What this site knows about you.

This is a personal portfolio run by Mattias De Ridder, based in Ghent — Belgium. It is not a business: nothing is sold here, no service is offered for payment, and there is no company, KBO/BCE number or VAT registration behind it. That is why there is no company registration block on this page — if that ever changes, this page gains one.

For anything here, including a request about your data, write to mattias.deridder [at] outlook.com. Under the GDPR that makes me the controller for the limited processing described below.

Two things, and both are kept to the minimum:

• Server logs. Like every web server, the host records the request: IP address, timestamp, the page requested, browser and operating system. An IP address counts as personal data under the GDPR, which is the reason this page exists at all.
• Cookieless analytics. I use Vercel Web Analytics to see how many people visit, which pages they read, roughly where they come from (the referring site and a country-level location) and which links they click. It sets no cookies and assigns you no persistent identifier. To count you once without one, it derives a temporary daily hash from your IP address and user-agent that is discarded within the day and cannot be tied back to you or followed across sites. The numbers I see are aggregate: totals and trends, not people.

That is the whole list. There is no advertising, no profiling, no heatmaps, no session recording and no A/B testing — I wanted to know whether anyone reads the writing or plays the games, not to watch you do it.

There is no contact form and no newsletter. If you email me, that email sits in my mailbox like any other, and I keep it only as long as the conversation is useful.

Both rest on legitimate interest (Article 6(1)(f) GDPR). Server logs exist to keep the site running and secure. The analytics exists so I can tell whether the work here reaches anyone and which parts are worth continuing — a genuine interest, weighed against a minimal privacy cost because it is cookieless, carries no persistent identifier and cannot identify you or track you elsewhere.

There is no profiling, no advertising, no automated decision-making and nothing sold to anyone. Because the analytics is exempt from the consent rule (see below) rather than based on consent, you can still object to this processing at any time under Article 21 — email me and I will exclude your visits.

This site sets no cookies at all — the analytics included. The ePrivacy rules (and Belgium’s transposition of them) only require a consent banner when a site stores or reads information on your device, such as a cookie or a tracking identifier. Cookieless analytics that stores nothing on your device does not cross that line, so there is nothing to consent to and no banner to click.

Three things are stored locally in your own browser, and never sent anywhere:

• theme — remembers light or dark, and is written only when you press the toggle yourself.
• The games keep their own progress, settings and high scores — a saved Sudoku grid, a Tetris theme. That data stays inside your browser.
• demo:mcp-todo-flow — anything you type into the MCP demo on that case study. It never leaves your device.

Under the ePrivacy rules this kind of storage is exempt from consent because it does only what you asked it to do. Clearing your browser storage removes all of it.

Vercel Inc. hosts the site and is my processor under a data processing agreement, which covers both the server logs and the analytics — Vercel Web Analytics is Vercel’s own product, served from this domain rather than a separate tracker. Vercel is a US company, so this data may be processed outside the EEA under the safeguards in that agreement (Standard Contractual Clauses).

That is the entire list — one processor. Fonts are served from this domain rather than from Google, there is no third-party analytics tracker, no advertising network, no CDN for third-party scripts, no embedded video, no social widgets, and the fourteen games are self-hosted and sandboxed so they make no outside connections either.

Server logs are short-lived and held by the host for operational purposes only. The daily hash the analytics uses to count you is discarded within the day; what remains is aggregate statistics with no personal data in them, retained by Vercel under their retention policy. Email stays until the conversation is over. Nothing else is kept.

Under the GDPR you can ask for access to your data, correction, erasure, restriction or portability, and you can object to processing based on legitimate interest. Email me and I will deal with it.

One honest caveat: beyond short-lived server logs held by the host, I hold nothing about you at all — so there is usually no “your data” for me to produce or erase. That is a consequence of collecting nothing, not an evasion.

If you think I have this wrong, you can complain to the Belgian supervisory authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels.

The target is WCAG 2.2 level AA, which is the standard the European Accessibility Act points at. This site is a personal portfolio that sells nothing, so that Act almost certainly does not bind it — the commitment is here because it is the right target anyway, not because a regulator asked.

What is in place:

• Text and interface colours meet the AA contrast ratio in both light and dark themes.
• Every animation, including the 3D scenes, is skipped entirely when your system asks for reduced motion. The 3D also never loads on a phone, on a metered connection or on a machine without WebGL.
• Keyboard navigation throughout, a skip-to-content link, visible focus outlines, and alt text on images that carry meaning.
• Semantic headings, one h1 per page, and labelled landmarks.

Known limitations, stated rather than hidden: the games are embedded third-party-style canvases of my own making and most of them need a pointer or the arrow keys, so they are not fully operable by assistive technology. The architecture diagrams convey their meaning visually, and their text alternatives are summaries rather than full equivalents.

If something here blocks you, email mattias.deridder [at] outlook.com and tell me what broke. I will fix it or tell you honestly that I cannot.

Everything here is published in good faith and for information. Nothing on it is advice you should act on without checking, the case studies describe past work rather than promise future results, and I make no warranty that the site is available, complete or error-free.

Links point away to sites I do not control — GitHub, LinkedIn, Instagram, Etsy, Behance, Vimeo. What happens there is governed by their terms and their privacy policies, not mine.

The embedded games run in a sandboxed frame in your own browser and save their progress locally. They are hobby projects offered as-is.

Belgian law applies, and the courts of Ghent have jurisdiction, to the extent that any of this ever matters for a portfolio site.

If you find a vulnerability in this site, email mattias.deridder [at] outlook.com with what you found and the steps to reproduce it. I aim to reply within a week, and will credit you once it is fixed if you want the credit.

Testing in good faith is welcome, and I will not pursue anyone who does it. Please do not run load or denial-of-service tests, and give me a reasonable time to fix an issue before you publish it.

The writing, design and code here are mine unless stated otherwise. Licences for the libraries, fonts and assets this site depends on are listed under attributions. Client and employer work shown here remains the property of those clients and employers, and work covered by a non-disclosure agreement is described only in the terms that agreement allows.