Privacy Policy

1. Overview

This Privacy Policy explains how adityamallah.com ("the site," "we," "us"), operated by Aditya Mallah, collects, uses, and protects information. The site is a personal growth marketing site with a blog, newsletter signup, and contact form. We collect as little personal data as needed to run those features.

Related policies: Cookie Policy, Terms of Service, and Accessibility.

2. Information We Collect

When you subscribe via the newsletter form, we store:

Email address (required)
Topic preferences (optional), such as sales, lead gen, partnerships, AI tools, LinkedIn, or fintech
Technical metadata used for abuse prevention and operations: approximate IP address, browser user-agent, and signup source or referrer when available
Timestamps for subscribe and unsubscribe events

Data is stored in a Cloudflare D1 database we control. It is used only to manage the list, send newsletter content, and keep the form secure. You can unsubscribe at any time (link in emails when delivery is active) or request deletion by emailing us.

2.2 Contact form

When you submit the contact form, we store:

Name and email (required)
Subject and message (required)
Company (optional)
Technical metadata: approximate IP address, browser user-agent, and HTTP referrer when available

Submissions are stored in Cloudflare D1 so we can reply and track status. We do not sell or rent this data. Spam and abuse are filtered with honeypot fields that real users leave empty.

2.3 Analytics (Google Analytics 4) - non-essential

If you accept Analytics (or Accept all) in the cookie banner, we load Google Analytics 4 (GA4) via Google Tag (gtag.js). GA4 may collect:

Page views and navigation (including in-app style transitions)
Scroll depth, outbound link clicks, and file downloads
Site search queries (terms only, not personal form fields)
Engagement events such as newsletter signup, contact form success, bookmarks, and article feedback
Device/browser technical data, approximate location (from IP), and a client identifier stored in Google cookies (for example _ga, _ga_*)

Analytics is off by default. We use Google Consent Mode v2 so storage stays denied until you opt in. You can change your mind anytime via Cookie settings in the footer or the Cookies control. IP anonymization is enabled in our configuration. We do not intentionally send email addresses or message content to GA.

Google acts as a processor / independent controller for Analytics under its Privacy Policy and data processing terms.

2.4 Marketing signals - non-essential

If you enable Marketing (or Accept all), we grant Google consent signals for ad storage and ad personalization. This site does not run a separate ad pixel today; those signals mainly allow Google to use broader measurement features with Analytics. Marketing is optional and off unless you opt in.

2.5 Server and edge logs

Cloudflare may temporarily log request data such as IP address, user-agent, and requested URL for security, reliability, and abuse prevention. Those logs are governed by Cloudflare's practices.

2.6 Local storage (on your device)

The site uses browser localStorage for UI preferences and to remember your cookie choices. See the Cookie Policy for keys.

3. Cookies and consent

We show a cookie consent banner on first visit. Categories:

Essential - always on (security, forms, consent preference, site UI storage)
Analytics - Google Analytics 4 cookies and events (optional)
Marketing - Google ads-related consent signals (optional)

Full detail, cookie names, and how to change preferences: Cookie Policy.

4. Third-party services

We rely on the following to run the site:

Cloudflare - Hosting (Cloudflare Pages), edge delivery, and D1 database storage for contact and newsletter data. See Cloudflare's Privacy Policy.
Google Analytics / Google Tag Manager endpoint - Measurement when you opt into Analytics. See Google's Privacy Policy and Analytics privacy overview.
Google Fonts - Loads Inter, Merriweather, and JetBrains Mono. Google may receive limited technical data (such as IP address) when fonts are requested. See Google's Privacy Policy.
Pagefind - Client-side search index. Search runs in your browser after the index is loaded from this site. If Analytics is on, search terms may be sent to GA as events; they are not sent to a separate search vendor.

Outbound links (for example LinkedIn, X, or articles we cite) go to third-party sites governed by their own policies.

5. How we use information

Reply to contact messages and manage growth or partnership conversations
Operate and improve the newsletter
Prevent spam, bots, and abuse
Secure and operate hosting infrastructure
With consent: measure traffic, content performance, and conversion events via Google Analytics
Comply with legal obligations when required

6. Legal bases (EEA/UK where applicable)

Contract / steps prior to contract - handling contact inquiries you send
Legitimate interests - securing the site, preventing abuse, essential storage
Consent - Analytics and Marketing cookies / Google tags
Legal obligation - when the law requires retention or disclosure

You may withdraw Analytics or Marketing consent at any time without affecting essential site use.

We do not sell, trade, or rent your personal information. We share data only:

With infrastructure providers that process data on our behalf (Cloudflare for hosting and D1 storage)
With Google when you opt into Analytics (and Marketing signals if enabled)
If we later use an email delivery provider to send the newsletter, that provider will process addresses solely to deliver messages we authorize
When required by law or to protect legal rights
With your explicit consent

8. Data retention

Contact submissions - Kept as long as needed to respond and keep a reasonable business record, then deleted or anonymized on request when feasible
Newsletter subscribers - Kept until you unsubscribe or request deletion. Unsubscribed addresses may be retained in a suppressed state so we do not re-add you by accident
Google Analytics - Retained according to our GA4 property settings (typically 2-14 months for event-level data; aggregates may last longer inside Google)
Local storage / consent choice - Controlled by you and your browser until cleared

9. Data security

The site is served over HTTPS. Form APIs accept only JSON (no file uploads or multipart bodies), allow POST only, check request origin, validate and sanitize input, cap payload size, apply per-IP and per-email rate limits, and use honeypot fields against bots. Security headers and no-store caching are set on API responses. Data lives on Cloudflare infrastructure. No method of transmission or storage on the internet is 100% secure; use the contact channels you trust for sensitive matters.

10. Children's privacy

This site is not directed at children under 13 (or the equivalent minimum age in your region). We do not knowingly collect personal information from children. If you believe a child has submitted data, contact us and we will delete it.

11. Your rights

Depending on where you live (including under GDPR, UK GDPR, or similar laws), you may have the right to:

Access, correct, or delete personal data we hold about you
Object to or restrict certain processing
Withdraw cookie consent for Analytics or Marketing (Cookie settings)
Opt out of newsletter emails (unsubscribe link when emails are sent, or email us)
Clear browser localStorage and site cookies
Lodge a complaint with a supervisory authority if applicable

To exercise these rights, email [email protected] or use the contact page. We will respond within a reasonable time.

Google also offers browser tools such as the Google Analytics opt-out add-on.

12. International transfers

Cloudflare and Google operate global infrastructure. Data may be processed in the United States and other countries. Where required, transfers rely on appropriate safeguards (for example Standard Contractual Clauses used by those providers).

13. Changes to this policy

We may update this Privacy Policy from time to time. Changes take effect when posted. The "Last updated" date at the top reflects the latest revision. Material changes may also be noted on the site or by email if we hold your address for the newsletter.

14. Contact

Questions about privacy: [email protected] or the contact page.

Operator: Aditya Mallah · Site: adityamallah.com