Google’s privacy policy](https://policies.google.com/privacy).

## Verification and usage protection

Cloudflare Turnstile verifies browser requests when the live Lab is enabled and can process browser and network information. See [Cloudflare’s privacy policy](https://www.cloudflare.com/privacypolicy/).

The server uses a signed first-party `kt_ai_session` cookie for up to 24 hours to apply browser trial allowances. It is HttpOnly, uses SameSite restrictions and is Secure on HTTPS. It is independent of optional Analytics.

The usage ledger stores hashed session and IP identifiers, request timestamps, counters and budget reservations, not challenge descriptions or generated answers. Request allowances use rolling windows and spending accounting uses daily and monthly periods. Accounting state can remain beyond a request window; deletion after 24 hours is not promised.

## Fonts, hosting and email

Google Fonts requests occur independently of Analytics. They can disclose request metadata including an IP address to the provider. See [Google Fonts privacy information](https://developers.google.com/fonts/faq/privacy).

The host may process IP addresses, requested paths, timestamps and errors to serve and protect the site. Hosting log retention depends on hosting settings; no fixed period is claimed.

Email links open the visitor’s email application. There is no contact form or mailing-list signup. Messages sent to the owner, including contents and addresses, are processed through the email service to respond to enquiries.

## Questions and requests

Contact [kt@ktoulis.com](mailto:kt@ktoulis.com) about handling of information or access, correction and deletion where applicable. The [Hellenic Data Protection Authority](https://www.dpa.gr/en) is also available. This describes the current implementation; provider settings and services must also be considered for public operation.