Who is responsible
The controller of personal data described here is Nawras Al Bukhari, an independent individual service provider using the professional name Nawras Bukhari Engineering.
The public site is nbukhari.dev. Privacy questions go to [email protected]. Operational support may also use [email protected].
What this policy covers
This policy applies to the public website, the contact form, authenticated staff tools, the client portal, shared proposal and invoice links, receipts, payment checkout started from an invoice, optional Google Calendar connection, and optional realtime notifications in the authenticated application.
It does not replace a written proposal, statement of work, or data-processing terms agreed for a specific engagement. Those documents control if they conflict with this page for that engagement.
Information we collect
You may send us a name, company, email address, project type, timeline, budget range, and message through the contact form. Those fields become an inquiry record.
If you have an account, we store your name, email, hashed password, role, optional avatar, optional two-factor authentication secrets, and access-link metadata.
Client and project records may include organisation details, contacts, commercial terms, tasks, decisions, deliverables, files, calendar events, proposals, invoices, payment status, and comments needed to deliver the work.
Shared document links record views, acceptances, and change requests against the proposal or invoice they belong to.
- Server logs: IP address, user agent, requested URL, and timestamps used for security, abuse prevention, and debugging.
- Session identifiers, CSRF tokens, and the locale stored in the session so the site can stay in the language you selected.
- Theme, sidebar, and similar preferences kept in your browser local storage. Those values stay on your device unless a feature you use sends them.
How we use information
We use personal data to reply to inquiries, run engagements, issue proposals and invoices, collect payment, operate the portal, keep accounts secure, and maintain the public site.
Where data-protection law requires a lawful basis, we rely on performance of a contract or steps before a contract, legitimate interests in operating and securing the practice, legal obligations such as accounting, and consent where a connection is optional, such as Google Calendar.
- Responding to a project brief and deciding whether an engagement is a fit.
- Creating, sending, and verifying proposals, invoices, and receipts.
- Giving authorised clients access to projects, deliverables, documents, and payments.
- Detecting abuse, failed sign-in attempts, and other security events.
How long we keep information
Inquiries are kept while we consider or deliver an engagement, then as long as needed for a continuing commercial or legal record.
Account, client, project, and document records remain until an authorised owner deletes them, subject to accounting and legal retention.
Security logs are kept for a short operational period. Google Calendar tokens are removed when the integration is disconnected.
When we no longer need personal data, we delete it or irreversibly anonymise it.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or restrict personal data, to object to certain processing, to receive a portable copy, and to withdraw consent where processing is based on consent.
Write to [email protected]. We will respond within 30 days unless the law allows a longer period. You may also complain to a supervisory authority in your country, including an EU or EEA data-protection authority if those laws apply to you.
Security
The site is served over HTTPS. Passwords are stored as hashes, not plaintext. Two-factor authentication is available. Staff and client access is limited by role. Private application, portal, and document-share URLs are excluded from search indexes.
No method of transmission or storage is perfectly secure. Tell us promptly at [email protected] if you believe an account or document link has been misused.
International processing
The practice works with clients in Kazakhstan, the UAE, Europe, and other regions. Personal data may be processed on infrastructure used to host nbukhari.dev and by the processors named above, which may be outside your country.
Where a transfer needs safeguards under applicable law, we use the mechanisms those processors provide, such as their standard contractual terms.
Children
The site and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, contact [email protected] and we will delete it.
Changes
We will update this page when our practices change. The date at the top is the effective date of the current version. Material changes will be reflected here before they apply to new processing.
How to reach us
For privacy requests, email [email protected]. For billing or document access issues, [email protected] may also be used.
Questions about this page: [email protected]