Nicole Fung

Privacy

Privacy policy

Last updated: Oct 27, 2026

This site, nicolefung.pro, is a personal publication about AI in commercial, marketing, and brand strategy. It's built to collect as little personal data as possible: there are no accounts, no ads, no tracking cookies, and no social media widgets.

Who is responsible

The data controller is Nicole Fung, based in Denmark. The EU General Data Protection Regulation (GDPR) applies.

To ask a question about your data or use any of your rights, use the contact form.

The short version

  • Reading the site doesn't require you to give me any personal data.
  • This site uses no tracking cookies and no analytics.
  • If you use the contact form, I get your name, email address, and message, and use them only to reply to you.
  • The site runs on Cloudflare, which processes technical data such as your IP address to deliver and protect the site.
  • The contact page uses Cloudflare Turnstile to block spam bots.
  • The "My presentation" tray saves your picks only in your own browser. They never leave your device.

The contact form

What I collect: your name, your email address, and your message. The form also has a hidden field that people never fill in; it catches spam bots.

Why: only to read your message and reply to you. I don't add you to a mailing list, and I don't sell or share your details. I don't use your contact messages to train AI.

Legal basis: my legitimate interest in answering messages people choose to send me (GDPR Art. 6(1)(f)). If you write about working together, the basis is also taking steps at your request before a possible contract (Art. 6(1)(b)).

How it travels: when you press send, the form goes to a small server function on Cloudflare Pages. The server function sends your IP address to Cloudflare Turnstile for the spam check (see Cloudflare Turnstile below); the message itself is not sent to Turnstile. It then passes your message to Cloudflare Email Routing, which delivers it as an email to my inbox. Cloudflare says Email Routing does not store or access email content. My inbox is a Gmail account provided by Google Ireland Limited, which stores the email from then on. My email address is never shown on this site.

How long I keep it: your message and my replies are kept only in my Gmail inbox, for up to 12 months after our last exchange, and then deleted, unless we start working together, in which case I keep what's needed for that work and any legal record-keeping. Messages caught as spam are never delivered to me. You can ask me to delete your message at any time.

Cloudflare Turnstile (spam protection on the contact form)

The contact page loads Cloudflare Turnstile from challenges.cloudflare.com to tell people from bots. It usually works without asking you to solve a puzzle.

What it processes: according to Cloudflare, Turnstile uses signals such as your IP address, browser details (User-Agent and TLS fingerprint), and the site key of this page. Cloudflare says Turnstile does not access, store, or send your form entries.

Roles: for protecting this site, Cloudflare acts as my processor. Cloudflare also uses these signals as an independent controller to improve its bot detection, based on its legitimate interests. See Cloudflare's Turnstile Privacy Addendum. Cloudflare may process these signals in the United States (see "Transfers outside the EU").

Legal basis: my legitimate interest in keeping spam and abuse out of the contact form (Art. 6(1)(f)).

Turnstile doesn't set a cookie on this site. To work, it saves a small technical value in your browser's storage for challenges.cloudflare.com (not for this site). Cloudflare treats this as strictly necessary to tell people from bots, so it doesn't need your consent. It is only used on the contact page.

Hosting and server logs (Cloudflare Pages)

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical data when you load a page, such as your IP address, the page you asked for, your browser type, and the time. This is needed to deliver the site and protect it from attacks, for example by limiting how often one IP address can send the contact form.

Role: Cloudflare, Inc. acts as my processor for the logs it keeps for this site, under its Data Processing Addendum. For some network and security data it uses to run its own service, Cloudflare acts as an independent controller under its privacy policy.

Legal basis: my legitimate interest in running a secure, working website (Art. 6(1)(f)).

All connections to this site are encrypted (HTTPS).

How long: our own server code logs no personal data. Cloudflare keeps security event records (such as blocked requests, with IP address and browser type) visible to me for up to 31 days, and short technical logs of the contact-form service for up to 3 days. Cloudflare keeps its own network data for as long as needed for security and running its network, as described in Cloudflare's privacy policy.

The "My presentation" tray

You can collect pieces into a presentation and download it as a PowerPoint file. Your selection is saved in your browser's localStorage, on your device only. It is never sent to me or to anyone else, and the PowerPoint file is built in your browser. You can clear it by emptying the tray or clearing your browser's site data.

Reusing my content

You're welcome to use pieces from this site in your own presentations and work. Please credit "Nicole Fung, nicolefung.pro" with a link. Downloading or reusing content does not identify you to me.

Cookies and other storage

This site's own code sets no cookies. It stores two things on your device, both strictly necessary for something you use:

  • the presentation tray described above, only if you use it;
  • a small technical value saved by Cloudflare Turnstile on the contact page (see above).

If Cloudflare's security systems ever need to check that you're a person (for example, during an attack), Cloudflare may set a strictly necessary cookie called cf_clearance to remember that you passed the check. See Cloudflare's cookie list. Fonts are hosted on this site, so no font service sees your visit. Because nothing here tracks you as an individual, there is no cookie banner.

This site links to my profiles on LinkedIn and X. These are plain links: nothing from LinkedIn or X loads on this site, and those platforms learn nothing about your visit unless you click. Once you're on their sites, their own privacy policies apply.

Who else sees your data

  • Cloudflare, Inc. (hosting, security, Turnstile, and Email Routing), as described above.
  • Google Ireland Limited (Gmail), which hosts my inbox and stores the emails you send me. Google's own privacy policy applies to how it runs Gmail.

I don't sell your data, and I don't use it for advertising.

Transfers outside the EU

Cloudflare, Inc. is based in the United States, and Google may process my inbox on servers outside the EU, including in the United States. Both Cloudflare, Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as adequate. Where that doesn't apply, they use the EU Standard Contractual Clauses. You can check their certifications at dataprivacyframework.gov.

Your rights

Under the GDPR you can ask me to:

  • tell you what personal data I hold about you and give you a copy (access)
  • correct it (rectification)
  • delete it (erasure)
  • limit how I use it (restriction)
  • give it to you in a reusable format (portability), where that applies

You can also object at any time to processing based on my legitimate interests. To use any of these rights, use the contact form. I'll reply within one month, as the GDPR requires. I make no automated decisions about you.

Complaints

If you think I've handled your data wrongly, please tell me first so I can fix it. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark: datatilsynet.dk/english/file-a-complaint.

Changes

If this policy changes, I'll update it here and change the date at the top.