Skip to content
Pedro Sant'Anna Brazilian product designer in London.

Privacy

This is Pedro Sant'Anna's personal site. I decide what it collects, and I keep it to what tells me whether the site is useful. Nothing about your visit is measured until you choose. The one thing counted either way is what the agent's answers cost: tokens, time and model, never what was said.

What is collected

Before you choose

Nothing about your visit. No analytics script loads, no request leaves your browser for an analytics service, and nothing is stored on your device. If you ask the agent a question, its server sends PostHog the answer's counts: the tokens it used, how long it took, what it cost and which model wrote it, with the server's log lines and any error it met. No text, and no identifier that links them to you, your visit or your other questions.

If you came through a link I sent you (pedrosantanna.com/to/…), it names who I sent it to and why. That name is taken off the address as the page opens and held in the page's memory, never on your device, until you choose.

If you decline

PostHog counts the visit without cookies or anything else on your device: the pages you open, where you came from, your browser and device type, and the country your IP address points to. To tell one day's visitors apart, PostHog's servers hash your IP address and browser with a salt that changes every day, so a visit can't be linked to you or to your other days. Nothing else is collected: no clicks, scrolling, page speed or error reports, no session recording, no Google Analytics. The same applies when your browser sends Global Privacy Control or Do-Not-Track. A link I sent you counts as any other visit: its name is dropped, and goes nowhere.

Vercel, which hosts the site, counts the pages you open too, with its Web Analytics: also without cookies or anything on your device. It gets each page's address without its query or anchor, where you came from, your browser, device type and country, and tells one day's visitors apart by a hash it discards within a day. It is there so the site is still counted if PostHog fails.

The agent's answers are counted as before you choose: tokens, time, cost and model, with no text and no identifier.

Legal basis: legitimate interests, in knowing whether the site is read at all and what the agent costs to run. You can object by email, below.

If you accept

  • PostHog records the pages you open, clicks, scrolling, page speed and errors, and a recording of the visit with everything you type hidden — the agent conversation, your questions and its answers, is left out of the recording. A cookie (ph_*) recognises your browser on later visits. It never knows your name or email.
  • The agent: your questions and its answers are sent to PostHog too, with the page you asked from and the rest of the conversation, so I can see what visitors ask and whether the answers help. The text is deleted after 30 days; the counts stay with the other events. Your clicks on the agent (opening it, asking, stopping, starting over) are recorded as events, without the words.
  • A link I sent you (pedrosantanna.com/to/…): its name, who I sent it to and why, goes with this visit to PostHog and Google Analytics, so I know the link was opened.
  • Google Analytics 4, through Google Tag Manager, records page views and contacts. Its cookies are _ga and _ga_*. Advertising features stay off.
  • Vercel counts the pages, as it does when you decline, and its Speed Insights measures how fast each page loads and responds and whether it shifts as it loads. No cookies, no addresses with their query or anchor, nothing that identifies you.
  • Automated analysis of recordings. PostHog may run its AI over the recordings of visits that accepted, to summarise them and spot where the site gets in the way. It sees what the recording shows, with your typing and the agent conversation already hidden. PostHog uses Google's Gemini models for this.

Legal basis: your consent, which you can withdraw at any time under Your choice.

The agent

Questions you ask the agent, and the text of a page you ask it to read, are sent to Anthropic's API to write the answer. Anthropic is a US company and processes them outside the UK, under its commercial terms and Data Processing Addendum: it deletes them within 30 days (longer only if its systems flag misuse) and may not train its models on them. The conversation is kept in this tab's session storage so it follows you between pages, and is gone when you close the tab.

For every answer, the agent's server sends PostHog its counts: tokens, time taken, cost and model. Without your accept that is all, with no text and no identifier. With your accept, your questions and its answers go to PostHog's EU cloud as well, joined to your visit, and PostHog deletes that text after 30 days.

The agent's server keeps log lines and error reports, in Vercel's logs and in PostHog: token counts, how a request ended, the reason one was refused, the host of a page it read and what went wrong in the code. Never your words. With your accept they are joined to your visit, so a problem in a conversation can be traced.

If you paste a link, the site's server fetches that one public page to read it, and keeps only the page's host in its logs, never the text. Please don't paste other people's personal data: a job description is fine, someone's CV or an email thread is not.

Legal basis: legitimate interests, in answering what you asked the agent and knowing what that costs; your consent, for the text of the conversation in PostHog. You can avoid the agent entirely by emailing instead.

Hosting

Vercel serves the site and keeps short-lived request logs (IP address, page, time) for security and operations. The agent's own log lines carry token counts, the reason a request was refused, the host of a page it read and the errors it met, never your words.

Who processes it

  • PostHog Inc., on its EU cloud in Frankfurt (analytics, the agent's counts, its server's logs and error reports and, with your accept, its conversations).
  • Google (Google Analytics 4, with your accept; and Gemini, which PostHog uses to analyse accepted recordings). Google may transfer data to the United States, under the UK Extension to the EU–US Data Privacy Framework.
  • Anthropic PBC, in the United States (the agent's answers).
  • Vercel Inc. (hosting, Web Analytics and, with your accept, Speed Insights).

How long it is kept

Session recordings for 30 days, PostHog events for up to 12 months, Google Analytics data for 14 months. The text of agent conversations in PostHog for 30 days, and its counts for up to 12 months, like the other events. The server's logs and error reports in PostHog, and Vercel's Web Analytics and Speed Insights, for as long as each service keeps them under the site's plan. Anthropic deletes the agent's questions and answers within 30 days. Your choice is kept for 12 months, then the site asks again.

Your rights

You can ask to see, correct or delete data about you, object to its use, or withdraw consent. The site never asks who you are, so tell me what you need and I'll find what I can: pedro@pedrosantanna.com. You can also complain to the UK Information Commissioner's Office at ico.org.uk.

Updated 4 October 2026.

Pedro's agent

Expand chat

For real answers, email pedro@pedrosantanna.com