Privacy
Last updated 28 July 2026
This site is run by Yusuf Diallo, trading as Yusuf Creates. It collects as little as it can get away with, and this page says exactly what that is. If anything here is unclear, write to hello@yusufcreates.comand I'll answer plainly.
What is collected, and why
If you send an enquiry. Your name, email address, and whatever else you choose to fill in — phone number, company, budget range, timeline, and the description of your project. A phone number is only required if you ask to be called. This is used to reply to you and to quote the work. Nothing else.
If you subscribe to the newsletter. Your email address, and which page you subscribed from. Nothing is sent until you click the confirmation link — an address that is never confirmed is never written to the list.
When you browse.Page views, the page you came from, and which buttons are clicked. These are tied to a random identifier held in your browser's session storage, which is cleared when you close the tab. It is not a cookie, it is not shared with anyone, and it cannot identify you.
Anti-spam. Forms measure how long the page was open and include a hidden field that a person never sees. Both are used only to discard automated submissions.
What is never collected
- Advertising or cross-site tracking identifiers.
- Payment card details. Those go directly to Stripe.
- Anything sold, rented, or shared with data brokers — ever.
Who processes it
These are the only third parties that data reaches, and only for the purpose listed.
| Processor | Purpose |
|---|---|
| Convex | Database. Enquiries, subscribers and analytics are stored here. |
| Vercel | Hosting and content delivery. |
| Resend | Sends transactional email and the newsletter. |
| Cloudflare | Turnstile, which distinguishes people from bots on forms. |
| Stripe | Payments. Card details are entered on Stripe's own page and never touch this site. |
| Anthropic | Powers the site assistant, where one is available. Conversations are not used to train models. |
How long it is kept
- Enquiries:kept while there's an active conversation, and for two years afterwards in case you come back. Ask and I'll delete yours sooner.
- Newsletter: until you unsubscribe. Every email has a one-click link.
- Analytics: pageview records are anonymous and kept for twelve months.
- Invoices and payments: kept for seven years, because tax law requires it.
Your rights
Wherever you are, you can ask for a copy of what I hold about you, ask for it to be corrected, or ask for it to be deleted. I'll respond within 30 days, and sooner in practice.
If you are in California (CCPA/CPRA): you have the right to know what is collected, to have it deleted, to correct it, and to opt out of its sale or sharing. To be explicit: I do not sell or share personal information, and never have. There is nothing to opt out of. Exercising any of these rights will never result in worse service or different pricing.
If you are in the UK, EU, or Saudi Arabia (UK GDPR, GDPR, PDPL): you additionally have the right to restrict or object to processing, to data portability, and to complain to your supervisory authority. The lawful basis is consent for the newsletter, and legitimate interest for replying to an enquiry you sent me.
To exercise any of these, use the data request form below or email hello@yusufcreates.com. No account or verification hoops.
Making a request
Email hello@yusufcreates.com with the address you used, and say whether you want a copy, a correction, or deletion. I'll confirm within a couple of days and complete it within 30.
Security
Everything is served over HTTPS. Secrets live in server-side environment variables and are never sent to the browser — the build actively scans for leaked credentials and fails if it finds any. Invoices are reachable only through an unguessable link, and admin access is restricted to a single account with server-side verification on every request.
Changes
If this policy changes materially, the date at the top changes with it. I won't quietly broaden what is collected.