Privacy policy

Last updated: 2026-10-08

Who is responsible

Rorsa Platform, at https://platform.jimrarras.com, is a CRM and client portal. It is run by Dimitrios Rarras (Δημήτριος Ράρρας), a freelance software developer in Ioannina, Greece. He uses it to keep track of his customers, their websites and the work on them. His clients use it as their portal. This page calls him "the operator".

For most of what this page describes, the operator is the controller under the General Data Protection Regulation (EU) 2016/679 (GDPR). There is one exception: the messages that visitors send through the forms of a client's website. For those, the client is the controller. See "Messages sent through a client's website" below.

Contact for anything on this page:

• Email: demetriosrarras@gmail.com

Who this page is about

• Account holders: the operator's clients, and anyone else he works with and invites.
• People the operator sends a link to, to fill in a form or to comment on a website, without an account.
• Visitors of a client's website who sent a message through a form on it.
• Visitors of the platform's own pages, such as this page and the sign-in page.

The contact form on jimrarras.com, the operator's own website, also sends its messages to this platform. For that form the operator is the controller. That website's privacy policy describes it: jimrarras.com/en/privacy/.

Your account

Accounts exist only by invitation. An invitation holds your name, your email address and, for a client, the business you are invited for. When you accept it, the platform stores:

• your name, your email address and, for a client, the business your account belongs to;
• your password, only as a hash that cannot be turned back into the password;
• your two-step sign-in settings and your passkeys, if you turn them on;
• your language choice;
• when you were last active.

Each sign-in starts a session. A session records the IP address and the browser (user agent) of the device you signed in from. A session ends after 15 minutes without activity, and at the latest 12 hours after you signed in.

Your customer record

The operator keeps a record for each customer: the business name, a contact email address and phone number, and notes about the work.

What you send through the portal or a link

The platform stores what you give for the work on your website:

• Onboarding form. Your business name, your name, email address and phone number, your current website or the domain you want, what the website should do, and notes about your brand. When the operator approves the answers, your customer record is made from them, your brand notes are added to your brand assets, and a portal invitation is sent if one is needed.
• Questionnaires. Your answers. A file you upload as an answer is added to your brand assets.
• Page texts. The texts you write for the pages of your website. The pictures you upload for them are added to your brand assets.
• Brand assets. Logos, fonts, colours, photos, documents and approved texts, each with the history of its versions. Each version records which account uploaded it.
• Blog articles. The articles you write or propose changes to, and the notes exchanged about them.
• Approvals of security testing. When you approve the testing of a platform of yours, the name you type and your account are kept as the record of your permission.
• Monthly reports. A report on each of your websites: messages received, availability, when its security certificate expires, the site audit's score, and the change requests opened and completed. It is sent to the portal accounts of your business.

Comments on a website

You can comment on a website through a small button on the website itself. With each comment the platform stores:

• the name you are shown under, and your text;
• the page, the element you pointed at, the spot you clicked, the size of your browser window and the pixel ratio of your screen;
• the text of that element, any text you selected with a few words around it, and a short piece of the page's code (its HTML);
• anything you drew on the page;
• which version of the website you were looking at.

No IP address and no browser details are stored with a comment. For a web application that shows its own users' data, the page text and the piece of code are not stored at all.

A review link for a guest, someone without an account, also holds the guest's name and email address.

While you comment, a few small items are kept in your browser's local storage for the reviewed website. No cookies are used for this.

These items stay in your browser. Clearing the website's data in your browser removes them.

Visiting the platform

• Server logs. For each request, the server writes to its log the time, the method, the address requested, the IP address and the result. The codes in invitation and password links are removed first. The log is used to keep the platform working and to protect it from abuse.
• Protection against abuse. Requests are counted per IP address for a short time, to limit abuse. Refused sign-ins and requests are counted to detect attacks such as password guessing. These counts are kept only as one-way codes (digests) of the source and of the account, never as an IP address or an email address.
• Bot check. The sign-in page uses Cloudflare Turnstile to tell people from automated programs. Your browser loads the check from Cloudflare. The platform then sends Cloudflare the check's token and your IP address to confirm it.
• Cookies and browser storage. The portal uses cookies only to keep you signed in. Your language and display choices are kept in your browser's local storage. The platform sets no advertising or analytics cookies.

Error reports

Error reporting is switched off at present, so no error reports are sent. Before it is switched on, this page will say how long reports are kept. When it is on and something fails, in the platform or in the portal page in your browser, a report goes to Sentry. Reports go to Sentry's EU region in Germany, or to a server the operator runs himself.

Before a report leaves, text that looks like an email address or a phone number is masked, and the codes in invitation and password links are removed. Reports from the server also leave out cookies, request headers, IP addresses and the content of what was sent, and they blank fields such as name, email, phone and notes. A report keeps the error, the page or address where it happened, and technical details such as the browser or the software version.

Records of actions

The platform keeps a record of important actions: which account did what, and when. For example, an invitation sent or a file exported. Entries name accounts by an internal id. They hold no names, email addresses, phone numbers or IP addresses. The record cannot be changed or deleted through the platform.

Emails

The platform sends emails such as invitations, password links, notices about your requests, pages and articles, and the monthly reports. For each email it records the recipient's address, the subject, the type, the time and whether sending worked. The content of the email is not kept.

Legal bases

• Contract (Art. 6(1)(b) GDPR). Your account, your customer record, what you send through the portal or a link, and the monthly reports are needed for the work on your website. The onboarding form is a step you ask for before the work starts.
• Legitimate interest (Art. 6(1)(f) GDPR). The IP address and browser of sessions, the server logs, the protection against abuse, the bot check, the error reports, the backups, the record of actions and the record of emails keep the platform secure and working. You can object to this processing (see "Your rights").

Messages sent through a client's website

Some of the operator's clients send the contact forms of their websites to this platform. If you sent a message through such a form:

• The website's owner is the controller. They decide why your message is collected and what happens to it.
• The operator is their processor (Art. 28 GDPR). He stores and forwards the message only on their instructions, under a data-processing agreement made with each client.
• To exercise your rights over a message, contact the website you sent it through. The operator acts on its owner's instructions.

A stored message holds:

• every field the form sent (often a name, an email address, a phone number, a subject and a message);
• whether the form's consent box was ticked;
• the IP address and the browser (user agent) of the device that sent it;
• the address of the website the form was sent from, and the website on which the bot check was solved;
• a spam score, with the signals behind it;
• whether the notice email reached the addresses set for the website;
• the attached file, if the form accepts one.

Each accepted message is emailed to the addresses set for that website. Your email address is written in the text of that email, so that the website's owner can reply to you. If the website has it switched on, you also get a short automatic acknowledgement. Its text is fixed in advance and does not repeat what you wrote.

The bot check on these forms is Cloudflare Turnstile. The platform sends Cloudflare the check's token and your IP address to confirm it.

How long a message is kept:

• An accepted message is deleted automatically 730 days after it arrives. This is the period set in the platform's settings (730 days, 24 months, unless the operator changes it), and this page always shows the current value. A message can be deleted earlier on request.
• The content of an attached file is deleted after 180 days. Its name and size stay with the message.
• A message that failed a check (the bot check, a website the form is not registered for, a hidden trap field, or a missing consent tick) is deleted after 30 days. So is a message held as probable spam.
• The record of the emails sent about a message keeps the recipient's address for 365 days.

Who receives data

GitHub. When an article is published on a website whose blog runs through the platform, the article and its pictures are sent to that website's code repository on GitHub as a pull request.

Google Gemini. When writing help is used for an article, the request holds the website's name and address, the writing rules stored for it, the article's brief and the titles already published. For a version in the website's other language, it also holds the article's text. For a cover picture, it holds a description of the scene and the website's visual style. It never holds contact details, form messages or account data.

Coding assistants. The operator can let an AI coding assistant read from the platform, to work on your website. It does so with a token that the operator creates, limits to certain kinds of data and can withdraw at any time. With such a token, the assistant can read your customer record and its contact details, page texts, questionnaire answers, brand assets, blog articles, and the comments and change requests on your website with the names of the people who wrote them. What it reads is processed by the provider of that assistant. No token gives access to the messages sent through your website's forms.

Transfers outside the European Economic Area. netcup keeps the platform's data in Austria, inside the EU. Amazon Web Services, Cloudflare, GitHub, Google and Sentry are companies based in the United States. Each of them takes part in the EU-US Data Privacy Framework, so a transfer to it relies on the European Commission's adequacy decision for that framework (Art. 45 GDPR). Each one's data protection terms also contain the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which apply where the framework does not.

Nothing is sold, and nothing is shared for advertising.

How long data is kept

Backups. A copy of the platform's database, including the stored files, is made every night and kept on the same server in Austria for 14 days. Data deleted from the platform therefore stays in these copies for up to 14 days more. The copies are used only to restore the platform after a failure.

Your rights

Under the GDPR you can ask:

• for a copy of your data (Art. 15);
• to correct it (Art. 16);
• to delete it (Art. 17);
• to restrict its use (Art. 18);
• to receive the data you gave in a common file format, or to have it sent to someone else (Art. 20);
• to stop processing based on legitimate interest, for reasons of your particular situation (Art. 21).

Write to demetriosrarras@gmail.com. You get an answer within one month (Art. 12(3) GDPR). You can also download your website's messages yourself in the portal, as a CSV file.

For a message you sent through a client's website, contact that website. Its owner is the controller.

Complaints

You can complain to a data protection authority, in particular in the EU country where you live or work. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 11523 Athens, www.dpa.gr.

Security

• Connections to the platform use HTTPS.
• Passwords are stored only as hashes that cannot be reversed.
• Two-step sign-in is available to clients, and required for the platform's administrator accounts.
• A session ends after 15 minutes without activity, and at the latest after 12 hours.
• Downloading all of your website's messages at once asks for a recent sign-in.
• Secrets the platform stores, such as the password of an email account, are encrypted.
• The record of actions cannot be changed through the platform.

Changes to this page

When this page changes, the date at the top changes. Important changes are announced to clients by email.