1. Who I am
This website is operated by Ijaz Khan, an independent software developer. For applicable privacy laws, I am the controller of personal information collected directly through this website.
Privacy questions and requests can be sent to ijaz@ijazkhan.com.
2. Information I collect
Information you provide
- Contact inquiries: name, email, optional phone number, company, budget, service interest, subject, message and, when available, the campaign label or referring website that brought you to the form.
- Newsletter: email address, optional name, subscription status and confirmation/unsubscribe tokens.
- Portfolio chat: the messages you submit, conversation context needed to answer, and any contact draft you ask the chat to prepare.
- Direct communication: information included in emails or subsequent project discussions.
Information collected automatically
The site increments aggregate daily counters for page loads and a limited list of actions, such as opening a project or submitting a contact form. Each counter contains only the date, action, page path and total count. It contains no cookie, IP address, user agent, location, referrer, session identifier, event properties or visitor-level record, so it cannot identify a person or reconstruct a journey.
If you allow optional Google Analytics, Google may process the page path, page title, campaign parameters, referring page, interactions listed in this policy, and technical information such as browser, device and approximate location. Arbitrary query parameters and contact-form or chat contents are not sent to Google Analytics.
Technical request information may also be processed by the hosting provider for delivery, security, debugging and abuse prevention.
3. How I use information
- respond to inquiries and assess potential projects, employment or collaboration;
- deliver requested newsletter messages and manage confirmations or unsubscribes;
- answer portfolio questions and prepare contact drafts requested through the chat;
- operate, secure, troubleshoot and improve the website;
- understand site usage through non-identifying aggregate counters and, when you consent, Google Analytics;
- prevent spam, fraud, abuse and unauthorized access;
- comply with legal obligations and establish or defend legal claims.
I do not sell personal information and do not use it for third-party behavioural advertising.
4. Legal bases
Where laws such as the UK GDPR or EU GDPR apply, processing relies on:
- Steps at your request or contract: responding to a project inquiry and taking steps toward an engagement.
- Consent: newsletter subscriptions and optional Google Analytics. Consent can be withdrawn at any time.
- Legitimate interests: operating and securing this portfolio, preventing abuse, answering ordinary communications and improving services in ways reasonably expected by visitors.
- Legal obligations: recordkeeping or disclosures required by applicable law.
5. AI portfolio chat
The assistant saves recent messages and your unsent message in this browser’s local storage so you can close and reopen it without losing the conversation. Up to 24 messages are retained for seven days since the latest activity. Expired history is removed when you reopen the assistant; use “Clear conversation” to remove it sooner, or clear this site’s browser storage. Contact confirmation tokens are not saved locally. Avoid using chat for sensitive information, especially on a shared device. If browser storage is unavailable, history may not survive closing the assistant.
Chat messages are sent to Google Gemini to generate an answer. Relevant published portfolio excerpts retrieved from the site database may be included with your question.
I do not store full chat transcripts in my analytics database. I keep limited operational events with a 30-day retention target, including a salted hash derived from the request's network address, provider/model, response duration, source count, tool names and success or error status. Temporary rate-limit records use the same kind of hash and expire after their rate-limit window. If you explicitly confirm a contact draft, its contact details become a normal inquiry record.
Do not put passwords, credentials, financial information, health information, confidential business data or other sensitive personal information into the chat.
Provider handling depends on the account tier. Google states that content submitted through unpaid Gemini services may be used to improve its products and may be reviewed by humans; paid-service handling differs. See the Gemini API Additional Terms.
6. Service providers and recipients
I use providers only where needed to operate the site:
- Vercel: hosting, content delivery and request processing.
- Supabase: PostgreSQL database, vector storage and uploaded media.
- Resend: contact notifications, replies and newsletter email delivery.
- Google: Gemini AI and embeddings, plus Google Analytics only after analytics consent.
Information may also be disclosed where required by law, to protect rights or security, or in connection with a legitimate business transfer. I do not permit providers to use contact information for their own marketing on my behalf.
8. How long information is kept
- Inquiries: for as long as needed to respond, evaluate or perform an engagement, maintain reasonable business records, resolve disputes and meet legal obligations.
- Newsletter: while subscribed. After unsubscribe, a minimal suppression record may be retained to honour the request and avoid sending further mail.
- Aggregate analytics counters: retained as non-identifying totals for long-term trend comparison.
- Google Analytics: retained according to the data-retention setting configured for the GA4 property and Google’s applicable policies.
- AI operational events: records older than 30 days are removed during subsequent event writes. Rate-limit records expire after their applicable control window and are removed during subsequent writes. Expired records may remain stored while the service is inactive.
Retention may be extended where required by law or necessary for legal claims. You may request deletion at any time, subject to lawful exceptions.
9. Your privacy rights
Depending on where you live, you may have rights to:
- access or receive a copy of personal information;
- correct inaccurate or incomplete information;
- request deletion or restriction;
- object to processing based on legitimate interests;
- withdraw consent without affecting earlier lawful processing;
- request portability where applicable; and
- complain to your local data-protection authority.
Send requests to ijaz@ijazkhan.com. I may need enough information to verify the request and protect other people’s data. Newsletter consent can also be withdrawn using the unsubscribe link in each email. Analytics consent can be changed through “Analytics settings” in the footer.
10. International data transfers
The website is available internationally and providers may process information in countries other than yours, including the United States and regions selected for hosting or database infrastructure. Where required, transfers are handled through provider contractual safeguards or another legally recognized transfer mechanism.
11. Security
I use access controls, encrypted transport, server-side validation, hashed abuse-control identifiers, rate limiting, restricted administrator routes and reputable infrastructure providers. No online service can guarantee absolute security, so please avoid sending unnecessary sensitive data.
12. Children’s privacy
This professional portfolio is not directed to children under 16, and I do not knowingly collect their personal information. A parent or guardian who believes a child submitted information can contact me to request deletion.
13. Changes and contact
I may update this policy when the website, providers or legal requirements change. The effective date at the top will be revised, and material changes may receive additional notice on the site.
Questions: ijaz@ijazkhan.com.