Privacy Policy
1. Controller
Muhammad Bilal
Email: contact@mbilal.works
2. Overview
This privacy policy explains what data is collected when you visit mbilal.works, how it is used, and what rights you have under the EU General Data Protection Regulation (GDPR).
This website does not use cookies. No data is sold or shared with third parties for marketing or advertising purposes.
3. Data Collected
3.1 Hosting: Cloudflare
This website is hosted on Cloudflare. Cloudflare may process certain technical data as part of its hosting infrastructure, including IP addresses (processed transiently for content delivery and security) and HTTP request metadata (method, URL, user agent, timestamp). This processing is governed by Cloudflare's Privacy Policy. Cloudflare acts as a data processor on behalf of the controller.
Lawful basis: Legitimate interest (Art. 6(1)(f) GDPR), operating and securing the website.
3.2 AI Chatbot
This website features an AI-powered chatbot that answers visitor questions about Muhammad Bilal's professional background and case studies. The chatbot is hosted on a private cloud. Chat messages are not sent to, or shared with, any third-party AI provider.
Before chat data is stored, an automated scrubbing process removes personally identifiable information (PII) from messages, including email addresses, phone numbers, and name patterns.
Lawful basis: Legitimate interest (Art. 6(1)(f) GDPR), improving chatbot quality and understanding what visitors ask about. This interest is balanced against data subjects' rights through anonymization measures, PII scrubbing, and short data retention.
4. Cookies and Local Storage
This website does not use cookies.
The only client-side storage is a session token in localStorage, used by the AI chatbot to maintain conversation context within a single browser session. This token is not a cookie and is not subject to the ePrivacy Directive's cookie consent requirements, is randomly generated and anonymous, does not persist after the browser session ends or localStorage is cleared, and cannot be used to identify or track a visitor across sessions.
5. Data Retention
| Data type | Retention period |
|---|---|
| Chatbot session data | 90 days, then automatically and permanently deleted (hard deletion) |
| SimpleAnalytics data | Aggregate only, no personal data retained |
| Cloudflare hosting logs | Governed by Cloudflare's retention policy |
6. Data Sharing
Your data is not sold, rented, or shared with third parties for their own purposes. Data is only shared with:
- Cloudflare: as hosting provider (data processor)
- SimpleAnalytics: as analytics provider (no personal data processed)
The AI chatbot is hosted on a private cloud, and chat messages are not shared with any third-party AI provider.
7. Data Security
Chatbot data is protected by the following measures:
- Encryption at rest: all stored data is encrypted
- PII scrubbing: personal identifiers are stripped before storage
- IP discarding: IP addresses are never stored
- Short retention: data is hard-deleted after 90 days
8. Your Rights Under GDPR
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of any data held about you |
| Rectification (Art. 16) | Request correction of inaccurate data |
| Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") |
| Restriction (Art. 18) | Request that processing of your data be restricted |
| Portability (Art. 20) | Request your data in a structured, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interest |
How to Exercise Your Rights
Since chatbot data is stored anonymously (no account, no login, no persistent identifier), the controller cannot identify your data without additional information from you.
To request access to or deletion of your chatbot data, send an email to contact@mbilal.works, including the approximate date and time of your chat session and the city you were located in during the session. This information will be used to locate your session data. The controller will respond within 30 days as required by Art. 12(3) GDPR.
9. Changes to This Policy
This privacy policy may be updated from time to time. Material changes will be indicated by updating the effective date at the top of this document. Continued use of the website after changes constitutes acceptance of the updated policy.
10. Contact
For any questions or concerns about this privacy policy or data processing on this website:
Muhammad Bilal
Email: contact@mbilal.works
Ask Bilal’s AI Clone