Privacy policy.

1. Who I Am

This is the website of Muhammad Saif ("I", "me"), a freelance full-stack developer and AI engineer based in Lahore, Pakistan. I am the data controller for the personal data collected through saifcodes.com. This policy explains what I collect, why, who else handles it, and the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws.

In short: you can browse the site without being tracked by cookies unless you accept them, I only collect what you choose to send me through the contact form, and I never sell your data or use it for advertising.

2. What I Collect, Why, and on What Legal Basis

Contact form and email

When you send a message, I receive your name, email address, company (if you give one) and what you write. I use this only to reply to you and to discuss a possible project. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and, for general questions, my legitimate interest in answering messages sent to me (Art. 6(1)(f)).

Spam protection

The contact form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. Turnstile reads technical signals from your browser, such as your IP address and browser characteristics, only to perform this check. The legal basis is my legitimate interest in keeping the form free of spam and abuse (Art. 6(1)(f)).

Hosting and server logs

The site is hosted by Vercel. Like any web server, it processes your IP address, browser type, the page requested and the time of the request so it can deliver the page and protect the site against attacks. The legal basis is my legitimate interest in running a secure, working website (Art. 6(1)(f)).

Privacy-friendly visitor statistics

I use Vercel Web Analytics to count page views. It sets no cookies and does not identify you: visits are grouped using a short-lived hash of the request that Vercel discards within 24 hours, and I only see aggregated numbers. The legal basis is my legitimate interest in knowing which pages are useful (Art. 6(1)(f)).

Google Analytics (only with your consent)

If you click "Accept" in the cookie banner, I use Google Analytics 4 to understand in more detail how visitors use the site, for example which pages are read, how long people stay, the referring website, the type of device and browser, and an approximate location (country or city) derived from your IP address. Google Analytics 4 does not store IP addresses. Google signals and ad personalisation are switched off, so this data is not used for advertising. If you don't accept, the Google Analytics script is never loaded. The legal basis is your consent (Art. 6(1)(a)), which you can withdraw at any time.

4. Who Receives Your Data

I don't sell or rent personal data. I share it only with the service providers below, who process it on my behalf under data processing terms:

• Vercel Inc. (USA): website hosting and cookieless statistics.
• Cloudflare, Inc. (USA): Turnstile spam protection on the contact form.
• Resend (USA): delivers contact form messages to my inbox.
• Google (Google Ireland Ltd. for visitors in the EEA, Google LLC in the USA): Google Analytics, only with your consent, and the email service where I read your messages.

I may also disclose data where the law requires it, or to protect my legal rights.

5. International Transfers

I work from Pakistan, and the providers above are based in or use servers in the United States. These countries may not offer the same level of data protection as the EU or UK. Where a provider is certified under the EU-US Data Privacy Framework (and its UK extension), transfers rely on that framework; otherwise they rely on the European Commission's Standard Contractual Clauses. When you contact me, transferring your message to me in Pakistan is necessary to answer your request (Art. 49(1)(b) GDPR).

6. How Long I Keep Data

• Contact messages: up to 2 years after our last exchange. If we work together, I keep project correspondence for as long as the work lasts and as long as tax and accounting law requires afterwards.
• Google Analytics data: no longer than 14 months, after which Google deletes it automatically.
• Server logs: for the short period Vercel retains them for security and debugging.
• Your cookie choice: 6 months.

7. Your Rights

Under the GDPR you have the right to:

• Access the personal data I hold about you and get a copy of it.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data ("right to be forgotten").
• Restriction of how I process your data.
• Data portability: receiving your data in a common, machine-readable format.
• Object to processing based on my legitimate interests.
• Withdraw consent at any time, without affecting processing that happened before.
• Lodge a complaint with a data protection authority, for example the one in the EU country where you live or work, or the Information Commissioner's Office (ICO) in the UK.

To use any of these rights, email me at hello@saifcodes.com. I'll reply within one month. I don't make decisions about you based solely on automated processing or profiling.

8. Data Security

The site is served only over HTTPS, and only I have access to the accounts that hold your data. No method of transmission or storage is completely secure, but I take reasonable measures to protect your data against loss, misuse and unauthorised access.

9. Children

This site is meant for businesses and professionals. It is not directed at children under 16, and I don't knowingly collect their data.

10. Third-Party Links

This site links to other websites, such as LinkedIn, GitHub, Upwork, Calendly and AI assistants like ChatGPT, Claude, Gemini and Perplexity. Nothing is shared with them until you click a link. Once you do, their own privacy policies apply, and I'm not responsible for how they handle your data.

11. Changes to This Policy

I may update this policy when the site or the law changes. The date at the top shows the latest version. If I start using your data in a new way that needs consent, I'll ask you again.

12. Contact Details

If you have any questions about this privacy policy or want to exercise your rights, contact me at: