Privacy
Last updated 28 July 2026
This site is run by Yusuf Diallo, trading as Yusuf Creates. It collects as little as it can get away with, and this page says exactly what that is. If anything here is unclear, write to hello@yusufcreates.com and I'll answer plainly.
What is collected, and why
If you send an enquiry. Your name, email address, and whatever else you choose to fill in — phone number, company, budget range, timeline, and the description of your project. A phone number is only required if you ask to be called. This is used to reply to you and to quote the work. Nothing else.
If you subscribe to the newsletter. Your email address, and which page you subscribed from. Nothing is sent until you click the confirmation link — an address that is never confirmed is never written to the list.
When you browse. Page views, how far down a page you scroll, which buttons are clicked, and the site you arrived from — its address only, never the full link. Also your device type, browser, screen width and country, so I can tell whether the site works properly on what people actually use.
Those are tied to two random identifiers. One lives in your browser's session storage and is gone when you close the tab. The other lives in local storage and stays, so that a second visit is not counted as a stranger — clearing your site data removes it and you become a new visitor. Neither is a cookie, neither is derived from anything about you, neither can be read by any other website, and nothing here records your name, your address or your IP.
This is why there is no cookie banner. There is nothing to consent to: the analytics are first-party, they identify a browser rather than a person, and they never leave this site. If your browser sends a Do Not Track signal, nothing is recorded at all.
Anti-spam. Forms measure how long the page was open and include a hidden field that a person never sees. Both are used only to discard automated submissions.
What is never collected
- Advertising or cross-site tracking identifiers.
- Payment card details. Those go directly to Stripe.
- Anything sold, rented, or shared with data brokers — ever.
Who processes it
These are the only third parties that data reaches, and only for the purpose listed.
| Processor | Purpose |
|---|---|
| Convex | Database. Enquiries, subscribers and analytics are stored here. |
| Vercel | Hosting and content delivery. |
| Resend | Sends transactional email and the newsletter. |
| Cloudflare | Turnstile, which distinguishes people from bots on forms. |
| Stripe | Payments. Card details are entered on Stripe's own page and never touch this site. |
| Anthropic | Powers the site assistant, where one is available. Conversations are not used to train models. |
How long it is kept
- Enquiries: kept while there's an active conversation, and for two years afterwards in case you come back. Ask and I'll delete yours sooner.
- Newsletter: until you unsubscribe. Every email has a one-click link.
- Analytics: pageview records are anonymous and kept for twelve months.
- Invoices and payments: kept for seven years, because tax law requires it.
Your rights
Wherever you are, you can ask for a copy of what I hold about you, ask for it to be corrected, or ask for it to be deleted. I'll respond within 30 days, and sooner in practice.
If you are in California (CCPA/CPRA): you have the right to know what is collected, to have it deleted, to correct it, and to opt out of its sale or sharing. To be explicit: I do not sell or share personal information, and never have. There is nothing to opt out of. Exercising any of these rights will never result in worse service or different pricing.
If you are in the UK, EU, or Saudi Arabia (UK GDPR, GDPR, PDPL): you additionally have the right to restrict or object to processing, to data portability, and to complain to your supervisory authority. The lawful basis is consent for the newsletter, and legitimate interest for replying to an enquiry you sent me.
To exercise any of these, use the data request form below or email hello@yusufcreates.com. No account or verification hoops.
Making a request
Email hello@yusufcreates.com with the address you used, and say whether you want a copy, a correction, or deletion. I'll confirm within a couple of days and complete it within 30.
Security
Everything is served over HTTPS. Secrets live in server-side environment variables and are never sent to the browser — the build actively scans for leaked credentials and fails if it finds any. Invoices are reachable only through an unguessable link, and admin access is restricted to a single account with server-side verification on every request.
Changes
If this policy changes materially, the date at the top changes with it. I won't quietly broaden what is collected.