Privacy Policy

• No account to create, so no account data to leak.
• No advertising, no ad pixels, no third-party marketing cookies.
• Nothing is sold, rented, or shared for anyone else's profit.
• If you email me or use the contact form, I keep your message so I can reply.
• Reading the site collects anonymous pageview counts, not an identity.
• You can ask me to show you, correct, or delete what I hold — one email.

This website and the freelance services described on it are operated by Kunj Shah, an independent software engineer based in Ahmedabad, Gujarat, India. For the purposes of the Digital Personal Data Protection Act, 2023 (India) and the General Data Protection Regulation (EU/UK), I am the data controller: I decide what is collected and why.

I am an individual, not a company. There is no legal entity behind this site, and no data protection officer — the person to contact is the person who runs it.

There are three sources of data, and only the first one identifies you.

Information you send me

• Contact form: your name, email address, company (optional), area of interest, timeline, and the message body.
• Direct email: whatever you put in it, plus the email headers your provider attaches.
• Client work: documents, credentials, and data you share for a project — governed separately by the engagement agreement, not just this policy.

The contact form is validated and forwarded over email. It is never written to a database on this site, so there is no stored copy to breach.

Information generated by your visit

• Pageview counts and coarse traffic sources, collected cookieless by Vercel Analytics.
• Technical request data your browser always sends: IP address, user agent, requested URL, referrer, and response timing.
• Your light or dark theme choice, kept in your browser's local storage under the key `theme`. It never leaves your device.

What I do not collect

• No advertising or cross-site tracking identifiers.
• No data bought from brokers or appended to your record by a third party.
• No special category data — health, biometrics, political views, religion, or sexual orientation — unless you deliberately include it in a message, in which case please do not.
• No credentials or payment details. Payments are handled by a payment provider; card numbers never touch this site.

Purpose first, lawful basis second. Each category of data exists for one stated reason, and that reason is the permission.

• To reply to an enquiry and, if it turns into a project, to run that project — necessary to take steps at your request, and to perform the resulting contract.
• To keep the site secure and working — legitimate interest in protecting my service from abuse.
• To understand which pages are useful — legitimate interest in improving the site, carried out on cookieless, aggregated counts.
• To meet a legal obligation if one genuinely applies, such as Indian tax record-keeping for invoices.
• Marketing by email, if you ever ask for it — consent, which you can withdraw at any time.

Three services stand between you and me. Each is under contract to process data only on my instructions.

• Vercel — hosts the site, serves it over CDN, and runs the cookieless analytics. It sees the IP address and request metadata described above.
• Resend — delivers contact-form messages and replies. It processes your message content and address purely to send the email.
• GitHub, LinkedIn, X, Hugging Face, Peerlist and Medium — I link to these profiles. Nothing is loaded from them unless you click; once you do, their own privacy policies and cookies apply.

Web fonts are compiled into the site's own files at build time, so no font provider is contacted when you read a page.

Some projects linked from this site are live applications that call external model providers — for example a browser tool that sends your pasted text to a hosted LLM API. Those requests leave this site and are handled by the provider under their terms, not by this policy.

The providers behind those demos are the ones named throughout the projects section: OpenRouter, Groq, Google, Anthropic, OpenAI, Hugging Face and NVIDIA among them. Whichever one a demo uses, it receives whatever you type into it, for the length of that request, and nothing more.

None of them is contacted unless you interact with the demo yourself. Reading a page, scrolling the projects list, or opening this policy sends nothing to any model. Please do not paste confidential, personal, or regulated information into any hosted demo — it may be logged on someone else's infrastructure, and that infrastructure is not something I can give you guarantees about.

Everything above describes the website. Commissioning work is different, and the two are kept apart deliberately: during a project you are normally the controller and I am your processor, and the engagement agreement or a data processing agreement governs it rather than this page.

• I process your personal data only on your documented instructions, for the purpose of delivering the project — never to decide for myself what to do with it.
• A data processing agreement is signed before any personal data is processed, and it names the sub-processors in advance rather than after the fact.
• Where the project needs a sub-processor — a cloud provider, an API vendor, a model host — you are told which one and why before it touches your data, and they are bound to process on your instructions alone.
• Your data is never used to train or fine-tune any model, including mine, and never reused to benefit another client.
• On termination, your data is returned or deleted within 30 days, and I confirm in writing once that is done rather than leaving you to assume it.
• Overseas clients should read this as the same role split: I do not determine the purposes or the means of your processing, which keeps your own obligations under your regulator intact.

I do not sell, rent, trade or licence personal data to anyone — not to data brokers, not to advertisers, not to other clients. There is no version of this business where your enquiry becomes someone else's asset.

• A valid court order, summons or statutory demand from a competent authority is the only thing that obliges me to disclose data, and I disclose only what it actually requires — no more, in bulk, or on a vague request.
• Where the law permits, I tell you about a request before I comply with it.
• I keep no log of who visited beyond the anonymous aggregate counts described above, so there is frequently nothing to hand over even when asked.
• Under India's IT Act I am bound by lawful orders of a competent authority; under GDPR I am bound by the rules of whichever member state applies to you.

• Enquiries that do not become projects: deleted within 24 months of the last reply.
• Enquiries that do become projects: kept for the life of the engagement and up to 7 years after, because tax and contract records need that long in India.
• Client project data itself — code, documents, datasets — returned or deleted within 30 days of the engagement ending. Only the parts that are also invoice or contract records stay for the 7 years above.
• Analytics: aggregated on the provider's own schedule. I never export it or join it to anything else.
• Server logs: kept by the host for days to weeks for security purposes. I do not set that window and cannot extend it.
• Theme preference: stays in your browser until you clear your browser storage.

When a window ends, the data is deleted from live systems. Backups roll off on the host's normal schedule.

I am in India, and my hosting and email providers process data on servers outside India, primarily in the United States and the European Union. This is a cross-border transfer under Indian law and under GDPR Chapter V.

Engagements move data in both directions. An overseas client may see Indian-hosted tooling, support handled in IST, and invoices administered from India; that is your data, not mine, and it is governed by the engagement agreement rather than by this page.

Where it applies, these transfers are covered by the providers' standard contractual clauses and their own data processing agreements. The alternative — running the site from an Indian region only — would cost you nothing, but it would also mean giving up access to most of the site.

If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights of access, correction, erasure, nomination, and grievance redressal. If you are in the EU or UK, the GDPR additionally gives you rights of portability, restriction, and objection, and the right to complain to a supervisory authority.

1. 01Email me. One message is enough; there is no form and no portal.
2. 02I may ask for enough information to confirm the request is really from you — for example that the email you are writing from matches the one you wrote to.
3. 03I answer within 30 days, sooner in practice, and I tell you plainly if I cannot comply and why.
4. 04There is no fee unless a request is manifestly unfounded or excessive.

You can also complain to the Data Protection Board of India, or to the supervisory authority for your country, without coming to me first. I would rather hear from you directly, but that is genuinely your right.

• All traffic is encrypted in transit over HTTPS.
• Inquiries are validated server-side, rate-limited per IP, and filtered by a honeypot field and a minimum fill-time check before delivery.
• Contact submissions are transmitted, not stored: there is no enquiry database to breach.
• Project credentials are never committed to a repository, and secrets belong in environment variables.
• Client data is excluded from training any model, including mine.

No system is perfectly secure. If a breach ever affects your data, I will tell you and the relevant authority without undue delay and give you the details rather than a reassurance.

This site sets no cookies. Analytics are cookieless, so there is no consent banner and nothing to opt out of. The only browser storage used is a single local-storage entry recording whether you chose the light or dark theme.

Clearing your browser storage for this site removes that preference. Because it never identifies you, there is nothing further to delete or export.

This site is a professional portfolio and is not directed at anyone under 18. I do not knowingly collect data from children, and if you believe a child has sent me personal information through the contact form, tell me and I will delete it.

I will update this page when what I do changes, and the effective date at the top always reflects the current wording. Material changes — a new processor, a new purpose — are announced on the contact page rather than made quietly.

Prior versions are not archived publicly. If you need the wording that applied when you engaged me, ask and I will send it.