Privacy Policy

01Who I am

I'm Toki Osman, an independent developer based in Bangladesh, and I'm responsible for your data on this site. For anything about privacy, email me at tokiosman@outlook.com.

02What I collect

• Contact form: your name, email address, project type and message.
• Booking a call: your name and email address, what you'd like to build, and anything else you choose to add, such as your website, budget range, phone number, notes or guests.
• Messages: whatever you send me by email, WhatsApp or Messenger.
• Client work: the details and account access I need to deliver your project, and payment and billing records.
• Technical data: your IP address and basic request details, which appear in server logs and are used for security.

This site uses Vercel Web Analytics to count page visits. It doesn't use cookies, and I only see totals, such as which pages get visited and where visitors come from. The site has no advertising tools.

03Why I use it, and my legal basis

• To reply to you and prepare a quote: steps you ask for before entering a contract.
• To deliver a project and bill for it: performing our contract, and meeting my legal obligations.
• To keep the site secure and stop spam: my legitimate interest in protecting it.

I don't send marketing emails unless you've asked for them, and I don't use your data for automated decisions about you.

04Who else handles it

I use these services to run my work, and each one processes data only for its part of the job:

• Vercel: hosts this site, keeps its server logs and counts page visits.
• Zoho CRM: stores contact form enquiries.
• Cal.com: runs booking and video calls.
• Microsoft (Outlook) and Google: email and calendars, which hold booking details and messages.
• Meta (WhatsApp and Messenger): only if you message me there.
• Cloudflare Turnstile: checks that form submissions come from a person, when it's switched on.
• Payoneer: processes payments from clients.

I don't sell your personal data or share it for advertising, as those terms are used in California's privacy laws (CCPA/CPRA). I'd only disclose it to anyone else if the law required me to.

05International transfers

I'm based in Bangladesh and these services run servers in several countries, so your data may be handled outside your own country, including in countries with different data protection laws. Where a service moves data out of the EU or UK, I rely on the safeguards it offers, such as standard contractual clauses.

06How long I keep it

• Enquiries that don't become projects: up to 24 months, then deleted.
• Client and billing records: as long as our work continues, then as long as tax and accounting law requires.
• Server logs: as long as Vercel's standard retention period.

07Your rights

You can ask to see, correct, delete or receive a copy of your data, and object to or restrict how I use it. Where I rely on your consent, you can withdraw it at any time. Email tokiosman@outlook.com and I'll reply within 30 days. There's no charge. If you're unhappy with my answer, you can complain to the data protection authority where you live.

08Cookies and local storage

This site doesn't set cookies of its own, and it has no consent banner because its analytics don't use cookies. It stores two small items in your browser, which are never sent to me:

• theme (local storage): remembers whether you chose the light or dark theme.
• loader-seen (session storage): stops the phone intro animation from replaying during your visit.

Cal.com's booking window loads only when you click to book a call, and Cal.com may then set its own cookies or storage to make booking work. Cloudflare Turnstile, when switched on, may do the same to detect bots. You can clear or block all of these in your browser settings.

09Children

This site is for businesses and isn't aimed at anyone under 16. If you think a child has sent me personal data, email tokiosman@outlook.com and I'll delete it.

10Changes to this policy

If this policy changes, I'll update it here and change the date at the top.