01 / Purposes
What is collected, and why.
Project inquiries: when you submit the project form, Nullstar receives the details you enter — which may include your name, project email, WhatsApp number, company, business context, budget, and timeline — solely to assess and respond to your project inquiry. Attribution context such as as the landing page, referrer, and UTM parameters travels with a form submission so Nullstar can tell which content produced the inquiry; those UTM and referrer fields are stripped and never stored unless the relevant consent allowed them. Newsletter: your address is stored to deliver the newsletter you asked for. Consent-aware analytics: cookieless first-party events measure page and outcome counts without names, emails, phones, message content, or raw IP addresses. Security: spam protection (Cloudflare Turnstile), rate limiting keyed on a daily-rotated hash of your IP — the raw address is never written to storage — and signed provider webhooks.
02 / Consent choices
Essential stays on. Everything else waits for yes.
Essential processing — security, form delivery, and fulfilling requests you make — runs always-on because the site cannot function without it. Analytics and marketing (newsletter plus attribution joining) are independent opt-ins controlled from the consent banner and its Customize panel, recorded with a versioned receipt, and withdrawable at any time. Declining analytics removes the stored anonymous identifier and stops event collection; every declined choice still leaves the whole site usable.
03 / AI assistant
The chat runs on Cloudflare Workers AI.
The website assistant is served by Cloudflare Workers AI running the open-weight model @cf/openai/gpt-oss-20b. A conversation keeps only its bounded chat context, capped at twelve messages, in a session-scoped store that is purged after at most 24 hours. Chat content is not used to train models. The assistant answers from this site's published pages only: it cannot browse arbitrary URLs, submit forms, send email, or touch inquiry, newsletter, or analytics records.
04 / Public data connector
Assistants may search public pages, nothing else.
A read-only Model Context Protocol (MCP) endpoint lets external assistants such as ChatGPT or Codex run search and fetch over Nullstar's published portfolio content. The connector exposes public pages only — no personal records, inquiry data, newsletter data, or analytics — and supports no state-changing tools.
05 / Processors
Who touches the data.
Cloudflare provides hosting, the D1 database, Workers AI, and Queues for the site and its API. Resend delivers transactional email — inquiry notifications, newsletter confirmations, and privacy-request verifications — under webhook signatures so delivery events can be trusted. An organization-enrichment processor category exists in the architecture for company-level visit context, but it is disabled by default and no provider is enabled today. No other third-party processors receive this website's data.
06 / Retention
Every class of data has a clock.
AI chat sessions: purged after at most 24 hours. Analytics events: expire after 90 days, or immediately on consent withdrawal. Organization-level visit rows: 30 days. Delivered email-outbox rows: purged 30 days after sending. Provider webhook records: 90 days. Newsletter confirmation links stop working after 24 hours and their tokens are cleared shortly afterwards. Hashed IP rate-limit keys roll over daily, so they survive at most about two days. Inquiry records: kept while the working relationship and accounting require — deletion happens on request, and the final legal retention schedule is being confirmed. Completed or cancelled privacy requests themselves are purged after 90 days. A daily automated sweep enforces these windows and logs only row counts.
07 / International transfers
Where processing happens.
Nullstar operates from Saudi Arabia, but Cloudflare and Resend may process data in regions outside it, including the United States and Europe. The review of the appropriate cross-border transfer basis under Saudi PDPL is being completed and will be reflected here.
08 / Your rights
Export or delete everything tied to your address.
You can request a machine-readable export of all records tied to your email address — inquiries, newsletter subscription, and consent receipts — or ask for their deletion, where inquiry payloads are redacted while their reference and timestamps stay for accounting. Requests go through the privacy API (POST /api/privacy/request with a type of export or deletion and your address); Nullstar then emails a confirmation link bound to that address, valid for 24 hours, and acts only after you click it. Responses never reveal whether an address has data. If you prefer a human path, use the contact form and write “privacy request” in the problem field.