This developer portfolio, tech showcase, and blog are operated by Manh Quy (referred to as "we", "us", or "the author"), serving as the designated Data Controller.
We follow the principle of strict data minimization: we only collect information that is strictly necessary to answer your messages, maintain server security, and deliver an optimal developer experience.
We collect and process personal data in two well-defined categories:
- Information you provide voluntarily: When submitting contact requests or commenting on articles, we collect your name, email address, optional website link, and message body.
- Interactive AI conversations: Prompts and messages submitted when testing the AI chat assistant on our Contact page.
- Automatic telemetry & logs: Truncated IP addresses, operating system, browser user-agent, access timestamps, and page engagement metrics for security monitoring and performance diagnosis.
- Administrative credentials: For authorized admin panel access, session authentication tokens managed via Firebase Authentication.
- Article like state: The functional post_like_visitor cookie contains a random 128-bit browser identifier, not an account identity and not derived from IP or User-Agent. The server stores only its SHA-256 hash as the Firestore like-record key, together with the like timestamp, to read your actual state and prevent duplicate count changes when requests are replayed.
Under Article 11 of Vietnam Decree 13/2023/ND-CP and Article 6 of the EU GDPR, we process personal data under the following legitimate grounds:
- Consent: Freely given when you submit a contact inquiry, participate in discussions, or engage with our AI assistant.
- Pre-contractual & Contractual steps: Communicating regarding engineering projects, technical consultations, or job opportunities.
- Legitimate interests: Defending server infrastructure against DDoS attacks, detecting spam, and maintaining platform uptime.
We integrate generative AI providers (Google Gemini API and, when configured, other OpenAI-compatible services such as NVIDIA NIM) for the following dedicated capabilities:
- Automated message classification: Classifying incoming contact submissions (e.g. recruitment opportunities, project collaborations, spam) to streamline author review.
- Interactive Portfolio Assistant: Responding to general questions about the author skills, experience, and tech stacks.
- Blog drafting support: The system periodically reads public titles, links, and summaries from technology RSS feeds and uses AI to draft articles. Drafts always remain unpublished until the author reviews and approves them. This pipeline processes public feed content, not your personal data.
- AI data safeguards: Data sent to each AI provider is governed by that provider own data terms (for example, Google Cloud enterprise API terms). Your contact-form data is never fed into the blog drafting pipeline.
- Security Guidance: Do not disclose confidential credentials, proprietary code, or financial information within the chat window.
To ensure high resilience and low latency, we rely on established third-party sub-processors who adhere to stringent security standards:
- Google Firebase & Firestore (US/Singapore): Identity authentication, persistent database for contact inquiries and comments.
- Vercel Inc. (US): Edge hosting, serverless functions, and web content delivery.
- Cloudinary Ltd. (US/EU): Cloud-based media storage, dynamic optimization, and asset delivery.
- Microsoft Graph & SMTP: Secure email routing to deliver user messages to the author inbox.
- Google Cloud (Gemini API): Natural language inference for automated classification and chat.
- NVIDIA (NVIDIA NIM API): Language model inference for classification/chat and blog draft generation from public RSS sources (public content, not your personal data).
Due to the globally distributed architecture of cloud infrastructure, data may be processed in Singapore, the United States, or the European Economic Area.
All international transfers comply with Article 25 of Decree 13/2023/ND-CP and Chapter V of GDPR through Standard Contractual Clauses (SCCs) and strict data processing agreements with our cloud vendors.
We retain personal information only as long as necessary to fulfill the intended purposes:
- Contact inquiries: Retained for up to 24 months after the last communication, after which records are purged permanently.
- Blog comments: Retained alongside the published article unless you request removal.
- Server access logs: Automatically rotated and erased within 30 days.
- post_like_visitor cookie: Expires 180 days after creation without automatic renewal; you may clear it earlier in your browser. Hashed like records remain on the server until you unlike using the same cookie or an erasure request is fulfilled. Cookie expiry/deletion does not automatically remove prior likes; legacy post_like_* localStorage keys no longer determine like state.
Under Article 9 of Vietnam Decree 13/2023/ND-CP and GDPR Articles 15-22, you are entitled to the following rights:
- Right to know & Right to consent: You have the right to be informed about how your data is handled and withhold consent.
- Right to access: You may request a copy of the personal data we hold about you.
- Right to rectification: You may request correction of outdated or incomplete information.
- Right to erasure ("Right to be forgotten"): You can request permanent deletion of your contact records and comments.
- Right to withdraw consent: You may withdraw your consent to data processing at any time.
- Right to lodge a complaint: You have the right to submit concerns to competent data protection authorities.
We implement defense-in-depth security measures to protect against data leakage, loss, or unauthorized alteration:
- Encrypted transit: All traffic is enforced over HTTPS utilizing modern TLS 1.3 cryptographic suites.
- Cookie security: Sensitive cookies carry HttpOnly, Secure, and SameSite flags to thwart XSS and CSRF vectors.
- Database segregation: Firestore Security Rules restrict read/write permissions exclusively to validated users and server actions.
To exercise any of your data protection rights, or if you have inquiries regarding our data practices, contact our Data Protection Lead:
- Data Protection Lead: Manh Quy
- Dedicated Email: hello@manhquy.id.vn
- Fulfillment SLA: We acknowledge receipt of requests within 72 business hours and fulfill valid erasure or export requests within 30 calendar days.