Effective October 25, 2026 · Last updated October 25, 2026

Privacy Policy

This Privacy Policy explains how Khalid Hossen ("I", "me", "my") collects, uses, and protects your personal information when you visit khalidhossen.com (the "Site"), contact me, request a free audit, or book a call.

1. Who is responsible for your information

Khalid Hossen

Email: hello@khalidhossen.com

If you have any question about this policy or your information, email hello@khalidhossen.com.

2. Information I collect

Information you give me

• Contact form (/contact/ and the form on the homepage): first name, last name, email address, phone number (optional), and your message.
• Free audit request (/free-audit/): full name, email address, your website or Google Maps / Business Profile link, business type (for example dental/medical, home services, professional services), what you want the audit to focus on, and any notes you add (optional).
• Booking a call: calls are booked on the /book/ page through TidyCal, a third-party scheduling service embedded there. TidyCal collects the details you enter (such as your name, email, and chosen time) under its own privacy policy. I receive those booking details.
• Email and calls: anything you send me directly by email or share during a call.

Please don't send sensitive information (for example health, financial-account, or patient information) through the forms.

Form submissions are not stored in a database on this Site. The contact and free-audit forms are emailed to me via Google Workspace. The message includes what you typed, and the reply-to address is the email you entered.

Information collected automatically

• Spam protection: when it is turned on, the forms use Google reCAPTCHA v3 to block spam and abuse. reCAPTCHA collects hardware and software information (such as device and browser data) and sends it to Google. Its use is subject to Google's Privacy Policy and Terms of Service. If the reCAPTCHA keys are not configured, the forms submit without it.
• Fonts: Space Grotesk and DM Sans are stored on this Site. Loading a page does not send your IP address to Google Fonts.
• Server logs: the Site's hosting provider (xCloud) automatically records technical data such as IP address, browser type, pages requested, and the date and time of each request, for security and to keep the Site running.
• Analytics: when Google Tag Manager is enabled, I use Google Analytics 4, loaded through Google Tag Manager, to understand how visitors use the Site: pages viewed, how you arrived (for example search or a link), general location (country or region), device and browser, and actions such as submitting a form or booking a call. I don't send your name, email, phone number, message, or booking details to Google Analytics. A form event is sent only after the server accepts the submission, and it carries an anonymous id, not the contents of the form. Google Analytics uses cookies (for example _ga). Visitors in the EEA, UK, and Switzerland are not measured unless they accept. Elsewhere, analytics storage is on by default and you can opt out at any time via "Your privacy choices" in the footer. I honor Global Privacy Control signals for advertising-related storage. Ad personalization stays off. I don't use Google Analytics for remarketing or personalized advertising. Learn more: How Google uses information from sites that use its services. Opt-out browser add-on: https://tools.google.com/dlpage/gaoptout. If the tag manager id is empty, the Site does not load Google Tag Manager or Google Analytics.

3. How I use your information

• To reply to your message, prepare and send the free audit you asked for, and arrange and hold calls.
• To provide services if we decide to work together.
• To keep the Site and forms secure and free of spam.
• To understand how the Site is used and improve it, when analytics are enabled.
• To meet legal, tax, and accounting obligations.

I don't sell your personal information, and I don't share it for cross-context behavioral advertising.

Legal bases (UK/EU visitors): I process your information to take steps at your request before a contract (audit requests, enquiries, and bookings), for my legitimate interests (replying to enquiries, keeping the Site secure, improving the Site), and with your consent where it's required (for example for non-essential cookies in the EEA, UK, and Switzerland).

4. Marketing emails

I don't run a newsletter from this Site. I email you to reply to a message you sent, to send an audit you asked for, or about work we agree to do. If I ever send a marketing email, it will have an unsubscribe link, and you can also email hello@khalidhossen.com.

5. Who I share information with

I share personal information only with service providers that help me run the Site and my business, and only as much as they need:

• Website hosting: xCloud
• Form delivery: Google Workspace. Submissions are emailed to me. They are not written to a site database.
• Scheduling: TidyCal
• Spam protection: Google reCAPTCHA, when it is enabled
• Email: Google Workspace for hello@khalidhossen.com
• Analytics: Google (Google Analytics 4 and Google Tag Manager), when the tag is enabled

A certified consent manager is not bundled with the Site. Until one is connected, "Your privacy choices" in the footer is an on-site opt-out for this browser. It is not a certified EEA, UK, or Switzerland banner. Visitors in those regions stay opted out of analytics and ads storage until a certified banner is connected.

I may also disclose information if the law requires it, to protect my rights or the safety of others, or as part of a business transfer.

6. International transfers

I'm based in Bangladesh, and my service providers may process data in the United States and other countries. When information about UK/EU visitors is transferred, I rely on appropriate safeguards such as the providers' standard contractual clauses.

7. How long I keep information

• Enquiry and audit emails: for as long as I need them to reply, to do the work you asked for, and to meet legal, tax, and accounting duties. I don't publish a fixed deletion period, because one is not set on the mailbox.
• Client records: for as long as we work together, plus as long as tax and legal rules require.
• Server logs: for as long as the hosting provider keeps them for security and operations.

8. Cookies

• Necessary: used to run the Site and, when reCAPTCHA is enabled, to protect the forms from spam. The booking calendar (TidyCal) may set its own cookies inside the embedded calendar.
• Analytics (Google Analytics 4), when enabled: _ga and _ga_*, used to tell visits apart and measure usage. In the EEA, UK, and Switzerland these are only set if you accept them. Elsewhere you can turn them off via "Your privacy choices".
• Consent: a kh_consent cookie that remembers an opt-out or opt-in made with the footer control on this browser.
• Internal testing: a kh_internal cookie, set only when a link includes ?internal=1, so my own visits can be excluded from analytics.

You can also block or delete cookies in your browser settings. Some parts of the Site may not work without them.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal information I hold about you;
• correct it;
• delete it;
• object to or restrict how I use it;
• receive a copy in a portable format;
• withdraw consent at any time (where I rely on consent);
• opt out of the "sale" or "sharing" of personal information, and of targeted advertising (certain US states; see section 3);
• not be discriminated against for using these rights.

To make a request, email hello@khalidhossen.com. I'll verify your request and reply within the time the law requires (usually 30 to 45 days). You can use an authorized agent where the law allows it.

UK/EU visitors can also complain to their data protection authority (in the UK, the Information Commissioner's Office). Canadian visitors can contact the Office of the Privacy Commissioner of Canada. Australian visitors can contact the OAIC, and New Zealand visitors the Office of the Privacy Commissioner.

10. Security

I use reasonable technical and organizational measures to protect your information, including encrypted (HTTPS) connections and access-restricted accounts with my service providers. No method of transmission or storage is completely secure.

11. Children

The Site is meant for businesses and isn't directed at children under 16. I don't knowingly collect children's personal information. If you think a child has sent me information, email hello@khalidhossen.com and I'll delete it.

12. Third-party links

The Site links to other sites (for example TidyCal, LinkedIn, and X). Their privacy practices are governed by their own policies.

13. Changes to this policy

I may update this policy from time to time. I'll post the new version here with a new "Last updated" date.

14. Contact

Khalid Hossen · hello@khalidhossen.com