Privacy Policy

What I collect and why

Analytics (Google Analytics 4)

I use Google Analytics 4 to see which pages and tools are useful and which buttons people click (for example "book a call" or "send message"). It records pages viewed, approximate location derived from your IP address, device and browser type, referring site, campaign (UTM) parameters, and site events. Google Ads features are not used: ad storage, ad user data, and ad personalization are always denied.

Analytics runs with Google Consent Mode v2. If you are in the EEA, the UK, or Switzerland, analytics storage is off until you click "Accept" in the cookie banner; until then Google receives only cookieless signals without identifiers. Elsewhere, analytics is on by default and you can switch it off at any time.

Session insights (Microsoft Clarity)

Microsoft Clarity shows heatmaps and session replays of how pages are used, so I can find confusing layouts. It loads only after you accept analytics in the cookie banner. Clarity masks text you type into form fields, and I do not use it to identify individuals.

Contact form

When you send a message, I receive your name, email address, message, and any optional details you choose (the service you are interested in, timeline, budget, how you heard about me). To understand which channels bring enquiries, the form also sends how you first arrived on the site: campaign (UTM) parameters, the referring website, and your first landing page. The message is delivered to my inbox by email. It may also be passed to my own automation workflow (n8n), which records the enquiry in my CRM and sends you an automatic acknowledgement.

The form is protected by Cloudflare Turnstile, which checks that a person, not a bot, is sending it. Turnstile processes your IP address and browser signals for that check.

Booking a call (Calendly)

"Book a call" buttons open Calendly. The name, email, answers, and time you enter there are collected by Calendly and shared with me so I can hold the call. I may pass campaign parameters to Calendly so I know which page led to the booking. When you book through this website, my server looks the booking up in Calendly and sends you a confirmation email through Resend.

Free tools

The tools under /apps/ run in your browser. What you type or upload into them is not sent to my server. A few tools load open-source libraries from public CDNs (jsDelivr, esm.sh), and the currency converter fetches exchange rates from Frankfurter; those providers see your IP address as part of the request, but not your inputs. If you choose to carry a planning tool's results into the contact form, the summary is held in your browser's session storage until you send or leave the page.

Server logs

Like every web server, the host records standard access logs (IP address, time, requested URL, browser user agent) for security and troubleshooting. They are kept for a limited period set by the host and are not used for marketing.

Cookies and browser storage

• Theme (local storage, theme): remembers light or dark mode. Strictly necessary for the setting you chose.
• Consent (local storage, consent): remembers your cookie-banner choice so you are not asked on every page.
• Attribution (local storage): your first campaign parameters, referring site, and landing page, kept on your device and sent only if you submit the contact form.
• Tool hand-off (session storage, toolBrief): a planning tool's summary on its way to the contact form. Cleared when used.
• Google Analytics cookies (_ga, _ga_*): set only when analytics storage is granted. Google's default lifetime is up to 2 years.
• Microsoft Clarity cookies (such as _clck, _clsk): set only after you accept analytics.
• Cloudflare Turnstile and Calendly may set their own strictly necessary cookies when you use the contact form or the booking page.

You can change your choice at any time: open cookie settings. You can also clear this site's storage in your browser settings.

Legal bases (GDPR and UK GDPR)

• Consent (Art. 6(1)(a)): analytics and Clarity for visitors in the EEA, UK, and Switzerland. You can withdraw it at any time through cookie settings.
• Steps before a contract and the contract itself (Art. 6(1)(b)): replying to your enquiry, holding a call, preparing a proposal, and delivering a project.
• Legitimate interests (Art. 6(1)(f)): keeping the site secure and free of spam (Turnstile, server logs), understanding which channels bring enquiries (attribution), and analytics outside the regions where consent is required. You can object at any time.
• Legal obligation (Art. 6(1)(c)): keeping invoices and business records for as long as tax law requires.

Who else handles your data

I do not sell or rent personal data, and I do not share it for advertising. These service providers process it on my behalf, or as independent controllers under their own policies:

• Google (Google Analytics 4): analytics.
• Microsoft (Clarity): heatmaps and session replays, after consent.
• Cloudflare (Turnstile): bot protection on the contact form.
• Resend: delivers contact-form messages to my inbox.
• Google (Gmail / Google Workspace): my email inbox, where enquiries and replies are kept.
• Calendly: call scheduling.
• My n8n automation and CRM: recording enquiries and sending an automatic acknowledgement, when enabled.
• Web hosting (a cPanel shared hosting provider): serves the site and keeps server logs.

I may also disclose data if the law requires it, or to protect my rights in a dispute.

International transfers

I work from Bangladesh, and most of the providers above are based in the United States, so your data is processed outside the EEA and the UK. Where a provider is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), transfers rely on that; otherwise they rely on the provider's Standard Contractual Clauses. Data I access from Bangladesh is handled under the same safeguards described in this policy.

How long data is kept

• Enquiries that do not lead to a project: up to 24 months after our last contact, then deleted.
• Client records (contracts, invoices, project correspondence): for the duration of the engagement and up to 6 years after it ends, for tax and legal purposes.
• Google Analytics: user-level and event-level data is kept for the retention period set in the account (Google offers 2 or 14 months); aggregated reports are kept longer.
• Microsoft Clarity: session recordings for about 30 days and aggregated heatmap data for up to 13 months, per Microsoft's defaults.
• Browser storage: stays on your device until you clear it.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR, or US state privacy laws), you can ask me to:

• tell you what data I hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how I use it, or object to processing based on legitimate interests;
• send your data to you or another provider in a portable format;
• withdraw consent at any time, without affecting processing that happened before.

Email [email protected] and I will reply within one month. I may ask you to confirm your identity first. If you are unhappy with my answer, you can complain to the data protection authority where you live or work (in the UK, the ICO).

Security

The site is served over HTTPS with a strict Content Security Policy, form input is validated and sanitized on the server, and access to inboxes and tools is protected with strong authentication. No system is perfectly secure, but I will tell affected people and the relevant authority without undue delay if a breach puts your data at risk.

Children

This site is meant for businesses and is not directed at children under 16. I do not knowingly collect their personal data.

Changes to this policy

When the site starts or stops using a service that handles personal data, I update this page and the "Last updated" date above. See also the Terms of Use.