No advertising trackers
This website does not intentionally install advertising or audience-measurement trackers. Sign-in uses necessary authentication and security storage.
YOUR DATA, EXPLAINED
Privacy & Cookies.
What this portfolio stores, why it needs it, and how to contact me about your data. You can browse the public pages without creating an account.
Chat history is saved
Questions and answers are stored with your account ID and, when available, your verified email. Avoid sharing sensitive or confidential information.
A direct contact
For privacy questions or an access or deletion request, email andremoniy@gmail.com.
1. Who is responsible?
Andrey Lebedev, based in Luxembourg, is the controller responsible for personal data processed through this portfolio website, andremoniy.com. You can contact me at andremoniy@gmail.com.
This notice covers the website and its CV assistant. External websites linked from the portfolio have their own privacy notices.
2. What data is used, and why?
Browsing the portfolio
Public pages do not require an account. Hosting and network services process technical request information, such as your IP address, browser information, requested URL and request time, to deliver the website and protect it from misuse.
Creating an account and signing in
Amazon Cognito handles registration, email verification and authentication. Account information includes your email address, an account identifier and any profile name you supply. Cognito manages credentials; the website’s chat database does not store your password or access token. An account is required to use the assistant, but not to browse the portfolio.
Using the CV assistant
The assistant processes your question, relevant CV passages and an optional sanitized display name to generate a reply through Amazon Bedrock. Bedrock Guardrails evaluates inputs and outputs to enforce the assistant’s topic and safety restrictions. The application does not add your email address to the model prompt; anything you type into a question is part of that prompt.
Questions, answers, timestamps and conversation summaries are saved in DynamoDB and linked to your Cognito account ID. When Cognito supplies a verified email, it is saved as a separate attribute on user-specific records, in lowercase with any plus tag removed. Historical records can lack that attribute. This helps identify conversations when investigating problems or handling a request about your data.
Usage counters enforce per-user and shared chat limits. Verified mailbox hashes identify user quota keys; the normalized verified email is also stored on the user’s persistent quota row and conversation history. Shared quota counters do not contain a user email. Operational logs record service errors and request identifiers; the application does not intentionally write full chat transcripts to those logs.
Purposes and legal basis
The processing above is based on legitimate interests under Article 6(1)(f) GDPR: operating a professional portfolio, providing the optional assistant, managing accounts, preventing abuse and excessive costs, and investigating service problems. Retained conversations support troubleshooting and review of the assistant’s responses. You may object to processing based on legitimate interests, as explained below.
The site does not use your data for advertising or sell your chat history. The assistant generates informational replies about my experience; it does not make decisions about you with legal or similarly significant effects.
4. AWS and other services
Amazon Web Services provides hosting, content delivery, authentication, database storage, model inference and operational services. Account and application storage are configured primarily in Ireland (eu-west-1). Bedrock uses Amazon Nova Lite through an EU cross-Region inference profile, so model requests may be processed in other EU Regions.
Content delivery and related technical services use global infrastructure, so this is not a promise that every technical request is processed only within the EU. AWS’s data-processing terms include safeguards for applicable international transfers, including Standard Contractual Clauses where required. See the AWS Data Processing Addendum explanation ↗, or contact me for information about the safeguards relevant to your data.
Some portfolio pages request application metadata or artwork from Apple. These requests can disclose technical request information, such as your IP address and browser details, to Apple. Opening links to services such as LinkedIn, GitHub, Credly, Credential.net, Google Scholar or the App Store takes you to those providers’ services and privacy terms.
Social sign-in is an optional integration. If a provider is enabled and you choose it, that provider processes the sign-in under its own terms and supplies the permitted profile attributes to Cognito. Its cookies and data use can differ from email sign-in.
If you email me, your message and email address are processed by my email service so I can handle your request. Data may also be disclosed where required by law.
5. How long is data kept?
| Data | Current retention |
|---|---|
| Cognito account | Kept until the account is deleted. Signing out does not delete the account. |
| Conversation history | There is currently no automatic deletion schedule. Saved exchanges and summaries remain until manually deleted, including in response to an applicable deletion request. |
| Active session state | A conversation ends after more than five minutes of inactivity, or an explicit close. Its ownership and deadline are kept in the retained history summary. Browser-close delivery is best effort. Legacy session rows remain eligible for asynchronous expiry cleanup. |
| Quota counters | One persistent record per normalized user retains the current minute and day counters, period times, account ID and verified email until manually deleted. Values renew in place as periods change. Global counters have no user email. Legacy time-window records remain eligible for asynchronous expiry cleanup. |
| Application logs | The application’s CloudWatch log groups are configured for 14-day retention. |
| Recovery copies | The history table has point-in-time recovery. Deleted data may remain in recovery copies until the configured recovery window expires. The table is retained when the infrastructure stack is deleted. |
| Privacy correspondence | Kept as needed to handle your request and document the response, subject to any applicable legal requirements. |
Ending a conversation changes its session state; it does not erase its saved messages. Avoid entering sensitive personal data, other people’s information or confidential material into the assistant.
6. Your rights and how to contact me
Subject to the conditions and exceptions in data-protection law, you may request access to your personal data, correction, erasure, restriction of processing and, where applicable, portability. You may object to processing based on legitimate interests.
Privacy contact: Andrey Lebedev
andremoniy@gmail.com
Please describe your request and identify the email or account used for the chat. I may need proportionate additional information to verify your identity. Do not send your password, access token or unnecessary identity documents.
Requests are normally answered within one month; a lawful extension may apply for complex or numerous requests. You can also lodge a complaint with Luxembourg’s Commission nationale pour la protection des données (CNPD) ↗, or another competent supervisory authority. More information about data-subject rights ↗.
7. Changes to this notice
This page may be updated when the website’s services or data practices change. The date at the top identifies the latest revision. Material changes will also be reflected where the relevant data is collected.