peham
Menu

how is my data used on this site

Privacy
policy.

How this personal website handles analytics, hosting, consent and your GDPR rights.

This privacy notice describes how personal data is processed on thomas-peham.com. It is written to meet the transparency duties of the EU General Data Protection Regulation (GDPR, DSGVO) and the Austrian Data Protection Act (DSG).

Last updated: (Europe/Vienna).

1. Controller (Verantwortlicher)

The controller for personal data processed through this website is Thomas Peham, a VAT-registered sole trader (Einzelunternehmer) acting in his own name:

Thomas Peham

Obere Bahnzeile 13
3680 Persenbeug

Austria

Email: tom@peham.io

UID-Nr.: ATU74179667

Business purpose (Unternehmensgegenstand): Marketing consulting, speaking and publishing

Thomas Peham is CEO of OtterlyAI. This website is his personal site. OtterlyAI is not the controller for this website, except where an OtterlyAI service is used as a processor as described below.

2. Hosting — Cloudflare

This website is hosted on Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and Cloudflare entities in the EU as applicable). Cloudflare provides DNS, content delivery, security (including DDoS protection) and hosting via Cloudflare Workers.

To deliver pages, Cloudflare necessarily processes technical request data such as IP address, date and time, the requested URL, referrer and user agent, for security, availability and delivery of the site. This processing is required to operate the website.

Cloudflare Web Analytics may also be used. It is a cookie-free measurement product that can collect aggregated information about visits (pages viewed, referrer, browser and operating system, and a coarse location derived from the IP address) without using cookies for analytics and without building a cross-site advertising profile.

Cloudflare may process data in the United States or other countries. Where personal data is transferred outside the EEA, Cloudflare relies on an adequacy mechanism (including the EU–US Data Privacy Framework, where applicable) and/or standard contractual clauses.

3. Content management — Storyblok

Website content is managed with Storyblok (Storyblok GmbH, Austria). The public pages are generated as static HTML. Ordinary visits to the published site do not require your browser to contact Storyblok. Storyblok is used by the site owner to edit and preview content, including a visual editor. If you are not using that editor, Storyblok does not receive your visit data from this site in the ordinary course.

4. OtterlyAI user analytics (seti.js)

On the production site, a user-analytics script from OtterlyAI (seti.js, served from t.otterly.ai) may run. It is designed to operate cookieless. A visitor ID is stored in localStorage only after you give consent. Until consent is given, the script follows Consent Mode and does not store that identifier.

OtterlyAI is a service of the company of which Thomas Peham is CEO. On this personal website it is used as an analytics service (processor) to understand how the site is used, not to run ads.

5. Google Tag Manager and Google Analytics 4

The production site may load Google Tag Manager (container GTM-PQW83R) and Google Analytics 4 (measurement ID G-LXEE8Y793L). They are configured with Google Consent Mode v2. Every consent type is denied by default (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage and personalization_storage are denied; security_storage is granted).

While consent is denied, Google receives cookieless pings only (Consent Mode signals without advertising or analytics cookies). If you accept analytics via the cookie settings, consent is updated to granted and Google may use cookies and storage as described in Google’s own documentation. IP anonymisation is requested in the Analytics configuration.

6. AI-crawler logging (OtterlyAI Agent Analytics)

Requests that appear to come from AI crawlers or AI-assistant bots (identified by the user agent) may be logged server-side in the site’s Cloudflare Worker and sent to OtterlyAI (analytics.otterly.ai). The data recorded is the requested URL, the user agent and the time of the request (and similar technical metadata). This is done to understand how AI systems crawl and cite this site. These logs are not used to track ordinary human visitors.

A consent banner and a “Cookie settings” control in the footer are provided for storage and analytics that require consent. You can change your choice later at any time. The choice is stored locally in your browser under the localStorage key tp-consent-v1.

8. Cookies and local storage

  • Your consent choice: localStorage key tp-consent-v1.
  • OtterlyAI visitor ID: stored in localStorage only after consent.
  • Google cookies: only after consent.
  • Cloudflare may set technically necessary cookies or similar technologies for security and delivery of the site.

9. Purposes and legal bases

  • Providing, securing and delivering the website, including hosting logs and protection against abuse: Art. 6(1)(f) GDPR (legitimate interests).
  • Analytics that run only after you opt in: Art. 6(1)(a) GDPR (consent). You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
  • Cookieless Consent Mode pings, security logs and AI-crawler logs: Art. 6(1)(f) GDPR (legitimate interests in understanding reach, keeping the site secure, and understanding AI-crawler traffic).
  • Responding to email you send, and meeting legal disclosure duties: Art. 6(1)(b) and/or (c) and (f) GDPR, as applicable.

10. Recipients and transfers

Depending on how you use the site, recipients may include Cloudflare (hosting, security, optional Web Analytics), Google (Tag Manager and Analytics, after the conditions above), OtterlyAI (user analytics after consent, and server-side AI-crawler logs) and Storyblok (content management, not ordinary page views). Transfers outside the EEA use an adequacy decision (including the EU–US Data Privacy Framework where a recipient is certified) and/or standard contractual clauses.

11. Retention

Server and security logs are kept only as long as needed for security, debugging and the stated analytics purposes, then deleted or aggregated. Your consent choice stays in your browser until you clear it or change it. Analytics identifiers last according to the provider’s settings and your consent.

12. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, and data portability, and the right to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority. In Austria that is the Datenschutzbehörde.

To exercise your rights, email tom@peham.io.

13. No legal advice

This notice is a good-faith description of how this website works. It is not legal advice. It may be updated when the site, its providers or the law change.