Who I am
This website, muddaa.com, is run by me, Muddashir Siddique (“Muddaa”, “I”, “me”), an individual based in the United Arab Emirates. I decide how and why your personal information is used here, which makes me its “controller” in data protection terms.
My companies, Gridwork, Momentem, Leila and Onshow, are separate businesses with their own websites and privacy policies. This policy covers this site only.
For anything in this policy, email hello@muddaa.com.
The short version
I collect what you type into a form, the basic technical data that keeps the site running and secure, and analytics only if you click “Accept all”.
I use it to give you what you asked for: a free guide, email updates, a reply or a call.
I never sell your information, and I don’t use it for advertising.
You can unsubscribe, or ask me to show, correct or delete your information, at any time.
What I collect and why
Here is everything the site collects, grouped by what you’re doing. You never have to give me anything, but I need at least your name and email to open a guide or book a call. Your phone number is always optional.
- Free guides
- To open a free guide, prompt pack or template, the form asks for your name, email and country, and your phone number if you want to add it. I store them with the resource you opened, so I can give you access and see which resources people find useful. The form also has an optional box for my email updates, and I only add you to them if you tick it.
- Email updates
- If you sign up with just your email, I store it to send you updates. Every email has an unsubscribe link, or you can email me to stop them.
- Booking a call
- I collect your name, email, topic, the time you choose and any notes, plus your phone number and country if you add them. Cal.com creates the booking, emails you the confirmation and adds the call to my Google Calendar. I keep a copy so I can prepare and follow up.
- Form alerts
- When you send a form, the details may also be emailed to me, so I can respond quickly.
- Emails to me
- If you email me, I get your address and whatever you write, and I use them to reply.
- Security
- When you send a form, the server turns your IP address into a one-way, salted code (a “hash”) to block spam and repeated submissions. I don’t store the IP address itself, and I delete these codes within 7 days. My host, Vercel, also logs each request (IP address, browser type and the page requested) to deliver the site and keep it secure.
- Analytics
- Only if you click “Accept all”. Google Analytics records the pages visited, your approximate location (city or country), your device and browser, and a few actions, such as clicking to join the community, sending a guide form, subscribing or booking a call. It doesn’t receive your name, email or phone number, and I only use it to see what people read and use overall.
- On your device
- Your browser remembers your cookie choice, and keeps a copy of your free-guide form details so the guides stay unlocked. That copy stays on your device, and “Not you?” clears it. After you book a call, a short-lived cookie shows your confirmation page. The cookie policy has the details.
My legal grounds
Data protection laws only let me use your information for a valid reason, called a legal ground. In the GDPR’s terms, these are the ones I rely on.
The UAE’s data protection law works in a similar way, based mainly on your consent and on what’s needed to deal with a request you make.
- Consent
- Email updates, including when you tick the box on the free-guide form, and analytics cookies. You can withdraw consent at any time by unsubscribing or changing your cookie choice. That doesn’t affect what I did before.
- Your request
- Giving you a free guide, booking and holding your call, and replying to your messages. These are steps you ask me to take.
- Legitimate interests
- Keeping the site secure and free of spam, keeping sensible records of calls and messages, and seeing which resources are useful. I only rely on this where it doesn’t override your rights, and you can object to it.
- Legal duties
- Keeping records the law requires, and answering lawful requests from authorities.
Who helps me run the site
I use a few service providers, listed below. They handle your information only to provide their service to me, under terms that require them to protect it.
Apart from them, I only share your information if the law requires it, or with a professional adviser, such as a lawyer or accountant, who must keep it confidential. I don’t pass your details to my companies unless you ask me to introduce you.
- Vercel
- Hosts the website and its forms. Based in the United States.
- Neon
- Hosts the database that stores form submissions, on servers in Frankfurt, Germany. Based in the United States.
- Cal.com
- Handles bookings: creates your booking, emails you the confirmation and lets you reschedule or cancel. Based in the United States.
- Google Calendar holds my calendar, including your booking. Google Analytics runs only if you accept analytics cookies. Based in the United States.
- Resend
- Delivers the site’s emails, such as form alerts to me. Based in the United States.
- Email provider
- Stores the emails you send me and the site’s form alerts.
Where your data goes
I’m based in the UAE, and my providers store and process data in other countries, mainly the United States and the European Union. So your information may be handled outside the country where you live.
Where the GDPR or UK GDPR applies, these transfers rely on recognised safeguards: the EU–US Data Privacy Framework and its UK extension for providers certified under it, or the standard contractual clauses in a provider’s data processing terms.
For transfers out of the UAE, I rely on contract terms that commit providers to protect your data, or on the transfer being needed to give you what you asked for.
If you’d like more detail, or a copy of the safeguards, email me.
How long I keep it
I keep information only while I need it, then delete it or make it anonymous. I may keep something longer if the law requires it, or to deal with a dispute.
- Email updates and free guides
- Until you unsubscribe or ask me to delete your details. After that I keep only your email address on a do-not-email list, so you aren’t added back by mistake.
- Bookings
- Up to 2 years after the call.
- Emails and form alerts
- Up to 2 years after our last exchange, unless we’re working together and I need them for longer.
- Security codes
- Deleted within 7 days.
- Server logs
- Kept briefly by Vercel, under its own retention rules.
- Analytics
- Google deletes detailed analytics data after 14 months. Reports that only show totals, such as visits per month, don’t identify you and may be kept longer.
- On your device
- Until you clear this site’s data in your browser, or click “Not you?”.
Your rights
Depending on where you live, including under the GDPR, the UK GDPR and UAE law, you have the rights below.
To use any of them, email hello@muddaa.com. I may ask you to confirm it’s you. I’ll reply within one month, and it’s free. Some rights have limits, for example where the law requires me to keep something. If one applies, I’ll explain.
I don’t make decisions about you based only on automated processing.
- Access
- Ask what I hold about you, and get a copy.
- Correction
- Ask me to fix anything wrong or incomplete.
- Deletion
- Ask me to delete your information.
- Restriction
- Ask me to pause using it, for example while I check it’s accurate.
- Objection
- Object to how I use it. You can always stop email updates.
- Portability
- Get the information you gave me in a common format, or have it sent to another service.
- Consent
- Withdraw your consent at any time.
Complaints
If you’re unhappy with how I’ve handled your information, please tell me first, so I can put it right.
You can also complain to a data protection regulator: the UAE Data Office in the UAE, the data protection authority where you live or work in the EU, or the Information Commissioner’s Office (ICO) in the UK.
Keeping it safe
The site uses HTTPS, the database is encrypted, and only I and the providers above can access your information. I protect my accounts with strong passwords and two-step verification.
No website is perfectly secure. If a breach puts your information at risk, I’ll tell you and the relevant regulator, as the law requires.
Other sites and platforms
The community is a WhatsApp group, which WhatsApp (part of Meta) runs under its own terms and privacy policy. In a WhatsApp group, the admins, including me, and the other members can generally see your phone number, your profile name and, depending on your privacy settings, your profile photo, as well as everything you post. Only join if you’re comfortable with that.
I don’t copy members’ numbers from the group into my own contact lists, database or email updates. If you message me directly, I’ll have your number in that chat, like any WhatsApp conversation. You can leave the group at any time.
The site also links to LinkedIn, Instagram, TikTok, X and my companies’ websites, each with its own privacy policy. The share and add-to-calendar buttons are plain links: nothing is sent to those services unless you click one.
If I embed videos, the video provider may collect data once a video loads. The cookie policy explains more.
Children
This site is for adults. It isn’t meant for anyone under 18, and I don’t knowingly collect children’s information. If you think a child has sent me their details, email me and I’ll delete them.
Changes to this policy
When I change how I handle your information, I’ll update this policy and the date at the top. If a change is significant, I’ll also tell subscribers by email.
If I start selling courses or cohorts, I’ll update this policy before launch to cover payments.