Data minimization
Collect only the fields required to evaluate a project—name, work email, and context.
Privacy & Compliance
How Khalil Alsalim protects the data behind this portfolio.
This site collects only the details needed to respond to legitimate opportunities. No ads, no cross-site tracking, and nothing is sold or shared with third parties.
Last updated: 17 February 2025
Zero marketing cookies, pixels, or fingerprinting scripts.
Form data flows through Resend over TLS directly to an encrypted inbox.
Hosted on Vercel’s edge network with SOC 2 controls and 30-day log rotation.
Principles in practice
Three guardrails that shape every workflow and decision about personal data.
Transparent automation
Any AI summarization runs on demand in a secure workspace with human review; no automated decisions or scoring.
Accountable retention
Threads are archived after 18 months or immediately on request, with confirmation once deletion is complete.
What’s collected and why
The table below lists all personal data processed by khalilalsalim.com. Items marked “optional” are never required and can be skipped.
Item
Data captured
Purpose
Retention
Legal basis
Contact form submissions
Name, email, company (optional), topic, message, consent checkbox.
Respond to collaboration requests, qualify project fit, and prepare a follow-up meeting.
Active evaluation window, then archived for 18 months or deleted sooner upon request.
Legitimate interest to discuss services; explicit consent captured via checkbox.
Direct emails & scheduling threads
Email address, signature details, proposed meeting times, conversation history.
Coordinate discovery calls and maintain context while engagements are scoped.
Kept while opportunities are open; archived after 18 months or immediately once you ask.
Legitimate interest and pre-contractual steps.
Vercel edge logs
IP address truncated to /24, user agent, request path, timestamp, error diagnostics.
Keep the platform secure, detect abuse, and debug reliability issues.
Rotated automatically by Vercel in ~30 days.
Legitimate interest in operating a secure website.
Cookies & local storage
Not used. No analytics identifiers, ad pixels, or fingerprinting libraries.
—
—
Not applicable.
Use of AI & automation
Automation supports responsiveness but never replaces human judgment.
Inbound messages may be summarized locally to highlight goals and timelines. Summaries stay inside a private, access-controlled workspace.
No automated replies are sent. Every response is written manually after reviewing your original message.
Experiment notes and analytics dashboards reference aggregated metrics only; personal data is never used to train external models.
Security & retention controls
TLS 1.3 and HSTS enforced by Vercel on every request to khalilalsalim.com.
Form submissions route to Google Workspace with phishing protection, security keys, and admin alerts enabled.
Resend purges payloads once forwarded; inbox retention rules keep only active threads.
Access is limited to Khalil Alsalim; no subcontractor or agency access.
Quarterly reviews ensure archived threads that no longer serve a business purpose are deleted.
Your choices & rights
If you have shared data, you can exercise these rights at any time.
- Access: Receive a copy of the information held about you.
- Rectification: Update incorrect or outdated details.
- Deletion: Ask for your records to be erased from email, archives, and backups (within feasible limits).
- Restriction: Pause processing while we resolve accuracy or consent questions.
- Portability: Receive project information in a reusable format.
- Withdraw consent: Opt out of further contact or storage at any time.
Data lifecycle
Every touchpoint follows this path from intake to deletion.
01
Intake
You submit the form or send an email; Resend forwards the payload over TLS to [email protected].
02
Review
Details are reviewed manually. Optional summaries are generated locally to capture goals and constraints.
03
Response
You receive a reply or meeting invite. Notes stay in a private GTM-free workspace for coordination.
04
Archive or delete
If no engagement happens, the thread is archived for up to 18 months. Confirmed projects keep essential records until close, then data is deleted or anonymized.
Trusted processors
Only a short list of processors help run this site. Each provides a DPA, modern encryption, and robust compliance attestations.
Vercel, Inc.
Hosting, CDN, serverless edge
USA & EU data centers
Edge logs with truncated IPs, request diagnostics, deployment metadata.
SOC 2 Type II, ISO 27001, GDPR-compliant DPA with SCCs, 30-day log retention.
Resend
Form forwarding service
United States
Form payload (submitted fields) while relaying email to [email protected].
TLS 1.2+, transient storage only until delivery, spam filtering, opt-out controls.
Google Workspace
Email, file storage, calendar
EU data region preference
Emails, attachments, calendar invites, security alerts.
Encryption at rest and in transit, Advanced Protection with security keys, SCCs and ISO 27018 certifications.
No ad networks, remarketing partners, or data brokers are used. Processor list is reviewed quarterly and updated here when changes occur.
Frequently asked questions
More detail on how privacy works day to day.
Do you use cookies or analytics scripts?▼
No. There are no analytics tags, advertising pixels, or fingerprinting libraries on this site. Server-side logs are the only telemetry collected and they remain within Vercel.
How do I request access or deletion?▼
Email [email protected] from the address you used. Requests are acknowledged within two business days and fulfilled within 14 days.
Will you sign an NDA before I share materials?▼
Yes. Send your NDA to [email protected]. Materials are reviewed only after the NDA is executed.
Do client case studies expose personal data?▼
No. Case studies reference aggregate metrics and anonymized locations. Underlying client systems remain under their own governance.
Need something else?
For privacy questions, verification, or regulator outreach, write to [email protected].
EU/UK residents may escalate unresolved issues to their local supervisory authority. This site currently has no EU representative because it handles only occasional B2B inquiries.