Privacy policy

Who is responsible

Lia Dolev, Lia Dolev Studio. For anything in this policy, including a request about your own data, write to liadolev.studio@gmail.com.

What the contact forms collect

The site has four places you can write to me from: the form in the footer, the contact page, and the two forms on the Hebrew pages. They all send to the same place.

• Your name — required, so I know who I am replying to.
• Your email address — required, so I can reply.
• Your phone number — optional.
• Your message.

What happens to it

The form posts to a function on my Supabase backend. That function emails the message to me, sends you a confirmation of what you wrote, adds a row to a private Google Sheet I use as my enquiry list, and posts the same fields to an automation I run on Make.

The function also keeps a send log in Supabase — your email address, which email was sent and whether it went through — so I can see when a confirmation failed to reach you.

I use it to answer you and, if we end up working together, to run the project. I do not sell it, and I do not send marketing to an address that reached me through this form unless you ask me to.

Your IP address

To stop the contact form being used to flood my inbox, the function keeps a salted SHA-256 hash of the IP address the message came from and counts how many arrived from it in the last hour. The address itself is never stored, the hash cannot be read back into an address, and the rows are deleted after 24 hours.

Cookies and third parties

The site sets no advertising cookies, and there is no Google Analytics, Meta pixel or similar.

The hosting platform (Lovable) runs basic traffic and performance measurement on every page. For each page view it records the page address, the page you came from, your browser and device type (the user-agent string), the browser language, a country derived from your time zone, and loading-speed timings. It ties these together with a random session identifier in a cookie named session-id, which expires 30 minutes after your last activity. The data is processed by Lovable and its analytics provider, Tinybird. I do not use it for advertising or to profile or identify anyone.

Cloudflare, which sits in front of the hosting, may set a short-lived security cookie (__cf_bm, 30 minutes) that tells browsers from bots.

Two third parties are worth naming. The article pages show posts pulled from my Medium feed, and Medium embeds a 1×1 tracking image in that content, which loads from medium.com when you read an article here. Fonts are served from files hosted on this site, not from Google Fonts, so no request goes to Google when you load a page.

The site is hosted by Lovable and its backend runs on Supabase. Email is sent through my transactional email provider. Each of these sees a request in order to serve it, and keeps what passes through it on its own servers, which are outside Israel. I rely on each provider’s data-protection commitments in its terms and data-processing agreement.

The “book a call” links open Cal.com, a scheduling service with its own privacy policy. What you enter there goes to Cal.com and to my calendar, not through this site’s forms.

How long it is kept, and your rights

Enquiries stay in my email and in my enquiry sheet for as long as they are useful for the conversation or the work that came out of it, and no longer than three years after our last contact. The send log is deleted with the enquiry. Rate-limit rows last 24 hours.

Under the Israeli Privacy Protection Law you may ask to see the information I hold about you, to correct it, or to have it deleted. Email me and I will do it — for deletion, that means removing you from my enquiry sheet, my automation and the send log, and deleting the correspondence.