Skip to content

Privacy Policy

This Privacy Policy explains what personal information is collected when you visit mrifat.com or engage my services, why it is collected, how it is used and protected, and the rights and choices you have. It applies to this website, to my email and messaging conversations with you, and to the services I deliver.

I am Mohammad Rifat Khan, an independent full stack developer and technical partner based in Bangladesh. Throughout this policy, “I”, “me” and “my” refer to me as the operator of this website and the provider of the services described on it. “You” refers to a visitor, a prospective client or a client.

1. Summary

  • I collect only the information I need to answer your enquiry and to deliver the work you ask for.
  • I do not sell your personal information, and I do not rent it to anyone.
  • I use a small number of trusted service providers, mainly my hosting provider, Google and my email provider.
  • Analytics and advertising measurement tags are loaded as described in this policy, and you can block or clear them in your browser at any time.
  • You can ask for a copy of your information, ask me to correct it, or ask me to delete it by emailing [email protected].

2. Information you provide directly

I only receive personal information that you choose to give me. Depending on how you contact me, this can include the following categories.

  • Contact form: your name, email address, company name, the service you are interested in, your website address, and your message.
  • Direct messages: anything you send by email, WhatsApp, Telegram or WeChat, including project briefs, files, screenshots and access details for systems you ask me to work on.
  • Booking a call: if you book through the Google Calendar appointment page linked from this site, Google collects the name, email address, time zone and notes you enter so the appointment can be created and confirmed.
  • Client and billing records: when you become a client, I keep the details needed to quote, invoice and support you, such as your company details, billing address, tax information, purchase order references and payment confirmations. Card and bank details are handled by the payment provider and are never stored on this website.

3. Information collected automatically

When you browse this website, the web server and the analytics tools configured for the site record technical information. This normally includes your IP address, browser type and version, device and operating system, the page that referred you, the pages you view, and the date and time of your visit.

This information is used to keep the site secure and available, to detect abuse and faults, and to understand which pages and services are useful to visitors. It is not used to identify you personally.

4. Cookies and similar technologies

This website uses a small number of cookies and similar technologies. They fall into the following groups.

  • Strictly necessary: required for the site to work and to stay secure, including form submission protection and remembering your cookie choice. These cannot be switched off through the site.
  • Analytics: Google Analytics 4, loaded through Google Tag Manager, which shows how visitors find and use the site in aggregated form. Analytics data is kept for up to 14 months.
  • Advertising measurement: Google Ads conversion tracking and, where configured, the Meta Pixel or the Meta Conversions API. These are used to measure whether a campaign produced an enquiry, and they are only used where the law and your consent allow it.

You can control cookies through your browser settings, where you can block or delete them, and you can opt out of personalised advertising in your Google and Meta account settings. Blocking cookies does not prevent you from using this website.

5. How your information is used

  • To reply to your enquiry, ask clarifying questions and prepare a quote or proposal.
  • To deliver, support, maintain and invoice the services you engage me for.
  • To protect the website, prevent spam and abuse, and diagnose technical problems.
  • To measure which pages, services and campaigns bring enquiries, and to improve them.
  • To send service messages such as project updates, invoices and handover notes, and, only with your consent or on the basis of an existing client relationship, occasional marketing emails.
  • To meet accounting, tax and other legal obligations, and to establish, exercise or defend legal claims.

6. Legal bases for processing

Where the General Data Protection Regulation or the UK GDPR applies, I rely on the following legal bases.

  • Performance of a contract: processing needed to quote for and deliver the services you request, and to manage the client relationship.
  • Legitimate interests: running and securing this website, responding to business enquiries, improving my services and protecting my legal rights, balanced against your rights and expectations.
  • Consent: analytics and advertising measurement cookies, and marketing emails, where consent is required. You may withdraw consent at any time.
  • Legal obligation: keeping invoices, tax records and other information the law requires me to keep.

7. Who your information is shared with

I share personal information only with the providers needed to run this website and deliver the services, and only to the extent required. These providers act on my instructions or as independent controllers for their own services.

  • Hosting and infrastructure providers, for servers, storage, backups, DNS and content delivery.
  • Google, for Analytics 4, Tag Manager, Ads, Search Console and Calendar appointment scheduling.
  • Email and office service providers, for mailboxes, transactional email and document exchange.
  • Meta, only where the Meta Pixel or Conversions API is configured for advertising measurement.
  • Payment and accounting providers, when you become a client and an invoice has to be issued or paid.
  • Professional advisers such as my accountant, and authorities or courts where the law requires disclosure.
  • A buyer or successor, if my business or its assets are ever transferred, in which case you will be informed.

I do not sell, rent or trade personal information. I do not allow advertising networks to use information collected on this website to build profiles about you across other websites on my behalf.

8. International transfers

Some of the providers listed above store and process data in countries other than yours, including the United States and the European Union. Where personal data protected by the GDPR or UK GDPR is transferred outside the European Economic Area or the United Kingdom, the transfer relies on appropriate safeguards such as an adequacy decision or the standard contractual clauses approved by the European Commission.

9. How long information is kept

  • Enquiries that do not become projects: up to 24 months after the last message.
  • Client project records, contracts, invoices and tax documents: up to 7 years after the end of the relationship, as required for accounting and tax purposes.
  • Support and maintenance correspondence: up to 3 years.
  • Analytics and advertising measurement data: up to 14 months, or until consent is withdrawn.
  • Server and security logs: up to 12 months.
  • Backups: rolling backups that are overwritten within 30 days.

When information is no longer needed, it is deleted or anonymised. Where data cannot be deleted immediately because it is held in a backup or is needed for a legal claim, it is isolated until deletion is possible.

10. How information is protected

I use technical and organisational measures that are appropriate to the risk, including encrypted connections over HTTPS, restricted access on a least privilege basis, strong authentication, regular software updates and patching, monitoring, and off site backups. Access details you share for your own systems are stored in a password manager and removed from my systems after handover.

No method of transmission or storage is completely secure, so I cannot promise absolute security. If a data breach is likely to result in a risk to your rights, I will notify you and the relevant supervisory authority without undue delay where the law requires it.

11. Your rights

Depending on where you live, you may have some or all of the following rights.

  • Access: a copy of the personal information I hold about you.
  • Rectification: correction of information that is inaccurate or incomplete.
  • Erasure: deletion of information I no longer need, subject to legal retention duties.
  • Restriction: a limit on how your information is used while a question about it is resolved.
  • Portability: a machine readable copy of information you provided, where processing is based on consent or a contract.
  • Objection: the right to object to processing based on legitimate interests, and to direct marketing at any time.
  • Withdrawal of consent: at any time, without affecting processing carried out before withdrawal.
  • Complaint: the right to complain to your local supervisory authority, for example the Information Commissioner’s Office in the United Kingdom, or the authority in your country of residence in the European Union.

If you live in California, you also have the right to know the categories of personal information collected, to request deletion or correction, to opt out of the sale or sharing of personal information, and to be free from discrimination for exercising these rights. I do not sell personal information and I do not share it for cross context behavioural advertising on my own account, so there is nothing to opt out of in that sense, but you can still contact me with any request.

To exercise a right, email [email protected] with enough detail for me to understand the request. I may ask you to confirm your identity before acting, and I will respond within 30 days, or within one month where the GDPR applies. An authorised agent may act for you with written permission.

12. Marketing messages

Project updates, invoices and handover notes are part of the service and are sent because they are needed to deliver it. Marketing emails are only sent with your consent, or to existing clients where the law allows it on the basis of an existing relationship. Every marketing email includes an unsubscribe option, and you can also email [email protected] to be removed at any time.

13. Do Not Track signals

Some browsers can send a Do Not Track signal. There is no consistent industry standard for how such a signal should be interpreted, so this website does not change its behaviour based on it. Where consent is required for analytics or advertising cookies, those tags are only loaded once consent has been given, and consent can be withdrawn at any time.

14. Children

This website and my services are intended for businesses and professional users, and are not directed to children. I do not knowingly collect personal information from children. If you believe that a child has provided information to me, email [email protected] and I will delete it.

15. Automated decisions and profiling

I do not use your personal information for automated decision making that produces legal effects or similarly significant effects, and I do not build advertising profiles about you on my own systems.

16. Third party links, embeds and services

This website links to, and may embed, services operated by other companies, including Google Calendar appointment scheduling, WhatsApp, LinkedIn, GitHub and others. Once you use those services, their own privacy policies and terms apply, and I am not responsible for how they handle your information. Where an appointment or a message is handled inside a third party service, that provider acts as an independent controller of the information you give it.

17. Changes to this policy

I may update this policy to reflect changes in the law, in the services I offer, or in the providers I use. The date below shows the most recent revision, and the current version always applies from the moment it is published on this page. If a change is significant, I will make it clear on this page.

18. How to contact me

For any question about this policy, or to exercise a privacy right, contact Mohammad Rifat Khan by email at [email protected] or by WhatsApp on +880 1730 590869. I aim to answer privacy requests within 30 days.

Last updated: 29 September 2026.