Privacy Policy
Last updated
Summary
This is a personal portfolio website. It has no user accounts, no advertising, no tracking cookies, and I do not sell or share your personal data. The only personal data I receive is what you choose to send me through the contact form or by email, plus the minimal technical data needed to deliver and protect the website.
Who is responsible
The controller of personal data processed through mahmudulkhan.com is Mahmudul H. Khan (Md Mahmudul Hoque Khan), based in Chattogram, Bangladesh. You can reach me about anything in this policy at hello@mahmudulkhan.com.
What I collect and why
When you visit the website
The website is hosted on Cloudflare. To deliver pages and protect the site against abuse, Cloudflare processes technical data such as your IP address, browser and device type, the page requested and the time of the request. I do not use this data to identify you, and I do not combine it with other data.
Legal basis (GDPR): legitimate interests in operating a secure, working website (Art. 6(1)(f)).
When you use the contact form
The form asks for your name, email address, a topic and your message. I use this only to read and reply to your enquiry and to keep a record of our correspondence. To block spam, the form may use Cloudflare Turnstile, which evaluates technical signals from your browser (for example, IP address and browser characteristics) without asking you to solve puzzles. A hidden field also filters out automated submissions.
Legal basis (GDPR): legitimate interests in responding to messages you send (Art. 6(1)(f)) and, where your enquiry is about working together, steps you ask me to take before entering into a contract (Art. 6(1)(b)). Spam protection relies on legitimate interests in keeping the form secure.
When you email me directly
If you write to hello@mahmudulkhan.com, I receive your email address and whatever you include in your message, and use it to reply.
What I do not do
- No advertising, profiling or automated decision-making.
- No selling or "sharing" of personal data for cross-context behavioural advertising.
- No newsletters or marketing emails unless you explicitly ask for them.
Cookies and tracking
The website does not set advertising, analytics or other tracking cookies, so there is no cookie banner. Fonts are served from this website itself, not from third-party font services. If privacy-friendly visitor statistics are enabled, they use Cloudflare Web Analytics, which counts page views in aggregate without cookies, local storage or fingerprinting. Cloudflare may use strictly necessary technical mechanisms to protect the site and the contact form from attacks.
Signals such as Global Privacy Control and Do Not Track are respected by default, because no personal data is sold or shared.
Service providers
I use a small number of providers that process data on my behalf, under their own data-processing terms:
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare, Inc. | Website hosting, content delivery, security, spam protection (Turnstile), optional cookieless analytics | Technical request data; contact-form submissions in transit |
| Resend (Plus Five Five, Inc.) | Delivering contact-form messages to my inbox | Name, email address, topic, message |
| Apple (iCloud Mail) | Email inbox for hello@mahmudulkhan.com | Emails and contact-form messages you send |
Data may also be disclosed if required by law or to protect rights and safety.
International transfers
I am based in Bangladesh, and my service providers operate globally, including in the United States. Your data may therefore be processed outside your country. Where the law requires it, transfers rely on safeguards offered by those providers, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework where a provider is certified.
How long data is kept
- Contact-form messages and emails: for as long as needed to handle your enquiry and any follow-up, and normally deleted within 24 months of our last exchange, unless we start working together or the law requires a longer period.
- Technical request data: processed by Cloudflare for delivery and security and kept only for the short periods set out in Cloudflare's own policies.
Your rights
Depending on where you live, you may have the right to:
- know what personal data I hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent;
- not be discriminated against for exercising your rights;
- complain to a data protection authority.
To exercise any of these rights, email hello@mahmudulkhan.com. I will reply within one month (or the shorter period your law requires) and may need to confirm your identity first. There is no charge.
Region-specific information
European Economic Area, United Kingdom and Switzerland
The GDPR, UK GDPR and Swiss FADP apply to personal data of people in these regions. The legal bases are listed above. You can complain to the supervisory authority where you live or work, for example the UK Information Commissioner's Office (ico.org.uk).
California and other U.S. states
Under the CCPA/CPRA and similar state laws: in the last 12 months I have collected identifiers (name, email address, IP address), internet activity data (technical request data) and the contents of messages you send, for the purposes described above. I do not sell or share personal information, do not use sensitive personal information, and do not knowingly collect data from consumers under 16. You may exercise your rights to know, delete and correct by email, or through an authorised agent.
Bangladesh
I handle personal data in line with the laws of Bangladesh that apply to personal data and digital security, and in line with this policy. You may contact me at any time to access, correct or delete your data.
India, Brazil, Canada, Australia and elsewhere
If you are covered by India's Digital Personal Data Protection Act 2023, Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act 1988 or similar laws, you can exercise the access, correction, deletion and grievance rights those laws give you by emailing hello@mahmudulkhan.com. I am the contact for any privacy grievance.
Children
This website is not directed at children, and I do not knowingly collect personal data from anyone under 16. If you believe a child has sent me personal data, please contact me and I will delete it.
Security
The website is served only over HTTPS with modern security headers. Contact-form submissions are validated and sent to my inbox, and are not stored in a website database. No method of transmission or storage is completely secure, but I take reasonable steps to protect the data I receive.
Changes to this policy
If the way this website handles personal data changes, I will update this page and its "last updated" date. Significant changes will be highlighted on this page.
Contact and complaints
Questions, requests or complaints about privacy: hello@mahmudulkhan.com. If you are not satisfied with my response, you can contact your local data protection authority.