Legal

Privacy policy

Effective date: 8 November 2026

Who I am

This website is run by Oka Yunior, an independent designer and website builder (trading as uyako) based in Yogyakarta, Indonesia ("I", "me"). I decide how the personal data collected through this site is used, so I'm responsible for it (the "controller" under UK/EU GDPR). Contact: oka@uyako.com.

1. Contact form

When you send the form, I receive your name, email address, the topic you pick and your message. They're sent to my inbox as an email, delivered by Resend (an email delivery service). The website itself doesn't store your message. It stays in my email inbox (Gmail) and in Resend's short delivery logs, which Resend keeps under its own policy.

Why: you ask me to reply (consent, which you give with the checkbox) and to take steps before we might work together.

2. Spam protection (Cloudflare Turnstile)

The form uses Cloudflare Turnstile to tell people from bots. To do this check, Cloudflare processes technical data such as your IP address and browser details. Turnstile isn't used for advertising or to track you across sites.

Why: my legitimate interest in keeping the form free of spam and abuse.

3. Visit statistics and ad measurement (Cloudflare, Google Analytics, Google Ads, LinkedIn)

I count visits with Cloudflare Web Analytics. It uses no cookies or local storage and doesn't track you across sites.

I also use Google Analytics, loaded through Google Tag Manager. It sets first-party cookies (named _ga) to tell new visits from returning ones, and Google processes your IP address and browser details to produce the statistics. I only see totals, such as page views, referring sites, country and device type, never who you are. I don't use it for advertising. You can block these cookies in your browser settings or with Google's opt-out add-on.

LinkedIn Insight Tag. To measure LinkedIn ads and see which kinds of companies visit (for example by industry or job function, never who you are), I use the LinkedIn Insight Tag. It sets cookies (such as li_sugr, bcookie and UserMatchHistory) and sends LinkedIn your browser details, IP address and the pages you visit. LinkedIn only shows me anonymous, aggregated reports. LinkedIn's own privacy and cookie policies apply to what it does with this data.

Google Ads. When I run Google ads, a Google Ads tag (also loaded through Google Tag Manager) records when someone who clicked an ad sends the contact form or taps WhatsApp. It may set cookies (such as _gcl_au) and sends Google your browser details, IP address and the ad click. Google may also use this to show my ads to people who visited before. I only see totals, never your name or message. Google's own privacy policy applies, and you can manage ad personalisation at My Ad Center.

Your choice. When you first visit, a small banner asks whether you accept analytics and ad-measurement cookies. If you are in the UK, EU, EEA or Switzerland, Google Analytics, Google Ads and the LinkedIn Insight Tag store no cookies until you click "Sounds good". Elsewhere they run unless you click "No thanks". You can change your choice at any time with the "Cookies" link at the bottom of every page. Your choice is saved in your browser only.

Why: your consent (UK/EU/EEA/Switzerland), or my legitimate interest in knowing which pages are useful (elsewhere).

4. Hosting

This site runs on Cloudflare. Like any web host, Cloudflare processes your IP address and request details to deliver pages and protect the site from attacks.

5. WhatsApp and email

If you message me on WhatsApp (run by Meta) or email me, I receive your name, phone number or email address, and whatever you send. Those services handle your messages under their own privacy policies. I use your messages only to talk with you and do the work.

6. Payments

If we work together, invoices can be paid by card through a secure payment provider (such as Stripe), or by Wise or PayPal. The payment provider collects and processes your payment details under its own privacy policy. I receive only what I need to match the payment to your invoice, such as your name, email, amount and the last digits of the card. I never see or store full card numbers.

Why: to take payment for work you ordered (contract), and to keep financial records (legal obligation).

7. Who else sees your data

Only the services named above: Cloudflare, Resend, Google (Gmail, Analytics and Ads), WhatsApp/Meta and, for payments, Stripe, Wise and PayPal. Each one helps deliver this site or our conversation. Some of them are based in the United States or other countries outside the UK, EU and Australia. Where the law requires it, these providers use recognised safeguards such as Standard Contractual Clauses. I don't sell or rent personal data to anyone.

8. How long I keep it

• Messages that don't lead to work: deleted within 12 months of our last contact.
• If we work together: kept for the length of the work, plus up to 5 years for tax and accounting records.
• Visit statistics hold no personal data. Cloudflare keeps them under its own policy.

You can ask me to delete your data sooner (see below).

9. Your rights

• UK and EU (UK GDPR / EU GDPR): you can ask to access, correct or delete your data, to restrict or object to how I use it, or to get a copy in a portable format. You can withdraw consent at any time. You can also complain to your data protection authority: the ICO in the UK (ico.org.uk), or your local authority in the EU.
• Australia (Privacy Act 1988 / Australian Privacy Principles): you can ask to access or correct your data. If you're unhappy with my reply, you can complain to the OAIC (oaic.gov.au).
• United States and everywhere else: I'll honour the same requests (access, correction, deletion) wherever you live.

I'll reply within 30 days, and it's free.

10. How to ask for deletion (or any other request)

Email oka@uyako.com with the subject "Privacy request". Tell me what you'd like (a copy, a correction or deletion) and the email or phone number you used to contact me. I may ask a short question to confirm it's really you. Once your data is deleted, I'll confirm by email.

11. Security

I keep access to my accounts protected with strong passwords and two-step verification. I only share client files with the people who need them for the work.

12. Children

This site is for businesses. It isn't meant for anyone under 16, and I don't knowingly collect children's data.

13. Changes

If I change this policy, I'll update it here and change the effective date at the top.