Zero Data Selling
We strictly never sell, rent, monetize, or trade your personal information with third-party data brokers or marketing networks.
End-to-End Encryption
All sensitive transactions, API communications, and credential transfers are protected by 256-bit TLS 1.3 cryptographic protocols.
Full Consumer Rights
Guaranteed statutory rights to request, inspect, correct, export, or permanently erase your personal records at any time.
1. Data Controller & Official Contact
This Privacy Policy sets forth the privacy practices of Mohd Irshad ("Provider", "we", "us", or "our"), operating the professional engineering portal and digital software marketplace at https://mohdirshad.com.
For the purposes of the European Union General Data Protection Regulation (EU GDPR), United Kingdom Data Protection Act 2018 (UK GDPR), and India's Digital Personal Data Protection Act, 2023 (DPDP Act), Mohd Irshad functions as the primary Data Controller.
Official Data Protection & Grievance Redressal Officer:
- Name: Mohd Irshad (Senior Full-Stack Software Engineer)
- Official Privacy Email: irshadalam62733@gmail.com
- Direct Phone / WhatsApp: +91 8076359220
- Operational Jurisdiction: India · Serving Enterprise & Individual Clients Globally
- Grievance Response SLA: Initial acknowledgement within 24–48 hours; substantive resolution within 30 calendar days.
2. Scope & International Applicability
This policy governs personal data collected when you:
- Visit and navigate our public web pages, blogs, and portfolio case studies at
mohdirshad.com. - Commission bespoke software engineering, enterprise web design, API architecture, or custom SaaS development.
- Purchase and download turnkey software templates, ready-made POS applications, PHP source scripts, or commercial digital licenses.
- Register an account, submit custom quote inquiries, or engage in project correspondence via email, phone, or live chat.
We adhere to harmonized international privacy principles to ensure lawful compliance across the United States (including state-level legislation such as California CCPA/CPRA, Virginia VCDPA, Colorado CPA), the European Economic Area (EEA), the United Kingdom, Canada (PIPEDA), Australia (Privacy Act 1988 & APPs), and India (DPDP Act 2023 & IT Act 2000).
3. Categories of Information We Collect
We practice data minimization: we collect only information that is strictly necessary to provide high-quality engineering services, deliver digital software licenses, issue legally valid tax invoices, and secure our systems.
| Category | Data Elements Collected | Business & Technical Purpose |
|---|---|---|
| Direct Identifiers | Full name, business email address, phone / WhatsApp number, company name, billing street address, and country. | Client onboarding, contract execution, delivery of digital products, and customer support. |
| Commercial & Billing | Transaction ID, purchased license tier, order total, currency, payment status, and milestone invoice records. | Payment verification, fulfillment of digital goods, warranty tracking, and mandatory statutory tax accounting. |
| Technical & Telemetry | IP address (anonymized for regional metrics), browser type & version, device operating system, referring URL, and session timestamps. | Server load balancing, defense against brute-force / DDoS attacks, fraud prevention, and performance optimization. |
| Project Specifications | Technical requirements, API credentials provided by client (stored encrypted), architectural blueprints, and milestone feedback. | Fulfillment of custom software development contracts and milestone delivery verification. |
| OAuth Authentication | Google ID, verified email address, public profile name, and avatar URL (when utilizing Google One-Tap / Social Login). | Frictionless user authentication, account recovery, and client dashboard access. |
4. Lawful Grounds for Processing (EU & UK GDPR Art. 6)
In accordance with Article 6 of the General Data Protection Regulation, our legal bases for processing personal data include:
- Performance of a Contract (Art. 6(1)(b)): Processing is necessary to execute custom development contracts, deliver digital software source code, process milestone payments, and provide post-deployment warranty support.
- Compliance with Legal Obligations (Art. 6(1)(c)): Fulfilling statutory accounting, financial audit, anti-fraud, and tax retention obligations under applicable national and international revenue codes.
- Legitimate Interests (Art. 6(1)(f)): Maintaining server network security, detecting malicious traffic or bot attacks, preventing payment chargeback fraud, and improving site usability—balanced against your fundamental rights.
- Freely Given Consent (Art. 6(1)(a)): When you opt-in to non-essential browser cookies, subscribe to technical newsletters, or submit public client reviews and ratings. Consent may be revoked at any time.
5. Payment Processing & Trusted Sub-Processors
We do not collect or store raw debit or credit card numbers, CVVs, or bank net-banking passwords on our servers. All financial transactions are handled directly by PCI-DSS Level 1 certified international payment gateways:
- PayU Payments Private Limited: Utilized for secure domestic and international card payments, UPI, and net-banking transactions compliant with Reserve Bank of India (RBI) tokenization guidelines.
- Stripe / PayPal: Utilized for international client milestone invoicing and credit/debit card processing under strict SOC 2 and PCI-DSS compliance standards.
- Google OAuth 2.0: Secure social authentication protocol safeguarding your account credentials without sharing your private account passwords with us.
- Cloud Infrastructure & Transactional Mail: Enterprise cloud hosting with hardened firewalls and authenticated SMTP relays for transactional order confirmations.
All sub-processors are legally vetted and bound by Data Processing Agreements (DPAs) mandating security standards equivalent to or exceeding this policy.
6. International & Cross-Border Data Transfers
Because we serve clients across North America, Europe, the United Kingdom, Australia, the Middle East, and Asia, your personal information may be transferred to, stored, and processed in cloud data centers located outside of your resident country.
To ensure your data remains protected when crossing international borders:
- We execute the European Commission’s approved Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46.
- We implement the UK International Data Transfer Addendum (IDTA) for data originating from the United Kingdom.
- We utilize strong encryption in transit (TLS 1.3) and restricted database access controls for all cross-border communications.
7. Cookies & Local Tracking Policy
Cookies are small text files stored on your local device to enhance browsing functionality and ensure security. We use the following categories:
| Cookie Type | Name / Identifiers | Purpose & Lifespan |
|---|---|---|
| Strictly Necessary | PHPSESSID, csrf_token |
Maintains your authenticated session, safeguards form submissions against forgery, and manages cart states. Expires upon browser close. |
| Functional Preferences | site_theme, currency_pref |
Remembers your selected display preferences (e.g. dark/light mode, preferred currency view). Lifespan: up to 365 days. |
| Analytics & Security | Telemetry tokens | Aggregated, non-personally identifiable visit counters and page load metrics to diagnose server latency and defend against automated bots. |
Managing Cookie Preferences: You can configure your browser to block, alert, or delete cookies at any time via your browser settings (Chrome, Safari, Firefox, Edge). Please note that disabling strictly necessary cookies may impair account login and checkout capabilities.
8. Your Statutory Rights Across Global Jurisdictions
We respect and uphold the statutory privacy rights granted to individuals across all major international jurisdictions:
European Union & United Kingdom (GDPR)
- Right of Access (Art. 15): Right to obtain confirmation and a free copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Right to rectify inaccurate or incomplete personal records without undue delay.
- Right to Erasure / "To Be Forgotten" (Art. 17): Right to request permanent deletion of your data when no longer needed for contractual or statutory tax obligations.
- Right to Restriction of Processing (Art. 18): Right to restrict processing during ongoing legal disputes or verification periods.
- Right to Data Portability (Art. 20): Right to receive your personal data in a structured, commonly used, machine-readable format (JSON/CSV).
- Right to Object (Art. 21): Right to object to processing based on legitimate interests or direct marketing at any time.
- Right to Lodge a Complaint: Right to contact an EU Data Protection Authority (DPA) or the UK Information Commissioner's Office (ico.org.uk).
United States Residents (CCPA, CPRA, VCDPA, CPA)
- Right to Know & Access: Right to know categories of personal information collected, sources, purposes, and third parties with whom data was shared in the preceding 12 months.
- Right to Delete: Right to request deletion of personal information collected from you, subject to statutory business exceptions.
- Right to Correct: Right to correct inaccurate personal data maintained in your client profile.
- Notice of Non-Sale: We do not sell personal information or share personal data for cross-context behavioral advertising (Cal. Civ. Code § 1798.140).
- Right to Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of software because you exercised your statutory privacy rights.
- California "Shine the Light": Under Cal. Civ. Code § 1798.83, California residents may request information regarding disclosure of personal data for direct marketing purposes (we make zero such disclosures).
India (Digital Personal Data Protection Act, 2023)
- Right to Summary of Personal Data: Right to obtain a summary of personal data being processed and identities of processing entities.
- Right to Correction & Erasure: Right to correct inaccurate personal data and request erasure of data no longer necessary for the specified purpose.
- Right of Grievance Redressal: Right to register grievances with our Data Protection Officer and escalate to the Data Protection Board of India if unresolved within statutory timelines.
- Right to Nominate: Right to nominate any individual who, in the event of death or incapacity, shall exercise your privacy rights.
Canada (PIPEDA) & Australia (Privacy Act 1988)
- Canada (PIPEDA): Full compliance with the 10 Fair Information Principles, including individual access, accuracy, and clear accountability for third-party transfers.
- Australia (APPs): Open and transparent management of personal information under the 13 Australian Privacy Principles, with transparent breach notification standards.
How to Exercise Your Rights: Submit your formal request directly to irshadalam62733@gmail.com with the subject line "Privacy Rights Request - [Your Name]". We will verify your identity to protect your account against unauthorized access and respond within the statutory timeframe (30 days or less).
9. Data Retention & Secure Disposal Schedule
We retain personal data only for as long as necessary to fulfill the operational purposes outlined in this policy or comply with legal requirements:
- General Inquiries & Contact Form Submissions: Retained for a maximum period of twenty-four (24) months following last communication, after which records are purged or anonymized.
- Digital Software Purchases & Active Licenses: Customer contact details and license verification records are retained for the lifetime of your active license to enable download access, updates, and bug warranties.
- Financial & Tax Invoices: Payment receipts, invoice records, and transaction logs are retained for seven (7) years to comply with statutory fiscal audit and tax reporting laws under international commercial standards.
- Disposal Protocol: Expired data is permanently deleted from production databases and overwritten using cryptographic wiping standards.
10. Information Security & Technical Safeguards
We employ multi-layered technical and organizational safeguards engineered to protect personal information against accidental loss, unauthorized access, destruction, or disclosure:
- Cryptographic In-Transit Security: 256-bit TLS/SSL certificate encryption across all web pages, checkout funnels, and administrative portals.
- Database Hardening: All database operations utilize PHP Data Objects (PDO) with strict parameter binding to eliminate SQL Injection (SQLi) vulnerabilities.
- Input Sanitization: Form data passes through multi-layered sanitization algorithms to prevent Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
- Access Control: Administrative access is restricted via multi-factor authentication, IP whitelisting, and least-privilege security policies.
11. Children's Privacy (COPPA & International Standards)
Our web engineering services and digital software products are directed strictly to commercial businesses, software developers, and individuals of legal majority. We do not knowingly solicit, collect, or process personal information from children under eighteen (18) years of age, or under the age of thirteen (13) in the United States pursuant to the Children's Online Privacy Protection Act (COPPA), or under sixteen (16) in the European Union.
If a parent or legal guardian discovers that a minor has provided us with personal information without consent, please contact us immediately at irshadalam62733@gmail.com. We will promptly delete such records from our databases.
12. Security Breach Notification Protocol
In the unlikely event of a verified security incident resulting in the unauthorized breach, alteration, or disclosure of personal data:
- We will initiate an immediate security audit and forensic containment protocol within four (4) hours of detection.
- Where required by applicable data protection laws (such as GDPR Article 33/34 or the DPDP Act), we will notify competent supervisory authorities without undue delay (and within 72 hours where feasible).
- Affected users will be directly notified via email outlining the nature of the breach, affected data categories, containment actions taken, and recommended protective measures.
13. Revisions to this Privacy Policy
We reserve the right to update or amend this Privacy Policy periodically to reflect technological advancements, operational enhancements, or statutory regulatory updates. When revisions are made, the "Last Revised" date at the top of this document will be updated. Continued use of our website and services following published revisions constitutes acceptance of the modified terms.
14. Contact Information & Formal Inquiries
For any questions, privacy rights requests, or feedback regarding our global privacy framework, please reach out to our dedicated privacy contact:
Mohd Irshad • Global Software Services
Email: irshadalam62733@gmail.com
Direct Phone / WhatsApp: +91 8076359220
Website: https://mohdirshad.com
Operating Base: India · Executing Projects for Clients Worldwide
