What this site knows about you.

If you only read a paragraph, read this one. I collect two kinds of thing: what you type into a form, and anonymous-ish measurements of how pages get used. Form submissions arrive in my email inbox and nowhere else — there is no CRM, no marketing automation, no list I sell or rent. Measurement runs through third-party analytics tags, one of which records your session as a replay. If you want anything deleted, email info@abdulwahabai.comand it’s done.

I am the data controller. I’m based in Karachi, Pakistan, and the services this site uses store data on servers in the United States and the European Union.

Five forms on this site capture personal data. Every one of them does exactly the same thing with it: composes an email and sends it to my inbox through Resend. Nothing is written to a database, and nothing is stored on this site after the email is sent.

Contact form

Name, email, and message are required. Organisation, enquiry topic, and a budget range are optional. I get one copy; you get an automatic acknowledgement at the address you entered.

Workshop inquiry

Name, email, organisation, your role, audience size, and preferred format are required. Target dates and free-text notes are optional. Same fan-out: a copy to me, an acknowledgement to you.

Lab note subscribe

Your email address, and nothing else. There is no double opt-in and no mailing-list platform yet — the address simply arrives in my inbox and I add it by hand when a note goes out.

Sessions notify

Your email address plus which session you asked about.

Audit bot

Your five free-text answers about your workflow, plus your name and email at the end. You get the resulting one-page PDF by email; I get the same PDF and a copy of the full transcript.

Each form also carries a hidden field that humans never see. If it comes back filled in, the submission is treated as a bot and quietly dropped. The workshop form additionally runs an invisible hCaptcha check when that integration is configured.

The workflow audit at /lab/audit is a real large language model, not a scripted quiz. Every answer you type is sent to Anthropic’s API to generate the next question and the final hypothesis. Say that out loud before you paste anything in: don’t put client names, credentials, or anything confidential into those five boxes. Describe the shape of the workflow, not the secrets inside it.

Your answers are held in your own browser’s session storage while you work through the questions, and cleared once the PDF is sent. To keep the demo from being abused, the first turn of each run records your IP address as a counter in a hosted Redis store; the counter expires automatically one hour later. That counter is the only place this site writes your IP anywhere it persists, and it is stored as-is rather than hashed.

Up to five measurement tools run on this site. Three of them only load when I’ve configured them, so what you actually get depends on when you visit — the honest answer is to assume all five are on.

Plausible

Privacy-first page-view counting. No cookies, no cross-site identifiers, no individual profile. This is the number I actually look at.

Google Analytics 4

Supplemental. Sets cookies, records page views and events, and derives approximate location from your IP address. Google is a separate controller for what it collects.

Microsoft Clarity

Session recording and heatmaps. This one captures a replay of your visit — scrolling, clicks, mouse movement, and the pages you move between. Clarity masks form input by default, but treat it as the most invasive thing on the page, because it is.

Vercel Analytics

Aggregate traffic counting from the host. No cookies.

Vercel Speed Insights

Page-performance timings from real visits. No cookies.

This site sets no cookies of its own. The cookies you may pick up come from Google Analytics, Microsoft Clarity, and two embeds: the Cal.com booking calendar on the contact page, and the video player on session and lesson pages. Videos use YouTube’s privacy-enhanced domain, which holds off on tracking cookies until you press play.

Two things are kept in your browser’s local storage and never leave your device: your light/dark theme choice, and which lessons you’ve marked as watched. Clearing site data removes both.

How to switch the tracking off:

• Google Analytics— install Google’s official browser opt-out add-on, or block the tag with any content blocker.
• Microsoft Clarity— Clarity honours the browser Do Not Track signal, so turning DNT on in your browser settings stops the recording. A content blocker works too.
• Everything else— a standard tracker blocker or blocking third-party cookies stops the rest. The site is built to work perfectly well with all of it blocked.

Because you asked me to. Everything you type into a form is processed to answer you. You started the conversation; that is the basis, and you can end it at any time by asking me to delete the thread.

Because I need to run the place.Analytics, the spam traps, and the audit bot’s rate limit exist so I can tell which pages earn their keep and stop bots from burning my model budget. That’s a legitimate interest, and it’s the reason you can opt out of all of it without losing anything.

If you are in the EU or UK and prefer the formal names: consent for the analytics and session-recording tags, and legitimate interests for correspondence, security, and abuse prevention.

I don’t sell data, and I don’t share it for advertising. These are the services involved in running the site, and the full list of who can see anything:

Vercel

Hosting. Serves every page and keeps short-lived server logs that include IP addresses and user agents.

Resend

Email delivery. Every form submission passes through Resend on its way to my inbox and to your acknowledgement.

Google Workspace

Where my inbox lives. Your message sits there like any other email until it’s deleted.

Anthropic

The language model behind the audit bot. Receives the five answers you type there.

Upstash

Hosted Redis. Holds the hourly audit-bot rate-limit counter keyed by IP address.

Cal.com

The booking calendar embedded on the contact page. If you book, your name, email, and any booking notes go to Cal.com.

YouTube

Video hosting for session and lesson pages, on the privacy-enhanced domain.

hCaptcha

Bot detection on the workshop form, when configured. Sees your IP and browser signals.

Analytics vendors

Google, Microsoft, Plausible, and Vercel, as described above.

I’d also hand something over if a law legitimately required it — which has never happened, and I’d tell you if it did, unless I were barred from doing so.

Emails from formsstay in my inbox as long as the conversation is useful — a live enquiry, an ongoing engagement, or a project I might reasonably need to look back on. If a thread has gone nowhere for two years, I delete it. If you’d rather not wait, ask.

Subscriber addresses stay until you tell me to drop them. Every note I send says how.

The audit rate-limit counter expires one hour after it is created. Audit answers leave your browser as soon as the PDF is sent; the transcript survives only as the email copy in my inbox.

Analyticsfollows each vendor’s own schedule. Clarity keeps session recordings for a limited window set by Microsoft; Google Analytics is configured to expire user-level data on its shortest available setting; Plausible and Vercel keep only aggregates, which never expire because they aren’t about you.

There’s no self-service dashboard here, and pretending otherwise would be theatre. One email to info@abdulwahabai.comcovers all of it: ask for a copy of what I hold, ask for a correction, ask me to delete it, ask me to stop emailing you, or ask me to stop processing altogether. I’ll confirm within 30 days and usually much sooner — a deletion request is a search of my inbox and a keypress.

I may ask you to confirm you’re writing from the address on the record, which is the only way I can tell it’s you. Depending on where you live you may also have the right to complain to a data protection authority; I’d appreciate the chance to fix it first.

This site is aimed at working professionals and isn’t directed at children. I don’t knowingly collect data from anyone under 16. If you’re a parent or guardian and think a child has sent me something through a form here, email info@abdulwahabai.comand I’ll delete it.

When the site starts doing something new with data, this page is updated in the same change that ships it — that’s a rule I hold myself to, not a courtesy. The date at the top always reflects the last edit. If a change materially affects data I already hold, I’ll email the people it affects rather than quietly editing this page.