Privacy Policy

This Privacy Policy governs all digital assets, software consulting engagements, and web platforms operated by Mosarrof Sabuz ("we," "our," or "the Lead Architect"), accessible via mosarrofsabuz.com.

As an independent senior software developer and telemetry specialist, we act as the Data Controller for any personal details submitted directly to us, and as a Data Processor when engineering, deploying, or auditing server-side tracking pipelines (such as Meta Conversions API or Server Google Tag Manager) on client infrastructure.

We adhere to strict data minimization principles. We only collect information essential for fulfilling technical proposals, providing consultation, and executing development milestones:

Note: We do not process sensitive personal data (such as health, biometric, religious, or political data) nor do we knowingly collect data from individuals under 18 years of age.

Under the General Data Protection Regulation (GDPR), every data processing activity is backed by a specific legal basis:

• Contractual Necessity: Processing inquiry information, project scopes, and development milestones to deliver bespoke software and execute Statements of Work.
• Legitimate Interests: Securing our web platform against bot spam, malicious SQL injection attempts, and DDOS vulnerabilities.
• Legal Obligation: Maintaining compliant tax, financial billing, and invoice records as required by relevant financial authorities.

As technical specialists in server-side telemetry and conversion engineering, we implement high-grade cryptographic privacy standards across all customer conversion pipelines:

This guarantees that raw unencrypted personal identifiers are never stored or transmitted across unverified network hops.

We utilize an intentionally minimalist infrastructure stack to limit external data exposure. Our authorized subprocessors include:

Our web properties operate strictly without intrusive advertising cookies:

• Essential Session Tokens: Secure CSRF verification tokens required for project form submissions and admin session management.
• UI Preferences: Local storage parameters for theme selection and cost calculator configurations.
• Zero Ad-Networks: No third-party behavioral advertising or tracking retargeting pixels run on our public blog or portfolio pages.

We maintain an automated data lifecycle management protocol:

• Inquiry Records: Retained for 12 months to facilitate ongoing project consultation, then archived or purged.
• Client Staging Credentials: All temporary SSH keys, database passwords, and FTP tokens are permanently deleted 30 days after live production deployment.
• Financial Invoices: Retained for 7 years to comply with statutory accounting and tax regulations.

You are entitled to exercise your statutory data subject rights at any time without fees:

We employ robust defenses against unauthorized data interception and automated abuse:

• TLS 1.3 Transport Security: Strict HTTPS enforcement across all routes with HSTS headers.
• Zero-Execution Honeypots: Invisible honeypot inputs and automated rate-limiting to prevent bot spam without intrusive CAPTCHA friction.
• Parameterized Database Access: Eloquent ORM and prepared PDO statements eliminating all SQL injection attack vectors.