Skip to content
Privacy

Privacy notice

Last updated: 5 November 2026

Who is responsible

This website is run by Hafiz Syed Shah Ali, Lahore, Pakistan. For any question about your data, email hello@shahali.dev.

In short

This site uses no cookies and gives you no identifier. It does not store your IP address, does not fingerprint your device, and uses no third-party analytics or advertising.

What is processed and why

Hosting. Every visit goes through Vercel, which receives your IP address and browser details to deliver the page and keeps request logs.

Contact form. When you send a message, your name, email address and message are emailed to me through Resend. They are not stored in a database on this site. Email sent to hello@shahali.dev is forwarded to my inbox by ImprovMX.

Chat assistant. Your question and the last few messages of the conversation are sent to an AI provider to generate an answer, and your question is also sent to Google's Gemini API to find the parts of this site that answer it. This site does not store conversations; the conversation stays in your browser tab. Please do not enter personal or confidential information.

Visitor statistics. I count visits with my own script, without cookies, to see which pages and sections are read, where visitors come from and how often my CV is downloaded. This covers the page you visit; which sections of the home page you view and which of its main links and buttons you click; the website you came from (by name only); your approximate country and city, which Vercel derives from your IP address; your device type and browser family; and how fast the page loaded. The statistics are kept as daily totals and as short logs of recent visits and CV downloads, with no identifier.

Abuse prevention. To limit how many messages and questions can be sent, a salted hash of your IP address (not the address itself) is kept for a short time.

Legal basis

All processing is based on legitimate interest (Art. 6(1)(f) GDPR): replying to messages, answering questions about my work, understanding how the site is used, and protecting the site from abuse.

Who receives data

  • Vercel (United States): hosting and request logs.
  • Upstash (United States): rate-limit counters and visitor statistics.
  • Resend (United States): delivers contact-form messages to me.
  • ImprovMX (United States): forwards email sent to hello@shahali.dev.
  • Google Gemini API (United States): receives every chat question, and answers when the other AI providers are unavailable. On the free tier, Google may use questions to improve its services.
  • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China): answers chat questions first. Its privacy policy states that it processes and stores data in China and may use what users enter to train its models.
  • NVIDIA, reached through OpenRouter (both United States): answers chat questions when DeepSeek is unavailable. OpenRouter keeps only usage details such as the response time; NVIDIA logs use for security and to improve its products, without linking it to your identity.

These services are outside the European Union, so your data is processed in the United States and, for chat questions, also in China.

How long data is kept

  • IP hashes for abuse prevention: from 30 seconds to 24 hours.
  • Log of recent visits: up to 30 days. Log of CV downloads: up to 90 days.
  • Daily totals: about 13 months.
  • Contact messages: in my email inbox. I delete them when you ask.
  • Chat questions: not stored by this site. The AI providers keep them under their own policies.
  • Vercel and Resend logs: kept under their own retention policies.

Your choices

If your browser sends Do Not Track or Global Privacy Control, your visits are not counted, and a CV download is counted only as an anonymous number. Requests to the chat assistant and the contact form are still included in the daily totals.

You can also turn counting off for this browser with the button below. It has the same effect, and it saves one setting in your browser's local storage, only because you asked for it.

Your rights

You can ask for access to your data, object to its processing and ask for it to be erased by emailing hello@shahali.dev. You can also complain to a data protection supervisory authority, for example in the EU country where you live.

The visitor statistics contain no identifiers, so they cannot be linked to you, and I cannot find or delete one visitor's entries in them.