Privacy Policy
Last updated: 19 August 2026
Who is responsible
This website (sahaand.com) is the personal portfolio of S. Saeed Hashemi, Leipzig, Germany. I am the controller for any personal data described below.
Contact: saeed.hashemi@nimcode.me
What this site is, technically
The site is generated as static files ahead of time and served as plain HTML, CSS, JavaScript, and images. There is no database, no user accounts, and no login. The one exception is the contact form: it POSTs to a small server-side script (described below) whose only job is relaying that one message to me; it renders no page and stores nothing. Consequently there is nothing to profile: the site does not build a visitor profile, does not personalise content, and does not run advertising.
Cookies and browser storage
This site sets no cookies and writes nothing to localStorage or sessionStorage. Because no consent-requiring storage is used, there is no cookie banner.
Analytics and tracking
There are none. No analytics product, tag manager, heatmap, session recorder, advertising pixel, or social-media tracking script is embedded in any page.
Fonts, icons, and images
The typefaces used here (Ubuntu and IBM Plex Mono) are downloaded at build time and served from this domain, so viewing a page makes no request to Google Fonts or any other font CDN. Every icon the site uses is likewise bundled into the page at build time, as are all images. The icon library retains a fallback to its public API (api.iconify.design) for icons that are not bundled, which in practice never applies here. So apart from that fallback, simply loading a page contacts no third-party server.
Contact form
The contact form on the homepage asks for your name, email address, and message. It also contains a hidden anti-spam field that real visitors never fill in; if it is filled in, that hidden field is sent along with the rest of the submission, and the server discards it — without relaying or storing it — rather than delivering it to me.
When a form backend is configured, your submission — including the hidden anti-spam field — is sent from your browser to a small script running on this same domain (a Cloudflare Worker). If that field is filled in, the Worker discards the submission immediately, without relaying or storing it. Otherwise it relays the three fields above, plus the technical metadata inherent in any HTTP request (such as your IP address, used only for a short-lived rate limit), to Resend (Resend, Inc., United States), which acts as my processor and delivers the message to me by email. Resend's own privacy terms apply to that processing, and the transfer involves a recipient outside the EU/EEA.
When no form backend is configured, the form does not transmit anything at all: it opens a pre-filled message in your own email program, and nothing is sent until you choose to send it yourself.
I use what you send only to read and reply to your message. The legal basis is Art. 6(1)(a) GDPR (your consent, given by submitting the form) and, for enquiries about work, Art. 6(1)(b) GDPR (steps prior to entering into a contract). Providing the data is voluntary; without it I cannot answer you.
Several places on the site link to my email address. Writing to me means I hold your message and address in my mailbox. I keep correspondence for as long as it is needed for the conversation and any follow-up, and delete it when it no longer serves a purpose.
Hosting and server logs
The static files are served by a hosting provider (a Cloudflare Worker). Like any web server, the provider's infrastructure processes the connection data that a request necessarily contains — IP address, requested URL, timestamp, referrer, and browser user-agent — to deliver the page and to keep the service secure and available. The legal basis is Art. 6(1)(f) GDPR (my legitimate interest in a functioning, secure website). I do not receive per-visitor logs from this processing.
Links to other sites
Pages link out to GitHub, LinkedIn, and the Figma community template credited in the footer, and blog posts include a LinkedIn share link. These are ordinary links: nothing is loaded from those services until you click, and once you do, that provider's own privacy policy governs what happens next. The same applies to the CV PDF, which is hosted here rather than elsewhere.
Your rights
Under the GDPR you have the right to access your personal data and to have it rectified or erased; to restrict or object to its processing; to receive it in a portable form; and to withdraw consent at any time with effect for the future. To exercise any of these, email me at saeed.hashemi@nimcode.me. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one for your place of residence or for my place of establishment in Germany.
Children
This site is aimed at a professional audience and is not directed at children. I do not knowingly collect data from children.
Changes to this policy
If the site changes in a way that affects this description — a new form, a new third-party service, or analytics of any kind — I will update this page and the revision date above.