Legal
Privacy Policy
This policy explains what information the portfolio, AI assistant, voice assistant, and booking features process, why, and the choices available to you.
1. Who operates this site
This personal portfolio at jamesugbanu.com is operated by James Ugbanu, an individual. No company registration, separate legal entity, or physical business address is claimed by this policy.
Privacy questions and requests can be sent to jamesugbanu@gmail.com.
2. Scope of this policy
This policy describes the portfolio website, the text chat and RAG assistant, the separate self-hosted voice assistant at voice.jamesugbanu.com, contact requests, and booking features. It does not govern third-party websites or services that have their own privacy policies.
The voice service is a separate application and server. It calls the portfolio RAG API over HTTPS; it does not share a private filesystem, database, or network with the portfolio.
3. Information we collect
Depending on how you use the site, the following categories may be processed.
- Content you provide: chat questions, conversation turns, contact-request name/email/company/message, booking name/email/agenda, and selected meeting details.
- Voice content: microphone audio while a voice session is active, and the transcript produced from it. Audio is transmitted to the voice service over an encrypted WebSocket.
- Technical and session data: an anonymous browser session identifier, browser/OS/device type, referrer, coarse country/region/city/timezone derived from hosting headers, timestamps, latency and error information, and a salted hash of your IP address.
- Security and abuse-prevention data: rate-limit counters, session/attempt records, and operational logs. The application does not store raw IP addresses in its own analytics tables, although hosting and infrastructure providers may process connection data under their own policies.
- Google Calendar booking data: your name, email, requested time, duration, timezone, agenda, event identifier/link, and booking status when you make a booking.
4. Why we process information and legal bases
We use information to answer questions, retrieve relevant portfolio evidence, operate the voice assistant, arrange and confirm bookings, respond to contact requests, protect the service from abuse, diagnose failures, and improve the experience.
Where a legal basis is required, we rely on your consent when you choose to use voice, submit a contact request, or make a booking; steps needed to enter into a booking arrangement; our legitimate interests in securing, operating, and improving the service; and compliance with legal obligations. The applicability of a particular legal basis depends on your jurisdiction and requires legal review.
5. AI and conversation processing
Chat questions, recent conversation turns, a compact summary of older turns, and retrieved portfolio context are sent to the configured AI model and embedding provider so the assistant can generate an answer. The provider receives only what is needed for those requests, subject to its own terms and retention practices.
Portfolio facts are retrieved from the site's PostgreSQL corpus. The assistant is instructed not to invent portfolio facts, but generated responses can still be incomplete or inaccurate. Do not submit passwords, financial account details, health information, or other sensitive personal information to the assistant.
We do not use conversations to train our own models. Third-party model and embedding providers may process data under their own agreements; this site does not control their independent retention or training practices.
6. Voice processing
When you start a voice call, your microphone audio is sent over an encrypted WebSocket to the voice service. Speech recognition and speech synthesis run on that separate server. The cloned voice is built from an authorized reference belonging to the site owner, not from visitor audio.
The voice service's own SQLite store is designed to hold session, quota, attempt, and salted-IP-hash records; it does not store visitor audio recordings or transcripts. Raw audio is processed in memory for the active turn. The final transcript is sent to the portfolio RAG API, where it may be stored with the generated answer in the portfolio's RAG analytics.
Operational logs may record timing, frame counts, session identifiers, and error codes, but are designed not to log audio or transcript text. Diagnostic audio capture is disabled by default in production.
7. Memory and session behavior
The portfolio stores an anonymous RAG session identifier in your browser's localStorage, with a timestamp, and rotates it after about 30 days of disuse. Recent chat turns are held in the page's React state and sent with subsequent questions; older turns may be represented by a compact summary. The server may store questions and answers in its RAG analytics tables.
The voice service keeps the active call's recent turns in server memory so follow-up questions have context. That voice state is not shared across separate calls or visitors. The voice service also sets an anonymous visitor cookie with a one-year lifetime for quotas and session limits.
Starting a new chat clears the visible transcript but does not necessarily erase server analytics immediately. Reloading the page, starting a new voice call, or reconnecting may lose active conversational state. There is no permanent cross-session visitor profile.
8. Calendar bookings
When you request a booking, we collect your name, email, requested slot, duration, timezone, and optional agenda. The portfolio checks the owner's configured availability and genuine Google Calendar free/busy information, then creates an event only after you explicitly confirm.
Google Calendar receives the event title, time, timezone, your email address, and agenda so it can create the appointment and send an invitation where configured. The site stores booking status, identifiers, and the event link in PostgreSQL. The owner's Google OAuth refresh token is stored server-side, not in browser code.
A slot shown in conversation is not a confirmed booking. A booking is confirmed only when the booking service and Google Calendar both return a successful result. Calendar failures, timeouts, and uncertain outcomes are not reported as confirmations.
9. Service providers and sharing
The site uses service providers to operate the service. Verified categories include Vercel for application hosting, Neon for PostgreSQL/pgvector storage, an OpenAI-compatible AI model and embedding provider for RAG generation, Google Calendar for availability and appointments, an SMTP email provider for contact-request notifications, and Cloudflare/Hetzner infrastructure for the separate voice service. AWS scheduling and GitHub Container Registry support deployment operations.
These providers process data on the site's behalf or as independent controllers under their own terms. We do not sell personal information or use it for advertising. We may disclose information when required by law, to protect the service or users, or in connection with a genuine security incident, subject to applicable legal requirements.
11. Retention and deletion
RAG analytics (sessions, questions/answers, telemetry, and cached answers) are configured with a 90-day retention target when the repository's retention job is run. The answer cache also has a seven-day cache lifetime. Records may remain until that job actually runs; the site does not guarantee immediate deletion.
Contact requests and booking records currently have no automated expiry configured and are retained until the owner deletes them, they are no longer needed, or a legal requirement applies. The voice service's session/attempt records also have no automatic deletion beyond stale-session status handling. Provider logs and backups may have separate retention periods that the site cannot control or confirm.
You can request access, correction, or deletion of information associated with you by emailing jamesugbanu@gmail.com. We may need to verify your identity and may be unable to remove data from third-party provider backups or records that we are legally required to retain. There is no self-service deletion tool.
12. Security
The site uses HTTPS, server-side secret storage, signed or opaque session identifiers, salted IP hashing, HMAC voice tickets, rate limits, owner-only server-side authorization, and scrypt-hashed owner credentials. Access to production systems is restricted to the operator and authorized providers.
No internet service can guarantee absolute security. Do not send highly sensitive information through the assistant, voice interface, or booking form.
13. International transfers
The hosting, database, AI, Calendar, email, and voice infrastructure providers may process information in countries other than your own, including the United States and the European Union. Those providers' contractual and legal safeguards govern their processing. The operator should confirm the applicable transfer mechanism and provider locations before relying on this policy for a regulated transfer.
14. Your rights
Subject to applicable law, you may request access to your personal information, correction of inaccurate information, deletion, restriction of processing, objection to certain processing, portability where applicable, and withdrawal of consent where processing is based on consent. You may also complain to a competent data-protection authority.
Nigeria's Data Protection Act 2023 may apply to some processing; if you are in the EEA, UK, or another jurisdiction with mandatory privacy rights, additional rights may apply. This policy does not claim certification or a particular compliance status. Send requests to the contact address below.
15. Children's privacy
The site is a professional portfolio and is not directed to children under 18. Do not submit personal information through the assistant, voice service, or booking form if you are under 18 without a parent or guardian. If the operator learns that a child's information was collected without appropriate consent, the operator will take reasonable steps to delete it.
16. Policy updates
This policy is effective 18 October 2026. Material changes will be reflected by updating this page and its effective date. Continued use after a change does not override rights that cannot be waived under applicable law.
17. Contact
Privacy questions and requests: jamesugbanu@gmail.com. This policy describes current practices and is not legal advice; jurisdiction-specific legal review remains necessary.