Privacy Policy | Muhammad Asif

This policy explains how I, Muhammad Asif, handle personal data when you visit www.asifdev.com (the "site") or contact me through it. I have tried to keep it short and in plain English.

Who I am

Muhammad Asif is a freelance software developer (Angular and Node.js) based in Pakistan. This is my personal portfolio site. For the purposes of data protection law (such as the EU and UK GDPR), I am the controller of the personal data described here. You can reach me at [email protected].

What data I collect

When you contact me

The contact form asks for your name, email address, an optional subject and your message. The short "drop your email" boxes collect only your email address. Along with each message, the site automatically records:

your browser's user agent (browser and operating system version);
a salted, one-way hash of your IP address – not the IP address itself – used to spot repeated abuse;
the reCAPTCHA score Google returned for your visit (a number between 0 and 1 estimating how likely the visitor is a human);
which form you used and when you sent it.

Spam and abuse protection (Google reCAPTCHA)

The site uses Google reCAPTCHA v3 to keep bots away from the contact form and the site's API. It runs invisibly in the background and is loaded the first time your browser needs to talk to the API (for example when you open another page or send a message). reCAPTCHA collects hardware and software information, such as device and browser data, your IP address and how you interact with the page, and sends it to Google for analysis. Google's use of this data is governed by the Google Privacy Policy and Google Terms of Service.

After a successful check, the site issues a short-lived session token tied to a hash of your browser's user agent, so reCAPTCHA does not have to run again on every request.

Technical data

Like any website, the servers that run this site receive your IP address and standard request details (page requested, browser type, time) because they are needed to deliver pages to you. Your IP address is held briefly in memory to rate-limit requests. My application logs record the request method, page, status and response time, not your IP address. My hosting provider may keep its own short-lived access and security logs.

Preferences stored on your device

If you choose a light or dark theme, that choice is saved in your browser's local storage, not sent to me. See the Cookie Policy for the full list of cookies and storage the site uses.

Analytics (Google Analytics 4, only with your consent)

I use Google Analytics 4, loaded through Google Tag Manager, to see which pages are read and how visitors find the site. Analytics cookies are used only if you click "Accept analytics" in the cookie banner. If you accept, Google Analytics records the pages you view, the page you came from, your approximate location (country and city, derived from your IP address, which Google Analytics does not log or store), your device, browser and screen size, and a random identifier stored in the _ga cookies.

Until you accept, or if you reject, the site uses Google Consent Mode with analytics storage "denied": no analytics cookies are read or written and no identifier is stored on your device. Google may still receive basic, cookieless signals (for example that a page was viewed, the time, your browser type and your consent choice), which it uses only for aggregated, modelled statistics. I do not use Google Analytics for advertising: ad storage, ad personalisation and Google signals are off.

You can change or withdraw your choice at any time with the "Cookie settings" link at the bottom of every page, or block Google Analytics everywhere with Google's opt-out browser add-on. Withdrawing consent does not affect data collected before.

How I use your data and why

To reply to your message and discuss any project you ask about. Legal basis: taking steps at your request before entering into a contract, and my legitimate interest in answering enquiries (GDPR Art. 6(1)(b) and (f)).
To protect the site from spam, bots and abuse (reCAPTCHA, session tokens, rate limiting, the hashed IP). Legal basis: my legitimate interest in keeping the site and my inbox secure (Art. 6(1)(f)).
To remember your theme choice. This stays in your browser and is set only when you pick a theme yourself.
To understand how the site is used (Google Analytics with cookies). Legal basis: your consent (Art. 6(1)(a), and the consent rules for cookies), which you can withdraw at any time. The cookieless signals sent before you decide or after you reject rely on my legitimate interest in basic, aggregated statistics without identifying you (Art. 6(1)(f)).
To remember your cookie choice (the bo_cookie_consent cookie). Legal basis: my legal obligation to respect and be able to show your choice (Art. 6(1)(c)).

I do not sell your data, use it for advertising, add you to a mailing list or make decisions about you based solely on automated processing. The reCAPTCHA score is only used to filter spam, and analytics data is only used in aggregated reports.

How long I keep it

Contact messages (including the hashed IP, user agent and score): for as long as I need them to handle your enquiry and any work that follows, and no longer than 24 months after our last contact unless we have an ongoing working relationship or the law requires longer. You can ask me to delete your message at any time.
Session tokens: about 20 minutes, renewed while you browse, and never longer than 12 hours.
Rate-limit counters: a few minutes, in memory only.
Theme preference: until you clear your browser's site data.
Google Analytics data: up to 14 months, then deleted by Google; the _ga cookies expire after 2 years unless you clear them or withdraw consent and clear them.
Your cookie choice: 6 months, after which the banner asks again.

I share personal data only with service providers that help me run the site, and only as far as they need it:

Hosting and database providers, which run the site's servers and store contact messages.
A transactional email provider (such as Resend or Brevo), which delivers the notification email containing your message to my inbox.
Google, for reCAPTCHA as described above, and as my processor for Google Analytics and Google Tag Manager (Google Ireland Limited for visitors in the EEA, UK and Switzerland; Google LLC elsewhere), under Google's data processing terms.
Cloudflare (R2 storage), which serves the site's images and my CV. Your browser downloads these files directly from Cloudflare, which receives your IP address and standard request details. No form data is stored there.

I may also disclose data if the law requires it, or to protect my rights, the site or other people. I do not share your data with anyone else.

International transfers

I am based in Pakistan, and my service providers may process data in other countries, including the United States and the European Union. Where data protection law requires it, these transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Your rights

Depending on where you live, you may have the right to:

access the personal data I hold about you and get a copy of it;
have inaccurate data corrected (rectification);
have your data deleted (erasure);
restrict or object to how I use it, including processing based on legitimate interests;
receive your data in a portable format;
complain to a supervisory authority, for example the data protection authority in the EU/EEA country where you live or the Information Commissioner's Office (ICO) in the UK.

To use any of these rights, email [email protected]. I will reply within one month. I may need to ask you to confirm the email address you used, so that I only release data to the right person.

Security

The site is served over HTTPS. IP addresses are stored only as salted hashes, session tokens are signed and short-lived, and only I can access the admin area where messages are kept. No system is perfectly secure, but I take reasonable technical and organisational measures to protect your data.

Children

This site is aimed at businesses and professionals. It is not directed at children under 16, and I do not knowingly collect their personal data. If you believe a child has sent me personal data, please contact me and I will delete it.

Changes to this policy

I may update this policy when the site or the law changes. The "Last updated" date at the top shows when it last changed. Significant changes will be highlighted on this page.

Contact

Questions or requests about your personal data? Email [email protected].