Website information
Privacy Policy
How enquiries, the client portal, optional measurement and the website’s tools handle information.
Last updated September 27, 2026
About this policy
This policy describes how information is handled through bizlal.com, run by Bizlal Media Inc. (Bilal Khalid), Hamilton, Ontario. For questions about your information, email bilal@bizlal.com. A written scope agreement and the notices of any service provider named below may also apply once we work together.
Information you choose to provide
A contact-form enquiry may include your name, email, an optional phone number and business name, the service you are interested in, how you would prefer a reply and a short message. The questions at /start also ask about your situation in general terms, for example a monthly budget band, whether you have a website or a Google Business Profile, your city and your timing, so the first conversation can start where you are. I use these details to reply, to decide how soon, and to prepare for that conversation. Do not include passwords, account numbers or other confidential records.
How enquiries are kept
Enquiries, answers to the /start questions and my notes are stored in a database I control. Contact details, answers, messages and uploaded files are encrypted before they are stored, and only I (or staff I sign in) can read them. To see which parts of the website bring in enquiries, and later clients, a reporting record links an enquiry to how the visitor found the site; that record holds your name, email and phone number so a repeat enquiry is recognised as the same person. I also record how an enquiry was sent, meaning the type of device, browser, page and referring site, but not your IP address or full browser details. With advertising measurement allowed, the ad-click identifier from your visit is kept with your enquiry so a resulting project can be reported back to the advertising platform as a conversion; with analytics allowed, the analytics client identifier is kept for the same purpose. Your answers produce a short triage summary of which service is likely relevant and how quickly to follow up. It is a prompt for me, not an automated decision: I read every enquiry, and nobody is refused by the summary.
Researching business enquiries
When you send an enquiry I may use an AI research service to look up publicly available information about the business you represent, for example what it does, its website and its size, so the first conversation is better prepared. Only your name, the business name or website you gave, your email domain and the text of your enquiry are used for this; your answers about budget and any files are never sent. The research runs through the Vercel AI Gateway and the model providers behind it, possibly outside your province or Canada, and the result is stored encrypted with your enquiry and visible only to me. It is a preparation aid, not a decision about you.
Follow-up emails
After you send an enquiry I may email you about it: a confirmation, a reminder if a call has not been arranged, and messages from me. These relate to your enquiry and stop when it is resolved or you ask. Anything beyond that is sent only if you tick the box asking for it, and every such email includes an unsubscribe link. Replies you send to my emails are stored with your enquiry.
Client portal
Once we work together, you can sign in to the client portal with a single-use link sent to your email. Signing in sets a session cookie that expires after 12 hours. The portal shows what I have asked for, lets you upload files of up to 3 MB each and exchange messages with me. Access to your domain, Google profile, ad accounts and analytics is requested only after we agree to work together, through the portal, and I ask for manager access in your account rather than for your passwords. Uploaded files are encrypted before they are stored.
Live results
The /proof page and the live numbers on the home page show Google Search Console figures for websites I run or built, fetched with the site owners’ permission through a Google service account. They contain no information about visitors to this site.
Service providers and delivery
The website is hosted on Vercel, which processes technical request information. Enquiries and my records are stored in a PostgreSQL database with a hosting provider I select. The site uses Resend for sending and receiving email, Upstash Redis for abuse prevention and duplicate-request handling, and Cloudflare Turnstile for form-security checks. These services may process information outside your province or Canada, according to their contracts and policies.
Security and temporary records
Forms validate requests and use abuse-prevention controls. A network address, when available, is converted into a keyed hash for temporary rate-limit counters; the application does not intentionally log enquiry contents, contact information or captcha tokens. Duplicate-request records hold a hashed request fingerprint rather than the enquiry text. Links that open your enquiry or the portal contain a random token that is stored only as a hash. No website or email channel can guarantee absolute security.
Website chat assistant
The optional chat sends the messages you type, and the address of the page you are viewing, to an AI model through the Vercel AI Gateway so the assistant can reply. The gateway and model providers process them under their own terms, possibly outside your province or Canada. The assistant gives general information only. This application does not intentionally log chat messages. If you send your details or request a call back from the chat, the conversation is included with your enquiry so you do not need to repeat it. Do not share passwords, account numbers or other confidential records in the chat.
Cookies
Three cookies are needed for the site to work and are always set when you use the feature: one lets you return to your /start answers and booking for 30 days after sending them, one keeps you signed in to the client portal for up to 12 hours, and one keeps staff signed in. Everything else is optional and off until you opt in through cookie preferences. With analytics allowed, the site stores how you first found it (for up to 90 days), a 30-minute visit identifier and a device identifier (up to 400 days), and reports page views to my own reporting; contact fields and message contents are never part of it. With advertising measurement allowed, it also keeps an ad-click identifier for up to 90 days so a resulting enquiry can be credited to the ad. Optional configuration also supports Google Analytics, Google Ads measurement and Microsoft Clarity, which record how pages are used with typed text, form fields and the chat masked, and load only after you allow analytics; none is loaded on the /start questions, the client portal or the staff portal. You can reopen Cookie preferences in the footer and change your choices at any time; your choice is remembered for up to 180 days.
Free tools
The ads budget calculator and the ads-or-SEO decider calculate in your browser and do not submit what you enter. The checklists save checked-item identifiers in local storage on your device, without attaching your name or email. Clearing browser storage removes that progress. A downloaded or printed copy is controlled by you.
Retention, access and questions
Enquiry information is kept as long as needed to respond, to administer a resulting project, to meet legal obligations and to address legitimate business needs, then deleted. Email bilal@bizlal.com to ask about access, corrections, deletion or privacy concerns. Requests are subject to identity verification and applicable requirements.
External links and updates
Booking services and other linked websites have their own terms and privacy practices. This policy may be updated when the site’s operation changes. Review the version shown here and contact me for clarification.