Usama Zahid ("we", "us", "the operator") operates the website at usamazahid.design (the "site"). This Privacy Policy applies to the site and to any communication you initiate with us through it.
We collect the minimum data needed to operate the site, respond to enquiries, and ship the work we are hired to do. We do not sell data. We do not run third-party advertising. We do not fingerprint visitors.
If you are a client, additional terms apply through your engagement contract. This policy covers the public site only.
We collect three categories of data: data you provide directly, data collected automatically, and data collected from third-party services you choose to engage with.
- 01Form submissions, name, email, project type, and message body when you use the contact form. Stored in our inbox and our CRM.
- 02Email correspondence, any reply you send to hello.usamazahid@gmail.com is stored in our email and CRM systems.
- 03Server logs, IP address, user agent, request path, and referrer. Retained for 30 days for security and abuse detection.
- 04Analytics events, page views, scroll depth, click events. Sent to PostHog (self-hosted EU region) under a pseudonymous visitor ID. No cross-site tracking.
- 05Error reports, JavaScript errors and stack traces sent to Sentry. IPs are truncated before storage.
We use the data collected for the following purposes, and only these:
- 01To respond to enquiries you send us through the contact form or by email.
- 02To deliver and improve the site, page performance, error monitoring, content iteration.
- 03To protect the site, abuse detection, rate limiting, security incident response.
- 04To maintain business records, invoices, contracts, project communications for active clients.
- 05To comply with legal obligations, tax records, lawful requests from authorities.
The site uses the following third-party services to operate. Each operates under its own privacy policy. We have selected providers with data-protection standards at or above GDPR.
- 01Vercel, site hosting and edge network. Server logs retained per Vercel policy.
- 02PostHog, product analytics, self-hosted in EU region. Pseudonymous visitor IDs.
- 03Sentry, error monitoring. Stack traces only; IPs truncated before storage.
- 04Sanity, content management for blog and portfolio. Public content only.
- 05Google Fonts, typography. May log IP for font delivery. Consider self-hosting if this is a concern.
- 06Cloudflare, DNS and DDoS protection. Logs anonymized at the edge.
Different categories of data are retained for different periods:
- 01Contact form submissions, retained for 24 months, then deleted unless an active engagement exists.
- 02Email correspondence, retained for the life of the engagement plus 7 years for tax and contract records.
- 03Server logs, retained for 30 days, then deleted.
- 04Analytics events, retained for 12 months in PostHog, then aggregated or deleted.
- 05Error reports, retained for 90 days in Sentry, then deleted.
If you are in the EU, the UK, California, or another jurisdiction with data-protection rights, you have the following rights with respect to data we hold about you:
- 01Access, request a copy of the data we hold about you.
- 02Correction, request that we correct inaccurate data.
- 03Deletion, request that we delete your data, subject to retention obligations.
- 04Portability, receive your data in a structured, machine-readable format.
- 05Objection, object to processing based on legitimate interest.
- 06Restriction, request that we limit processing while a complaint is resolved.
- 07Withdrawal of consent, withdraw consent at any time, where processing is consent-based.
- 08Complaint, lodge a complaint with your local data protection authority.
To exercise any of these rights, email hello.usamazahid@gmail.com. We respond within 30 days.
We take reasonable measures to protect data: HTTPS everywhere, scoped access controls, two-factor authentication on all operator accounts, regular dependency updates, and a 24-hour incident response window.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you within 72 hours of confirmation, in line with GDPR Article 33.
The site is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has submitted data through the site, contact us and we will delete it.
The site is operated from Pakistan. Some third-party service providers may process data in the EU, US, or other regions. By using the site, you acknowledge that your data may be transferred across borders.
We rely on Standard Contractual Clauses (SCCs) and equivalent mechanisms to protect data in transit. PostHog is configured for EU storage; Vercel and Cloudflare operate in regions closest to the visitor by default.
We may update this policy. Material changes will be reflected in the version number and the "last updated" date at the top of this page. We do not provide a changelog, but previous versions are available on request.
Continued use of the site after a change indicates acceptance of the updated policy.
For any privacy-related question, request, or complaint, contact:
- 01Email, hello.usamazahid@gmail.com
- 02Subject line, start with "PRIVACY ·" for faster routing.
- 03Response time, within 30 days, often within 24 hours.
- 04Postal, available on request. We do not maintain a public mailing address by default.