Privacy Policy

I, Khubaib Shah ("I", "me", "my"), operate this website (thekhubaib.me) and offer full-stack software engineering, B2B SaaS architecture, ERP development, and AI application engineering services.

I respect your privacy and am committed to maintaining rigorous confidentiality standards. I never sell, rent, or monetize your personal information, project details, or intellectual property. This Privacy Policy outlines what information is collected, how it is handled, and the safeguards in place to protect your business assets.

Depending on how we interact (via this website, direct email, WhatsApp, GitHub, or contract channels), I may collect the following:

• Contact Details: Your full name, business email address, company name, phone or WhatsApp number, and country/time zone.
• Project Scopes & Technical Briefs: Architectural specifications, wireframes, repository links, feature requests, and technical documentation submitted to evaluate project scopes.
• Contract & Invoicing Details: Company registration, billing addresses, milestone approvals, and transaction reference numbers for tax, invoicing, and accounting compliance.
• Anonymized Performance Telemetry: High-level, non-personally identifiable diagnostic information (such as viewport resolution, browser user-agent, and load latency) to ensure optimal visual rendering across mobile and desktop devices.

Engineering client projects requires handling sensitive source code, database structures, proprietary trade secrets, and API credentials. I treat every client's codebase as strictly confidential.

• Zero Unauthorized Sharing: Private client source code is never shared, made public, or reused in competitor projects.
• No AI Model Training on Client Code: Your proprietary source code and sensitive data are never used to train public machine learning models.
• Portfolio Showcase Permission: Client projects are only mentioned or showcased in my portfolio with explicit prior consent, or utilizing sanitized, whitelisted public demonstration previews.

The information provided is strictly utilized to deliver and support software engineering services:

• Evaluating project briefs, architectural feasibility, cost estimates, and sprint deadlines.
• Communicating project updates, code reviews, staging demos, and sprint milestones.
• Configuring necessary database connections, CI/CD deployment pipelines, and third-party webhook integrations.
• Issuing formal invoices, milestone receipts, and payment acknowledgments.
• Fulfilling legal, accounting, and anti-fraud statutory obligations.

When building custom web applications or AI workflows, our engineering process frequently integrates industry-standard cloud providers:

• AI Services (OpenAI, Google Gemini, Anthropic): Connected exclusively via your dedicated enterprise API keys according to their privacy and zero-retention developer agreements.
• Database & Cloud Hosting (Supabase, PostgreSQL, AWS, Vercel): Deployed directly under client-owned organizations or segregated production environments.
• Payment Gateways (Stripe, PayPal): Direct integration using official merchant SDKs. Credit card and banking credentials never touch my personal infrastructure.

I maintain strict cyber hygiene across all hardware, local development sandboxes, and remote repositories:

• Encrypted local storage with full-disk encryption (BitLocker / FileVault).
• Two-Factor Authentication (2FA) enforced on all development accounts (GitHub, AWS, Vercel, Supabase).
• Secrets and environment variables are managed using encrypted vault managers or .env configurations excluded from version control.
• Immediate revocation of development access keys upon project completion and handover.

This portfolio operates with minimal, privacy-first technical considerations:

• No Intrusive Ad Tracking: There are no third-party marketing trackers, cross-site pixel trackers, or behavioral advertising cookies on this website.
• Functional Local Storage: Lightweight browser storage is used solely to retain functional UI preferences (such as cursor state and performance flags).

Depending on your jurisdiction (including GDPR in the EU/UK, CCPA in California, and international privacy laws), you have rights regarding your personal information:

• Right to Access: You may request a copy of the personal contact details and correspondence retained.
• Right to Rectification: You may correct inaccurate or outdated company and billing details.
• Right to Erasure ("Right to Be Forgotten"): You may request the permanent deletion of contact logs, scoping documents, and communication history upon contract termination, subject to tax and invoicing record retention laws.

If you have questions regarding this Privacy Policy, wish to execute an NDA prior to sharing code, or wish to exercise your data rights, please contact me directly: