Privacy policy
In short: this website sets no cookies, uses no tracking and loads nothing from third-party servers. I only process personal data when you write to me, and for technical reasons when pages are delivered.
1. Controller
The controller under the General Data Protection Regulation (GDPR) is:
Hafiz Muhammad Sharoz Khalid
Rua Augusto Gil nº 7
2675-508 Odivelas
Portugal
Email: info@hmsk.life
2. Hosting and server log files
The site is hosted by Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA. The server is located in Amsterdam, Netherlands (EU).
For every request the server processes data your browser sends: IP address, date and time, requested URL, referrer, amount of data, HTTP status and user agent. This is needed to deliver the site and keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, error-free operation). The hosting provider deletes the log files automatically after a short period. I do not combine them with other data or use them to analyse behaviour. Namecheap acts as my processor (Art. 28 GDPR); any access from the USA relies on the provider's data processing terms including the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
3. No cookies, no tracking
hmsk.life sets no cookies, uses no analytics or advertising services and embeds no social media plugins. Fonts and icons are served from my own server, so no data goes to Google or other third parties. That is why there is no cookie banner. Social links in the footer are plain links. If I ever add audience measurement, it will be cookie-less and this policy will be updated first.
4. Contact form and email
If you write to me via the contact form or by email, I process your name, email address, message and the time, to answer you. The form is handled by a script on the same server and delivered as an email to my mailbox, which is operated by Microsoft (Microsoft Ireland Operations Limited, Dublin, Ireland) as a processor. A transfer to the USA is possible; Microsoft is certified under the EU-US Data Privacy Framework (Art. 45 GDPR) and also uses Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR. I delete messages once the conversation is clearly finished, at the latest after two years, unless statutory retention duties apply. If you ask for updates about a tool, I use your email only to write to you about that tool. I do not use a newsletter service at the moment.
5. Tools in your browser (invoice app, Skew Map)
The invoice app at hmsk.life/apps/invoice/ runs entirely in your browser. Senders, clients, invoices and settings are stored in your browser's local storage and never sent to my server. I have no access to them. Export a backup regularly; you can delete the data in your browser settings. Storing data in local storage is strictly necessary for the service you request (Art. 5(3) of the ePrivacy Directive 2002/58/EC). The Skew Map demo is a static page with a data snapshot and processes no input from you.
6. Self-hosted tools
If you run FinTrack, Content Studio or the server version of the invoice app on your own server, you are the controller for that processing. I receive no data from your installations. Services you connect yourself (for example AI providers with your own API keys, or bank interfaces) process data under their own terms.
7. Downloads and external links
The habit tracker is shared via a Microsoft SharePoint/OneDrive link. When you download it, Microsoft processes your IP address and technical data to deliver the file, under Microsoft's privacy policy.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). An informal email to info@hmsk.life is enough. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR); mine is the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal, cnpd.pt. You may also complain to the authority in the EU country where you live. There is no automated decision-making or profiling.
9. Security and changes
The site is served over HTTPS only. I update this policy when the site or the law changes.