Privacy policy

Who is responsible

Lia Dolev, Lia Dolev Studio. For anything in this policy, including a request about your own data, write to liadolev.studio@gmail.com.

What the contact forms collect

The site has four places you can write to me from: the form in the footer, the contact page, and the two forms on the Hebrew pages. They all send to the same place.

• Your name — required, so I know who I am replying to.
• Your email address — required, so I can reply.
• Your phone number — optional.
• Your message.

What happens to it

The form posts to a function on my Supabase backend. That function emails the message to me, sends you a short confirmation that your message arrived, adds a row to a private Google Sheet I use as my enquiry list, and posts the same fields to an automation I run on Make.

The function also keeps a send log in Supabase — your email address, which email was sent and whether it went through — so I can see when a confirmation failed to reach you.

I use it to answer you and, if we end up working together, to run the project. I do not sell it, and I do not send marketing to an address that reached me through this form unless you ask me to.

Your IP address

To stop the contact form being used to flood my inbox, the function keeps a salted SHA-256 hash of the IP address the message came from and counts how many arrived from it in the last hour. The address itself is never stored, the hash cannot be read back into an address, and the rows are deleted after 24 hours.

Cookies and third parties

The site sets no advertising cookies and has no Meta pixel or similar. Google Analytics is the one optional tool, and it runs only if you accept it.

Google Analytics 4. When you first visit, a small notice asks whether you accept it. Until you accept, the page makes no request to Google. If you accept, the site loads Google Analytics, which sets the cookies _ga and _ga_ followed by an identifier (up to 2 years) and sends Google the page you viewed, the page you came from, your device, browser and language, and an approximate location derived from your IP address (Google Analytics does not store IP addresses). I use it to count visits and see which pages lead to enquiries, with advertising features and Google signals switched off. You can change your mind at any time with “Cookie settings” in the footer; declining deletes the cookies. Your choice is saved in your browser’s local storage. Google acts as a processor for this data and may process it outside Israel.

The hosting platform (Lovable) runs basic traffic and performance measurement on every page. For each page view it records the page address, the page you came from, your browser and device type (the user-agent string), the browser language, a country derived from your time zone, and loading-speed timings. It ties these together with a random session identifier in a cookie named session-id, which expires 30 minutes after your last activity. The data is processed by Lovable and its analytics provider, Tinybird. I do not use it for advertising or to profile or identify anyone.

Cloudflare, which sits in front of the hosting, may set a short-lived security cookie (__cf_bm, 30 minutes) that tells browsers from bots.

Two third parties are worth naming. The article pages show posts pulled from my Medium feed, and Medium embeds a 1×1 tracking image in that content, which loads from medium.com when you read an article here. Fonts are served from files hosted on this site, not from Google Fonts, so no request goes to Google when you load a page.

The site is hosted by Lovable and its backend runs on Supabase. Email is sent through my transactional email provider. Each of these sees a request in order to serve it, and keeps what passes through it on its own servers, which are outside Israel. I rely on each provider’s data-protection commitments in its terms and data-processing agreement.

The “book a call” links open Cal.com, a scheduling service with its own privacy policy. What you enter there goes to Cal.com and to my calendar, not through this site’s forms.

How long it is kept, and your rights

Enquiries stay in my email and in my enquiry sheet for as long as they are useful for the conversation or the work that came out of it, and no longer than three years after our last contact. The send log is deleted with the enquiry. Rate-limit rows last 24 hours.

Under the Israeli Privacy Protection Law you may ask to see the information I hold about you, to correct it, or to have it deleted. Email me and I will do it — for deletion, that means removing you from my enquiry sheet, my automation and the send log, and deleting the correspondence.