Privacy Policy
Effective October 18, 2026 · Last updated October 18, 2026
This policy explains what dobias.ai collects, why it is used, who helps process it, and how to make a privacy request. It covers the current Site, including contact forms, optional update requests, and hosting and security records.
Operator: Richard Dobias · California, United States
Contact: richard@dobias.ai
- Who operates this site and what this policy covers
- Collection summary: what you provide and what happens automatically
- Sources and purposes of collection
- Hosting, forms, email, and security providers
- Other disclosures and limits on use
- Cookies, browser storage, and third-party tracking
- Do Not Track and Global Privacy Control
- Update requests, marketing choices, and unsubscribe
- Information you should not send through public forms
- How long information is kept
- Security and incident response
- Access, correction, deletion, and other requests
- Additional information for California residents
- Children and age-related requests
- Visitors outside the United States
- Policy changes and contact
01 — Who operates this site and what this policy covers
Richard Dobias operates dobias.ai personally from California, United States. In this policy, “I,” “me,” and “my” mean Richard Dobias. “Site” means dobias.ai and its public pages and forms. Privacy questions and requests can be sent to richard@dobias.ai.
This policy explains information collected through the Site and related inquiries and update requests. It does not replace a privacy notice for a separately operated product, a client engagement, or an unrelated website. A project appearing in the portfolio does not mean its software is collecting information through this Site.
The Site presents projects, educational working notes, and ways to discuss possible work together. It is not currently a public account service, an online checkout, or a client document portal. The practices below describe the Site as of the effective date; changes to actual practices require corresponding updates to this policy.
02 — Collection summary: what you provide and what happens automatically
You can read the public pages without submitting a contact form or signing up for updates. Ordinary technical and security information can still be processed when your browser requests a page.
Inquiry form. The form asks for your name, email address, selected inquiry topic, and message. These fields are required to submit that form, but submitting an inquiry is optional. You may include an organization, role, project idea, or other context in the message. Share only what is needed for an initial discussion.
Optional updates. A separate signup asks for an email address. The inquiry form also offers a separate, optional checkbox for practical AI articles and project updates. That checkbox is unchecked by default. Sending an inquiry without selecting it does not subscribe you to marketing.
Technical records. Hosting, form, and security systems may process IP addresses, request URLs, referring pages when supplied by the browser, browser or device information, request dates and times, submission metadata, and information about suspected abuse or failed logins. Some approximate location information may be inferred from an IP address; the Site does not ask your device for precise location.
Correspondence and choices. If you email me or make a privacy request, I receive your address, message, and any information you choose to include. I also keep relevant records of subscription choices, withdrawals, request handling, and communications. Do not send identification documents unless a suitable verification method has been discussed.
03 — Sources and purposes of collection
The main sources are you, your browser or device, and the hosting, email, form, and security providers that support the Site. If you contact me on behalf of another person, provide only information you are authorized to share.
I use information to respond to inquiries, understand a proposed task or collaboration, arrange a discussion, administer requested updates, keep appropriate communication records, troubleshoot the Site, prevent spam and attacks, investigate suspected misuse, and comply with legal duties. Information may also be used to establish, exercise, or defend legal rights.
An inquiry is not a purchase, a commitment to provide services, or a request for unrelated advertising. I do not use contact submissions to make automated decisions that produce legal or similarly significant effects about you. The current contact form is not connected to an AI chatbot or a model provider.
04 — Hosting, forms, email, and security providers
SiteGround. The Site is hosted on SiteGround. Hosting supports delivery of pages, storage of the WordPress database and form submissions, technical logs, backups, and infrastructure security. SiteGround may process visitor request information to deliver and protect its hosting services.
WordPress and Elementor Pro. The Site is built with WordPress and Elementor. The current forms are configured to collect submissions in the Site’s WordPress database. A person authorized to administer the Site can review those records. The use of the Elementor form widget does not, by itself, mean your submission is sent to Elementor’s cloud services.
Microsoft 365 email. Correspondence sent to richard@dobias.ai is handled through Microsoft 365 and the email systems involved in delivery. If an inquiry is followed up by email, that correspondence is processed through the email service. A form submission may be stored in WordPress even when an email notification is not delivered.
Wordfence / Defiant. Wordfence protects the Site. It can record traffic and security events, including IP addresses, requested URLs, login attempts, and suspected malicious activity. The Site participates in the Wordfence Security Network: attack-related information can be sent to Defiant to support threat detection and blocking across participating sites. This is security processing, not an advertising feature. Security services may analyze activity across multiple protected sites to identify abuse.
Providers receive information relevant to the services they perform, and some may process operational or security information under their own applicable notices and agreements. I do not represent that every provider has an identical legal role or retention period. Access may also be provided to technical support or professional advisers when reasonably needed, subject to appropriate restrictions.
Provider information: SiteGround privacy information; Microsoft privacy information; Wordfence / Defiant privacy information. These links explain those providers’ practices; they do not substitute for this policy or authorize unrelated collection.
05 — Other disclosures and limits on use
Information may be disclosed when reasonably necessary to comply with a valid legal obligation or process, respond to a security incident, protect rights or safety, obtain professional advice, or investigate fraud or misuse. Where permitted and appropriate, disclosures are limited to the information relevant to the purpose.
If the operation of this Site is transferred to a business entity or another operator, relevant records may transfer as part of that change, subject to applicable law and existing privacy commitments. I will provide appropriate notice of a material change in the operator or practices. A transfer does not remove rights you have under law.
I do not sell contact lists for money, rent inquiry lists, or disclose inquiry information to other businesses for their independent direct marketing. As of the effective date, I do not use advertising pixels, advertising audiences, or cross-context behavioral advertising on this Site. Security disclosures described above are distinct from advertising disclosures. The legal classification of a disclosure depends on its actual purpose, contract, and applicable law; a label in this policy cannot override those facts.
06 — Cookies, browser storage, and third-party tracking
Cookies are small browser records. Similar technologies include local storage and server-side records associated with requests. WordPress, hosting, and security components may use these technologies to maintain functionality, recognize authorized administrators, manage sessions, and protect the Site. Not every visitor receives every cookie.
For example, WordPress login or preference cookies and Wordfence authentication or remembered-device cookies can apply to people using administrative login features. A security bypass or remembered-device cookie is relevant only if the corresponding feature is used. These examples are not a claim that every listed cookie is active for ordinary visitors.
As of the effective date, no optional audience-analytics platform, advertising pixel, session-replay service, or chatbot has been enabled by the Site operator. The Site still has hosting and security logs. The absence of marketing analytics does not mean that browsing creates no technical records.
Security providers may correlate threat-related activity across protected websites. I have not enabled third-party advertising tracking across other websites. External services you independently visit through a link may collect information under their own policies. A link alone is different from an embedded service that contacts its provider while a page loads.
You can manage or delete cookies and browser storage using your browser settings. Blocking necessary cookies may affect login, security checks, or other functionality; it does not necessarily stop server-side logging. No optional-cookie preference panel is currently offered because the Site operator has not enabled the optional tracking tools described above.
07 — Do Not Track and Global Privacy Control
Do Not Track (DNT). The current Site does not change its hosting, security, or form processing in response to the legacy DNT browser signal. I have not enabled cross-site advertising tracking on the Site. DNT does not prevent the technical processing necessary to deliver and secure a page.
Global Privacy Control (GPC). GPC is different from DNT. The Site currently has no operator-enabled sale or advertising-sharing feature to switch off. It does not have a dedicated GPC preference-storage system. Where applicable law requires recognition of an opt-out preference signal, that requirement must be satisfied by the actual technical configuration; this policy does not claim that text alone implements a signal handler.
I will not treat a privacy signal as consent to marketing. Before introducing advertising or another feature requiring opt-out or consent controls, I will review the data flow, implement the controls required by applicable law, and update the disclosures. You can also send a privacy choice or objection to richard@dobias.ai.
08 — Update requests, marketing choices, and unsubscribe
Submitting the standalone update signup requests occasional practical AI lessons and project updates. Selecting the optional inquiry checkbox requests the same type of communications. You may make an inquiry without requesting updates, and you may withdraw an update request without losing the ability to contact me.
As of the effective date, no external newsletter provider or marketing automation has been enabled. A signup records your request; it does not promise an immediate email, a particular publishing schedule, or a specific future resource. Before a newsletter service is activated, its processing must be reviewed and this policy updated as needed.
You can withdraw your request now by emailing richard@dobias.ai with “Unsubscribe” in the subject or body. Marketing messages, when sent, will include a clear way to unsubscribe. Opt-out requests will be honored promptly and, for commercial email covered by U.S. law, within the required ten business days. Necessary replies to an inquiry or other non-marketing communications may still be sent.
A limited suppression record may be retained to avoid sending marketing after an opt-out. Withdrawal does not undo processing that already occurred lawfully. I will not make marketing consent a condition of receiving an inquiry response.
09 — Information you should not send through public forms
The inquiry form is for an initial, high-level discussion. It is not a confidential client portal, a medical intake system, an emergency channel, or an authorized channel for classified information, controlled government information, export-restricted technical data, or regulated client records.
Do not submit passwords, API keys, access tokens, payment card details, Social Security numbers, government identification documents, medical records, client files, or information you are prohibited from disclosing. Avoid sharing trade secrets or detailed proprietary designs before appropriate confidentiality and transfer arrangements have been agreed.
I do not request these categories through the public form. If you send sensitive information despite this request, it may still be received, logged, backed up, and processed as part of handling the message. Contact me promptly if you believe sensitive information was submitted by mistake. This warning does not eliminate any legal duty I may have concerning information actually received.
10 — How long information is kept
Information is kept for no longer than reasonably necessary for the purposes described here, unless a longer period is required or permitted by law. There is not one fixed retention period for every record.
For inquiries, relevant factors include whether the discussion is open, whether follow-up is reasonably expected, whether a separate engagement results, and whether a dispute or legal obligation requires preservation. For update requests, relevant factors include whether the request remains active and whether a limited consent or suppression record is needed. Technical and security records follow the applicable system settings and may be preserved longer for a documented incident.
Backups can contain earlier copies of records until they are overwritten or expire under the provider’s backup cycle. Where immediate removal from a backup is not reasonably feasible, the record is not to be restored for ordinary use; if a backup is restored, applicable deletion or suppression requests need to be reapplied. Legal holds and fraud-prevention needs may limit deletion where law permits.
You can request deletion rather than waiting for a routine review. I will explain a material reason for retaining requested information when disclosure of that reason is permitted.
11 — Security and incident response
The Site uses HTTPS and access and security measures intended to reduce unauthorized access and misuse. Appropriate safeguards depend on the information and the systems involved. Security is an ongoing operational responsibility, not a guarantee created by this policy.
No website, network, email service, or storage system can be guaranteed completely secure. Do not use ordinary email or a public inquiry form for information requiring a specifically agreed secure channel. If you suspect an issue affecting this Site or a submission, contact richard@dobias.ai with enough non-sensitive detail to investigate.
If an incident triggers notification or other duties under applicable law, I will address those duties. Nothing in this policy limits rights or remedies available under applicable data-security or breach-notification law.
12 — Access, correction, deletion, and other requests
You may email richard@dobias.ai to ask what information I hold about you, correct inaccurate contact information, request deletion, withdraw an update request, or ask a privacy question. You can also use the Work with me inquiry form, selecting “Other” and stating that it is a privacy request. Do not create an account or purchase anything to make a request.
Please identify the email address used to contact the Site and the type of request. I may need reasonable verification before disclosing, correcting, or deleting information, and an agent may need to demonstrate authorization. Verification should be proportionate; do not send a password or full identity document unsolicited. I will not require identity verification for a statutory sale/sharing opt-out when the law prohibits it.
I aim to acknowledge requests within ten business days and respond within 45 calendar days. These are service targets unless a particular law makes them mandatory. Where law requires a shorter deadline, extension notice, appeal process, or different procedure, that requirement controls. If I cannot fulfill a request, I will explain the relevant limitation where permitted.
Deletion and access may be limited by legal obligations, security needs, another person’s rights, inability to verify identity, or other applicable exceptions. I do not penalize a person for making a good-faith privacy request. If you disagree with a response, reply asking for reconsideration and identify the issue; you may also contact the relevant regulator.
13 — Additional information for California residents
California’s Online Privacy Protection Act and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), are different laws. CCPA coverage depends on business and processing thresholds and other legal conditions; operating a California website alone does not establish that every CCPA duty applies. This policy does not assert that those thresholds have been met or that legal rights have been waived.
Where the CCPA applies, eligible residents may have rights to know and access information, obtain a portable copy, correct inaccuracies, request deletion, opt out of sale or cross-context advertising sharing, limit certain sensitive-information uses, and exercise rights without unlawful discrimination. Applicable exceptions and verification rules remain in effect. An authorized agent may act where permitted.
The categories described in this policy include identifiers and contact details; information described in California’s customer-records law when you provide it; internet, device, and security activity; correspondence and voluntarily supplied project or professional details; and consent or request records. This Site does not intentionally collect sensitive personal information for profiling or unrelated secondary purposes. Contents you voluntarily send may nevertheless be sensitive. Sources, purposes, recipients, and retention criteria are described in the sections above.
For California’s “Shine the Light” law, where applicable, you may request information about covered disclosures for third parties’ direct marketing by contacting richard@dobias.ai. I do not disclose inquiry lists for that purpose. California privacy complaints may be directed to the California Privacy Protection Agency or the California Attorney General.
14 — Children and age-related requests
The Site is intended for a general adult audience interested in software, AI, and possible professional collaboration. It is not directed to children under 13, and I do not knowingly collect their personal information through forms or update signups. People under 18 should not submit an inquiry or request a paid engagement on their own.
If you believe a child under 13 has submitted personal information, contact richard@dobias.ai so I can investigate and take appropriate action, including deletion where required. A parent or guardian may contact me about a child’s information. These statements do not remove duties that arise if I actually learn that children’s information has been collected.
15 — Visitors outside the United States
I operate from California. Hosting, email, and security providers may process or store information in the United States and in other countries where they operate. Privacy protections may differ between locations.
If a privacy law outside California applies to a particular interaction, its mandatory requirements and rights still apply. Depending on that law, processing may rely on your request for a response, necessary operational or security interests, legal obligations, or consent where required. You may contact me about access, correction, deletion, restriction, objection, withdrawal of consent, or a regulator complaint where those rights apply.
Visiting the Site is not a blanket waiver of foreign privacy rights, consent to optional tracking, or a claim that an international-transfer mechanism has been implemented. Any activity that requires a specific lawful basis, transfer safeguard, or local notice must be evaluated before that activity is introduced.
16 — Policy changes and contact
The effective date appears at the top of this page. When practices change, I will revise the policy and update that date. Material changes will be highlighted on the Site or communicated directly where appropriate or legally required. A new policy does not retroactively authorize a materially incompatible use of previously collected information without any notice or permission the law requires.
Planned analytics, advertising, a chatbot, embedded media, newsletter delivery, payments, or new account features are not authorized simply because they might be added later. Their actual data flows, vendor settings, disclosures, and any required choices must be reviewed first.
For privacy questions, accessibility assistance with this policy, or requests concerning your information, contact Richard Dobias at richard@dobias.ai. This policy is available at dobias.ai/privacy-policy/.