Privacy Policy
This is a personal portfolio run by one individual. It collects as little as it can, sells nothing, and shows no advertising.
Effective 29 August 2026
Who is responsible
Bilal Ahamad is the data controller for this site. For any privacy question or request, use the contact form and say what you would like done.
What is collected, and why
Contact form
When you submit the form, your name, email address, subject and message are sent to Bilal by email so he can reply. Legal basis: your consent, given by submitting the form (GDPR Art. 6(1)(a)) and the legitimate interest in answering you. The message is not written to any database by this site; it lives in the recipient mailbox. A hashed copy of your email address is held briefly in memory to rate-limit submissions.
Spam protection
There is no CAPTCHA here — nothing for you to solve. Instead a submission has to pass three quiet checks. Vercel BotID runs an invisible bot check on the request; Vercel, not Google, is the processor for it, and its challenge script loads only when a protected request is actually made. The submission must also carry the signed entry cookie described below, which the form requests as soon as you focus one of its fields. Finally, submissions are rate-limited — by network address, and by a hashed copy of the email address given.
Entry check
A first visit sets a short-lived signed cookie named ba_entry (about two hours) and a browser storage flag named ba_entered(about 30 days). These exist to keep automated scrapers out, not to identify you. The cookie carries a timestamp and your browser's timezone name — no name, email or account. It is strictly necessary for that security function.
Audience measurement
Vercel Web Analytics and Vercel Speed Insights count page views and measure loading performance. Per Vercel's documentation these use no cookies and identify visitors only by a hash of the incoming request that is discarded within 24 hours; the results are aggregate.
Google Analytics
Google Analytics 4 is also loaded, and it does set cookies (including _ga) containing a randomly generated identifier used to recognise a returning browser. It records pages viewed and a small number of interaction events, such as a resume download. If you would rather not be counted, use your browser's tracking protection, an ad blocker, or Google's opt-out add-on.
Hosting logs
The site is hosted on Vercel, which processes standard request data (including IP address) to serve and secure the site.
What is never done here
No personal data is sold or shared for cross-context behavioural advertising. There is no advertising network, no newsletter list, no profiling, and no automated decision-making. Nothing on this site requires an account, and downloading the resume requires no form.
How long it is kept
Contact messages are kept in the recipient mailbox for as long as the conversation is useful, and can be deleted on request. The entry cookie expires in about two hours and the browser flag in about 30 days. Analytics data is retained under the providers' own schedules — Vercel's hashed identifier is discarded within 24 hours, and Google Analytics retention is set to Google's default for this property.
Who else processes it
Vercel (hosting, analytics, and the contact form's bot check), Google (Google Analytics), and the email provider that delivers contact messages. These providers may process data outside your country, including in the United States, under their own transfer safeguards.
Your rights
If you are in the UK, EU or EEA, you may request access to your personal data, and its correction, deletion, restriction or portability; you may object to processing based on legitimate interests; and where processing rests on consent you may withdraw it at any time without affecting what came before. You may also complain to your data protection authority — in the UK that is the Information Commissioner's Office.
If you are a California resident, you may request the categories and specific pieces of personal information collected, ask for deletion or correction, and you will not be treated differently for asking. This site does not sell or share personal information.
Requests go through the contact form. There is no charge, and you will get a reply.
Do Not Track
Browsers can send a Do Not Track signal. There is still no agreed standard for honouring it, so this site does not respond to it. The opt-out routes described under Google Analytics above are effective.
Third-party links
Pages here link to GitHub, LinkedIn, browser extension stores, and live project dashboards. Those sites have their own privacy policies, and this one does not cover them.
Changes
If this policy changes materially, the effective date at the top of the page changes with it, and the current version is always the one published here.