1. Controller
The controller responsible for processing on this website is the ANVAYA OS project, represented by Alphin Tom. Contact for all privacy matters: info@anvaya.dev. The postal address is provided on request by email. No data protection officer is required for a project of this size.
2. What this site does not do
- No cookies are set and no consent banner is needed.
- No third-party trackers, advertising or social media scripts are loaded.
- No third-party CAPTCHA. Spam protection runs entirely in your browser and on our server.
- Fonts, images and the live demo are all served from anvaya.dev itself.
3. Sponsor and contribute forms
The forms on /sponsor and /contribute let you contact us as a prospective sponsor or contributor.
3.1 Data processed
Your name, email address, the message you write, the category you choose, and any optional fields you fill in (organisation or affiliation, role, website or profile URL, time horizon or availability). Fields marked optional can be left empty.
3.2 Purpose and legal basis
We process this data to read and answer your enquiry and, where it leads somewhere, to prepare a sponsorship or collaboration. The legal basis is Article 6(1)(b) GDPR (steps prior to entering into an agreement at your request) and, for enquiries that are not contractual in nature, Article 6(1)(f) GDPR (our legitimate interest in communicating with people who contact us). Ticking the confirmation box records that you have read this notice; the time of that confirmation is stored with your enquiry.
3.3 What happens with a submission
- Your enquiry is delivered by email to info@anvaya.dev.
- A confirmation copy is sent to the email address you entered so that you have a record. If the message contains links it is acknowledged but not repeated in the copy.
- Nothing is written to a database. The web server keeps no copy of your enquiry.
3.4 Spam protection
To keep the inbox usable we apply technical measures that do not identify you: a hidden field bots tend to fill, a signed time-limited token that requires your browser to perform a short computational check, request rate limits, and rejection of duplicate messages. For rate limiting, your IP address is transformed into a salted hash that changes every day and is held only in server memory for at most 24 hours. The IP address itself is not stored and is not included in the email we receive. These measures are based on Article 6(1)(f) GDPR (protection against abuse) and involve no profiling or automated decision with legal effect.
3.5 Retention
Enquiries remain in our mailbox for as long as needed to handle them and are deleted no later than 24 months after the last exchange, unless a sponsorship or contribution agreement follows, in which case statutory retention periods for business records apply.
4. Email
Mail to and from anvaya.dev is handled by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, on servers located in the European Union, under a data processing agreement. IONOS acts as our processor under Article 28 GDPR. Email you send us is processed on the same bases and with the same retention as form enquiries.
5. Server logs
The reverse proxy and web server record technical access data (requested path, timestamp, HTTP status, user agent, and IP address) to keep the service secure and to diagnose faults, based on Article 6(1)(f) GDPR. Logs are held in size-limited rotating files on the server and overwritten automatically as new entries arrive; they are not analysed for anything other than security and fault diagnosis, and are not combined with form data. Form contents are never written to logs.
6. Live demo
The /demo page opens a WebSocket to anvaya.dev to stream a QEMU boot. To limit concurrent sessions per visitor, the demo service holds your IP address in memory for the duration of the session and a short rate-limit window afterwards; nothing is written to disk. No account and no personal input are required.
7. Recipients and transfers
Your data is seen by the ANVAYA OS team and by our email processor named above. We do not sell or share personal data with anyone else and we do not transfer it outside the European Union or the European Economic Area.
8. Your rights
Under Articles 15 to 21 GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, for example by asking us to delete your enquiry;
- restrict processing while a request is being examined;
- receive the data you provided in a portable, machine-readable form;
- object to processing based on legitimate interests (Article 21 GDPR); we will then stop unless we can show compelling legitimate grounds.
To exercise any of these rights, email info@anvaya.dev. Quoting the reference number from your confirmation email speeds things up. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, workplace or the place of the alleged infringement.
9. Security
All traffic to anvaya.dev is encrypted with TLS (HSTS enforced). Mail is transmitted to our provider over TLS. Form endpoints only accept same-origin requests, cap request size, and validate every field on the server. Credentials are kept outside the source repository.
10. Changes
We update this notice when processing changes. The version date at the top and the version recorded with your enquiry tell you which text applied when you contacted us.