Privacy Policy

1. Introduction & Scope

At GM Labs Technology Consulting ("GM Labs", "we", "us", or "our"), we respect the privacy of our website visitors, clients, and prospective engineering partners. This Privacy Policy details how we collect, handle, store, and safeguard personal and business information gathered through our agency portal (agency.ghulam-mustafa.com) and during our technical consulting engagements.

This policy adheres to modern international data protection standards, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Information We Collect

We strictly limit data collection to what is necessary to evaluate, scope, execute, and deliver client software projects:

• Direct Inquiries & Contact Details: When you submit a project inquiry, schedule an architecture audit, or reach out via email/WhatsApp, we collect your name, business email address, phone number, company name, and technical project description.
• Project & Infrastructure Credentials: During contracted engagements, you may share API keys, staging access credentials, or repository permissions. All such sensitive technical data is stored in encrypted password managers and deleted upon project completion or offboarding.
• Log & Technical Diagnostics: Standard web server logs collect basic telemetry (IP addresses, browser type, operating system, and request timestamps) strictly for security monitoring and DDoS mitigation.

3. Protection of Client Code & AI Training Policy

4. How We Use Your Information

We process collected data exclusively for the following legitimate business purposes:

• To review project inquiries and prepare technical architecture proposals or Statements of Work (SOW).
• To execute engineering deliverables, run tests, and deploy software services under active contracts.
• To generate milestone invoices, verify payments via commercial processors (e.g., Stripe, direct wire), and maintain required accounting records.
• To provide technical warranty support and SLA incident response during the post-launch period.

5. Third-Party Service Providers

We do not sell, rent, or trade your personal or business data. We may share necessary information with trusted enterprise service providers under strict confidentiality agreements:

• Payment Gateways: Stripe and banking institutions to facilitate compliant global credit card or wire transactions.
• Infrastructure & Hosting: Vercel and AWS for application hosting, performance monitoring, and DNS management.
• Version Control: GitHub for collaborative code repository management under private, secure permissions.

6. Data Security & Retention

We implement stringent technical and organizational security controls, including TLS 1.3 encryption for web transit, two-factor authentication (2FA) across all administrative tools, and automated security scans.

Project communication records and billing records are retained for the statutory period required by tax and corporate regulations (typically 5 to 7 years), after which they are securely archived or purged.

7. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you possess the following rights regarding your personal information:

• The right to request access to the personal data we hold about you.
• The right to request rectification or deletion of inaccurate or unnecessary data.
• The right to object to or restrict processing of your personal information.
• The right to request data portability in a machine-readable format.

To exercise any of these rights, contact our Data Protection representative directly at hello@ghulam-mustafa.com.

8. Contact & Privacy Officer

If you have questions or concerns regarding this Privacy Policy or our security practices, please reach out to: