Privacy policy

This site is operated by Muhammad Javed, an individual carrying on business in the Greater Toronto Area, Ontario, Canada. For the purposes of Canadian privacy law — and of the GDPR where it applies — Muhammad Javed is the organisation responsible for the personal information described here.

Anything to do with privacy can be sent to hello@javed.ca. It reaches a person, not a ticket queue.

There are four situations in which this site receives information about you.

• When you send an enquiry. The contact form, and any enquiry form on a page built here, asks for your name, email address and a message, and optionally your phone number and company. It also records which page you were on and any campaign parameters in the link that brought you here, so that an enquiry can be traced back to whatever prompted it.
• When you subscribe. A newsletter sign-up stores your email address, the name you give if any, and which form you used.
• When you buy something. A purchase stores your email address, what you bought, and the amount. Card details are entered directly with Stripe and are never seen by, or stored on, this site.
• When you simply visit. The web server records standard request information — IP address, the page requested, the time, and the browser’s user agent — in its logs, as every web server does. These logs are used to keep the site running and to spot abuse.

Nothing here asks for information the purpose does not need. There is no account to create, and no profile is built about you across other sites.

• To reply to an enquiry, and to follow up on it.
• To send the newsletter, where you have asked for it.
• To deliver a purchase, including the download link and any receipt.
• To keep the site working, secure, and free of abuse.
• To understand which pages are read, where analytics has been agreed to.

Marketing email is opt-in and separate from replying to you. Sending an enquiry does not subscribe you to anything: the consent box on the form is unticked by default, and the newsletter is only sent where it has been ticked. Every message carries a one-click unsubscribe, and unsubscribing is honoured immediately and permanently — a later form submission with the same address will not quietly put you back on the list.

Where you are in Canada, this site relies on your consent, on the performance of a contract where you have bought something, and on legitimate interests for the security and operation of the site.

Where the GDPR applies, the bases are: your consent for the newsletter and for analytics; the performance of a contract for a purchase; and legitimate interests for responding to an enquiry you initiated and for keeping the site secure. Consent can be withdrawn at any time, and doing so does not affect anything done before that point.

Information is shared only with the services that make this site work, and only what each one needs. They are:

• Resend — sends email, and therefore handles your address when a message is sent to you.
• Stripe — processes payments. Your card details go directly to Stripe and never reach this site.
• The hosting provider — runs the server and the database in which enquiries, subscribers and orders are stored.
• Google and Meta — only if you have allowed analytics. Nothing is sent to either before you decide, and declining means they receive nothing.

Your information is not sold, and it is not shared for anyone else’s marketing. Some of these providers are outside Canada, which means information may be handled in the United States or the European Union; they are bound by their own contractual commitments on how it is treated.

This site sets one cookie of its own — the admin sign-in session — and it is strictly necessary. Analytics cookies are set only if you allow them, and they are off by default. The cookie policy lists each one and how to change your choice.

Enquiries and subscriber records are kept while they remain useful for the relationship they belong to — an enquiry that becomes a client is kept for the life of that relationship, and one that goes nowhere is kept no longer than needed to be sure it has not been missed.

Order records are kept longer, because tax and accounting rules require it. A record that a message was sent is kept even after a contact is deleted, since it is the evidence that the message was sent and that consent existed at the time — but you can ask for the address itself to be removed.

If you would like a specific period applied to your own information, ask, and it will be honoured.

• To be told what is held about you, and to be given a copy.
• To have anything inaccurate corrected.
• To have your information deleted, subject to records that have to be kept.
• To withdraw consent to the newsletter or to analytics, at any time.
• To object to a particular use, and to ask that it be restricted.
• To receive your information in a portable format.

Ask by email and you will get an answer within 30 days. There is no charge, and you do not have to give a reason.

In Canada you may complain to the Office of the Privacy Commissioner of Canada, or to the Information and Privacy Commissioner of Ontario. In the United Kingdom or the European Union you may complain to your national supervisory authority. You are welcome to raise it here first, and it will be dealt with directly.

Information is stored on encrypted connections, access to the administrative area is password-protected and session-limited, and payment details are never held here at all. No system is perfect, and if a breach ever affected your information you would be told about it directly.

This policy may change as the site does. When it does, the date at the top changes with it. Material changes — a new purpose, or a new recipient — would be notified to subscribers rather than made quietly.