Privacy and cookies

Who is responsible

imhelal.com is run by Helal, an independent engineer based in Dhaka, Bangladesh. I decide how the data described on this page is used, and I'm the person to contact about it.

What I collect, and why

• Start a project. Your project type, platform, current setup and website, your goals, timeline, project scope and business size, and your name, email, country and time zone. A WhatsApp number only if you give one. I use it to prepare for the discovery call and to follow up.
• Emergency form. Your site address, what's wrong, your name, email and the channel you'd like me to use. I use it to reach you fast.
• Store health checklist. Your email address and the page you signed up on. You confirm the address first, then get the checklist and a short series of emails.
• Kickoff portal (clients only). Your goals, the status of each access step and the files you upload. The portal never asks for passwords.
• Analytics, only with your consent. Which pages you visit and what you click, without your name or email. No personal data is ever sent to analytics.

Who processes it

These services process data for the site. Each one is used only for the purpose listed.

• Cloudflare. Hosting, DNS, security, bot protection (Turnstile), the database and file storage, and cookieless traffic counts (Web Analytics).
• Resend. Sending email: confirmations, the checklist, follow-ups and portal links.
• Google Workspace. My [email protected] inbox. Replies to site emails, and anything you write to me directly, arrive there.
• Cal.com. Booking calls. When you book, Cal.com receives your name, email and the time you choose.
• Google Analytics. Visit statistics, loaded through Google Tag Manager, only after you accept analytics.
• Microsoft Clarity. Session recordings that show where pages confuse people, only after you accept analytics. Form fields are masked.
• Telegram. Instant alerts to my phone about new requests, including the details you submit, so I can reply quickly.
• Backblaze. Off-site copies of the database (B2), so a backup survives even if the main copy is lost.

These services may store data outside your country. I work from Bangladesh, so the details you send are also read there.

Cookies and the consent banner

On your first visit, a banner asks whether you accept analytics. "Reject" is as easy as "Accept", and the site works the same either way. Google Analytics and Microsoft Clarity load only after you accept, using Google Consent Mode v2. You can change your choice at any time from the link in the footer.

Without consent, the only measurement is Cloudflare Web Analytics, which sets no cookies. The site also stores your theme choice and unfinished "Start a project" answers in your browser. They stay on your device and are not sent anywhere until you submit the form.

How long it's kept

• Leads ("Start a project" and emergency requests) are kept for 24 months, then deleted automatically.
• Checklist subscribers are kept until you unsubscribe. Every marketing email has a one-click unsubscribe link. An address that unsubscribed, or never confirmed, is deleted 24 months after it signed up.
• Kickoff portal data and files are kept while we work together, and deleted when you ask or when the work ends.
• Portal sign-in links expire after 15 minutes and work once. A portal session lasts 14 days.
• Backups. The database is copied every night and the last 30 nightly copies are kept; a copy is kept off-site each week. Deleted data drops out of the backups as older copies are replaced.

Your rights

You can ask to see the data I hold about you, to correct it, or to delete it. Email [email protected] from the address you used. I act on deletion requests within 30 days: everything tied to that address is removed, including portal files. I keep only a one-way fingerprint of the address and the date, as a record that the request was carried out.