Legal
US state privacy
Most US privacy notices are copied from a template belonging to a company a thousand times the size. This one states the thresholds, shows that none is met, and then tells you what actually happens to your data — which is governed by something stricter anyway.
Last updated: 7 September 2026
1 · The short version
This site is run by ANDRONIC ANDREI-BOGDAN PERSOANA FIZICA AUTORIZATA, a one-person sole proprietorship in Romania. No US state privacy law applies to it — every one of them sets a size or volume threshold, and this operation is nowhere near any of them.
That is a statement about scale, not an attempt to avoid anything. The site is already governed by the GDPR, which is generally stricter than every law in the table below — most obviously because it requires opt-in consent before analytics rather than an opt-out afterwards.
2 · The thresholds, and where this site sits
| State | Law | Applies if | Met? |
|---|---|---|---|
| California | CCPA / CPRA | $25M revenue, or 100,000 consumers, or 50% of revenue from selling data | No |
| Virginia | VCDPA | 100,000 consumers, or 25,000 + 50% of revenue from selling data | No |
| Colorado | CPA | 100,000 consumers, or 25,000 + revenue from selling data | No |
| Connecticut | CTDPA | 35,000 consumers (lowered 1 July 2026), or any sale of sensitive data | No |
| Utah | UCPA | $25M revenue AND 100,000 consumers | No |
| Texas | TDPSA | No volume threshold; small businesses exempt unless selling sensitive data | No |
There is a second reason most of these do not apply. Outside California, "consumer" is defined as a person acting in an individual or household capacity — business-to-business contacts are excluded outright. Nearly everyone who contacts this site is doing so on behalf of a company.
3 · Personal information is not sold, and not shared for advertising
Nothing on this site is sold, rented, or shared for cross-context behavioural advertising — under the CCPA's definitions or anyone else's. There is no advertising, no ad network, no data broker, and no tracking pixel of any kind.
You will not find a "Do Not Sell or Share My Personal Information" link here, and that absence is deliberate: that link is required of businesses that sell or share. Publishing one while selling nothing would imply the opposite of the truth and hand you a control that does nothing.
4 · What is collected, in the categories US laws use
- Identifiers — your name, email address and IP address, if you use the contact form or the AI agent.
- Commercial information — what you say about the project you are enquiring about.
- Internet activity — page views, and a session replay, only if you switch those on.
No sensitive categories are collected: no government identifiers, no financial account details, no precise geolocation, no biometrics, no health data. The full detail is in the privacy policy.
5 · Your rights, offered regardless
The rights these laws grant — to know, to access, to delete, to correct, to opt out, and not to be discriminated against for asking — are all honoured here, because the GDPR requires them and there is no sense running two standards.
Write to privacy@iambogdan.com or use the contact form. There is no charge, no account to create, and no form to fill in. Section 9 of the privacy policy covers how requests are handled, including honestly how long they take.
6 · If a threshold is ever met
If this operation ever grows into any of the rows above, this page stops being a courtesy and becomes an obligation, and it will be rewritten rather than quietly edited. The date at the top will say when.