Dejan StevanovicNotNull Online

Legal

Privacy & AI transparency

Last updated: 7 July 2026

This notice explains how NotNull Online (notnull.online), operated by Dejan Stevanovic, processes personal data when you use the portfolio chat assistant and browse the public site. It also fulfils EU AI Act transparency obligations for AI systems that interact directly with users.

AI transparency

The chat on this site is an artificial intelligence assistant, not a live person. It uses retrieval-augmented generation (RAG): your question is matched against published portfolio content, and a third-party language model drafts a reply grounded in that material. Responses are labelled AI-generated in the interface.

The assistant does not make hiring, credit, or other automated decisions about you. It provides informational answers about published work, skills, and experience only.

Data we process

  • Chat messages you send, and AI replies shown to you, when you use the assistant.
  • Session identifier (a random UUID) stored in your browser (sessionStorage) so multi-turn conversations can continue during your visit.
  • Server-side chat history linked to that session ID when you chat (up to 20 recent turns), retained for 7 days then deleted automatically.
  • IP address (or a value derived from proxy headers) for rate limiting and abuse prevention — not used for profiling.
  • Admin login (email and password) only if you authenticate as the site administrator; visitors do not need an account.
  • Contact form (name, email, message) when you use the contact page. Submissions are emailed directly to the operator and are not stored in the site database; they are kept in the operator’s mailbox for up to 3 months and then deleted.

We do not use advertising trackers or third-party analytics cookies on the public visitor experience. Admin authentication uses an HTTP-only session cookie.

Why we process it

  • To operate the AI chat assistant you choose to use.
  • To maintain conversational context within a visit.
  • To protect the service (rate limits, security).
  • To administer the site (admin only).

Legal basis (GDPR)

  • Legitimate interests (Art. 6(1)(f)) — operating an informational portfolio and securing the service, balanced against your rights; chat use is voluntary.
  • Contract / steps at your request (Art. 6(1)(b)) — processing needed to respond when you submit a chat message.

Third parties & international transfers

Chat and search rely on external providers configured by the operator:

  • Google Gemini API (gemini-3.1-flash-lite) — receives your message, recent session history, and retrieved portfolio excerpts to generate a reply via an OpenAI-compatible API endpoint.
  • OpenAI API (text-embedding-3-large) — receives query text and portfolio content to produce search vectors; content is embedded when the index is built or updated. Chat completions are not sent to OpenAI.
  • MongoDB Atlas — stores published content and short-lived chat sessions.
  • Amazon Web Services (EU) — hosts the application and media assets (eu-central-1).

Providers may process data outside the European Economic Area. For U.S.-based providers, transfers are made under the EU-U.S. Data Privacy Framework where the provider participates as a certified organisation, supplemented by Standard Contractual Clauses and the provider’s data processing agreements where applicable.

Check the active provider’s privacy policy and terms for retention and model-training practices. Production configuration is documented internally and updated when vendors change.

Retention

  • Server chat sessions: 7 days (automatic deletion).
  • Browser session storage: until you close the browser tab/session.
  • Published portfolio content: until the administrator updates or removes it.
  • Admin auth tokens: per session configuration (see login cookie lifetime).
  • Application logs (security/diagnostics): 90 days (CloudWatch, automatic deletion).
  • Contact form submissions: kept in the operator’s email mailbox for up to 3 months, then deleted (earlier deletion on request to privacy@notnull.online).

Your rights

If you are in the EEA or UK, you may have rights to access, rectify, erase, restrict, or object to processing, and to data portability, subject to applicable law. Because visitor chat is tied to an anonymous session ID rather than an account, we may need your session ID or approximate time of chat to locate data.

To exercise rights or report inaccurate AI-generated content about published portfolio material, contact: privacy@notnull.online.

You may lodge a complaint with your local data protection supervisory authority.

Children

The site is a professional portfolio intended for a general audience and is not directed at children under 16.

Changes

We may update this notice when processing practices or providers change. The “Last updated” date at the top will change accordingly.