Home / How I handle your data

Legal · Privacy

How I Handle Your Data

What this site collects when you visit or get in touch, why, where it is stored, and what you can ask me to do with it. Written in plain English, because nobody should need a lawyer to read a privacy policy.

Contents

01 · Who I am

The Person Behind This Website

This website, mdshahinkhan.com, is run by Md Shahin Khan, a freelance WordPress and Shopify developer based in Bangladesh who works with clients in the United States, the United Kingdom, Australia, and Europe. For anything to do with your personal data on this site, I am the data controller and you can reach me at [email protected].

This policy explains what I collect when you visit the site or get in touch, why I collect it, where it is stored, and what you can ask me to do with it. I have tried to write it the way I would explain it on a call.

02 · What I collect

Only What You Give Me, Plus Basic Visit Data

Information You Give Me

Contact form: your name, email address, website address (optional), the type of project, budget range, timeline, and your message.
Email: whatever you choose to include when you write to [email protected].
Booking a call: the name, email address, and notes you enter on Calendly when you book a slot. Calendly collects this under its own privacy policy and passes the booking details to me.

Information Collected Automatically

Analytics data: pages viewed, approximate location (country or city level), device and browser type, how you arrived, and which buttons you clicked, collected through Google Analytics 4 via Google Tag Manager. IP addresses are not stored by Google Analytics 4.
Server and security logs: my hosting provider and Cloudflare keep standard request logs (IP address, time, requested page, user agent) to run the site and block abuse.

I do not sell personal data, I do not buy lists, and I do not run advertising on this site.

03 · How I use it

Replying to You and Improving the Site

To answer your message, quote a project, and run the project if we work together.
To schedule and hold calls you book.
To understand which pages and articles people find useful, so I can improve them.
To keep the site secure and working.
To meet legal or tax obligations, for example keeping invoices.

Under the GDPR and UK GDPR the legal bases are: performance of a contract or steps before one (your enquiry and any project), legitimate interests (analytics, security, keeping records of correspondence), and legal obligation (accounting records). Where consent is required for analytics cookies in your country, the site relies on your browser and consent settings.

I do not use your data for automated decision-making or profiling, and I do not send newsletters or marketing emails. If that ever changes, you will be asked first.

04 · Analytics and cookies

What Is Set and How to Opt Out

The site uses Google Tag Manager to load Google Analytics 4. Google Analytics sets first-party cookies (for example _ga and _ga_*) that last up to two years and tell me whether a visit is new or returning. The events I track are page views, clicks on the “Book a call” buttons, clicks on the “Send a message” links, and successful contact form submissions. None of these events carry your name or message.

Cloudflare may set a small technical cookie for security purposes. The site sets no advertising cookies and no social media tracking pixels.

To opt out, you can block cookies in your browser, install the Google Analytics opt-out add-on, or use a browser with tracking protection. The site works fully without cookies.

05 · Third-party services

Who Else Touches the Data

These are the services involved in running the site and handling your messages. Each one has its own privacy policy.

Hostinger (web hosting, servers in the United States): stores the website and the contact form submissions.
Cloudflare (DNS, security, and email routing): passes web traffic and forwards email sent to [email protected].
Google (Google Analytics 4, Google Tag Manager, Gmail, Google Workspace tools): analytics and my email inbox.
Calendly: call booking.
Fiverr and Upwork: if you hire me through either marketplace, that platform handles payment and messaging under its own terms and privacy policy.

I share personal data with these providers only as needed to run the site and reply to you. I do not share it with anyone else unless the law requires it.

06 · Where data is stored

United States and My Own Devices

The website and its database, including contact form submissions, are hosted in the United States. Email lives in Gmail. Analytics data lives with Google. I read and reply to messages from Bangladesh on devices protected with device encryption and two-step verification.

If you are in the UK or the EU, this means your data is transferred outside your region. The providers above rely on standard contractual clauses and, where relevant, the EU-US Data Privacy Framework for those transfers.

07 · How long I keep it

As Long as It Is Useful, Then It Goes

Contact form submissions: kept in the site’s database for up to 12 months, then deleted. The email copy stays in my inbox as ordinary correspondence.
Email: kept while we are in touch and for up to 3 years after the last message, so that I can pick up where we left off if you come back.
Project files and invoices: kept for as long as required for accounting, usually 7 years.
Analytics: Google Analytics 4 event data is retained for 14 months.

If you ask me to delete your data sooner, I will, unless I have to keep an invoice or a contract for legal reasons.

08 · Your rights

Ask, and I Will Act on It

Depending on where you live (including under the GDPR, the UK GDPR, the Australian Privacy Act, and US state laws such as the CCPA), you can ask me to:

tell you what personal data I hold about you and give you a copy;
correct anything that is wrong;
delete it;
stop using it for a particular purpose, or restrict how I use it;
send it to you or to another provider in a usable format.

Email [email protected] and I will reply within a few days, and in any case within 30 days. There is no charge. If you are in the EU or UK and are not satisfied with my answer, you can complain to your local data protection authority.

09 · Children

This Site Is for Businesses

The site is aimed at business owners and is not directed at children under 16. I do not knowingly collect data from children. If you believe a child has sent me personal data, email me and I will delete it.

10 · Changes

How Updates Are Announced

If I change this policy, I will update the effective date at the top of the page. For a change that affects how your data is used, I will also mention it on the contact page for a period after the change. This version is effective from 16 September 2026.

11 · Contact

How to Reach Me About Privacy

Md Shahin Khan
Freelance WordPress and Shopify developer
Bangladesh
[email protected]

You can also use the contact form.

Have a Question About Any of This?

Email me and I will answer it plainly. I read every message and usually reply within a few hours.

Free 30-minute call · Written plan included · 30 days of fixes after launch