Privacy & Cookie Policy

This website, zubairhussain.xyz, is the personal portfolio of Zubair Hussain, an independent developer based in Hyderabad, Pakistan ("I", "me", "my"). I am the data controller for personal data collected through this site. You can contact me at zubair@zubairhussain.xyz.

This policy explains what data is collected, why, how long it is kept, and the choices and rights you have, including under the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the ePrivacy Directive, the California Consumer Privacy Act as amended by the CPRA (CCPA), and other US state privacy laws.

Information you provide. When you use the hire-me / contact form, the scheduling flow or the chat assistant, I receive what you submit, such as your name, email address, location, project details and any message you write. Please do not submit sensitive information (health data, government IDs, payment card numbers) through these tools.

Information collected automatically. Your browser sends technical data such as IP address, browser and device type, language, pages viewed and referring page. With your consent, Google Analytics / Google Tag Manager also set cookies or similar identifiers to produce aggregated usage statistics.

Information I do not collect. I do not run user accounts, do not sell personal data, and do not knowingly collect data from children under 16.

• Responding to enquiries and bookings (contact form, scheduling, chat): performance of a contract or steps taken at your request, and my legitimate interest in replying to you (GDPR Art. 6(1)(b), (f)).
• Security and abuse prevention (bot checks via Cloudflare Turnstile, rate limiting): legitimate interest in keeping the site safe (Art. 6(1)(f)).
• Analytics and measurement (Google Analytics / Tag Manager): your consent (Art. 6(1)(a)). No analytics or advertising storage is granted until you click Accept.
• Remembering preferences (theme, language, cookie choice): strictly necessary or functional storage, which does not require consent.
• Legal obligations: where required to comply with applicable law.

When you first visit, a banner asks you to accept or decline cookies. Declining is as easy as accepting, and the site works the same either way. Google Consent Mode v2 is used so that analytics and advertising storage stay denied by default and only switch to granted if you accept.

Change or withdraw your choice at any time using the "Cookie settings" link in the site footer, or by clearing this site's cookies and storage in your browser. Withdrawing consent does not affect processing done before withdrawal.

I do not sell your personal data and I do not "share" it for cross-context behavioral advertising. I use the following service providers (processors) who handle data only to provide their service:

• Cloudflare, for hosting, security, Turnstile bot protection and the AI chat model.
• Google (Analytics, Tag Manager, Fonts, and Firebase), for analytics (with consent) and application services.
• Google Calendar and Google Meet, if you choose to book a call Your name, email, notes and chosen time create an event on my Google Calendar, a Meet link, and an invitation sent to you. The request passes through my booking service on Google Cloud, which does not store it. The booking page uses Cloudflare's location data, based on your IP address, to show times in your local time zone.
• YouTube (privacy-enhanced mode), when you play an embedded video.
• An email delivery service, to forward your contact form message to me.

I may also disclose data where required by law or to protect rights and security.

I am based in Pakistan and the providers above operate globally, so your data may be processed outside your country, including in the United States. Where the GDPR or UK GDPR applies, transfers rely on safeguards such as the EU-US Data Privacy Framework (where the provider is certified) or Standard Contractual Clauses.

• Contact, scheduling and chat messages: kept only as long as needed to respond and for any resulting work, normally no more than 24 months after the last contact, unless a longer period is legally required.
• Analytics data: retained according to Google Analytics settings (generally 14 months or less).
• Cookies: see the table in section 4.

You have the right to:

• access the personal data I hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to processing, including processing based on legitimate interests;
• data portability;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data protection authority (for EU residents, a list is at edpb.europa.eu; for the UK, the Information Commissioner's Office at ico.org.uk).

To exercise these rights, email zubair@zubairhussain.xyz. I will respond within one month.

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws may have the right to know and access what personal information is collected, request deletion or correction, opt out of the sale or sharing of personal information and of targeted advertising, and not be discriminated against for exercising these rights.

• Categories collected in the past 12 months: identifiers (name, email, IP address), internet activity (pages viewed), and the content of messages you send.
• Sale / sharing: I do not sell or share personal information for cross-context behavioral advertising. Choosing Decline in the cookie banner keeps all advertising storage denied.
• Sensitive personal information: not knowingly collected.
• Opt-in by default: analytics and advertising storage stay off until you click Accept, so no opt-out signal (including Global Privacy Control) is needed to prevent them.

To make a request, email zubair@zubairhussain.xyz. I may need to verify your identity first, and you may use an authorized agent. You may appeal a refusal by replying to my response.

The site is served over HTTPS and protected with security headers, bot protection and rate limiting. No method of transmission or storage is perfectly secure, so I cannot guarantee absolute security. If a breach affecting you occurs, I will notify you and the relevant authorities as required by law.

This site is not directed at children under 16 and I do not knowingly collect their personal data. If you believe a child has provided data, contact me and I will delete it.

This site links to third-party sites such as GitHub, LinkedIn and X. Their privacy practices are their own and are not covered by this policy.

I may update this policy from time to time. The date at the top shows the latest revision. Material changes will be highlighted on this page.

Questions or requests about privacy: zubair@zubairhussain.xyz.