Last updated: August 22, 2026 (chat free-tier scale and privacy filters)
This Privacy Policy explains how I, Md Shahabub Alam, collect, use, and protect your personal information when you visit my portfolio website (https://www.shahabub.com) or interact with the following social media presences operated by the same provider (see section 2 and the Impressum):
The Nabid In Motion Study Hub (nabidinmotion.com) is operated by the same provider but has its own privacy policy at nabidinmotion.com/privacy.html. That document covers Study Hub-specific processing such as browser local storage for learning progress. This portfolio Privacy Policy does not replace it.
I am committed to protecting your privacy. This policy is designed to meet the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws.
The data controller (Art. 4(7) GDPR) responsible for processing your personal data across this website and for the management of the social media presences listed in section 1 is:
Md Shahabub AlamThe postal address above is a paid mailbox (Zustelladresse) used for formal delivery and controller contact under Art. 13 GDPR. It is not my registered Gewerbe seat and must not be used for tax or banking correspondence. Details are in the Impressum.
I operate as a registered sole-trader business (Einzelunternehmen / Gewerbe) at Bezirksamt Mitte von Berlin, Ordnungsamt Mitte (trade office), and as a small-business operator under § 19 UStG (Kleinunternehmerregelung), where applicable tax requirements are met. Registered activities and other statutory provider information are published in the Impressum, which forms part of this Privacy Policy by reference.
This website does not include a contact form. If you email me at contact@shahabub.com, your message is processed by your email provider and by Google (Gmail) as the host of my inbox. Google acts as an independent controller for mailbox data under its own Privacy Policy. I process the content of emails you send me only to respond to your inquiry. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in answering professional inquiries. You may also contact me via LinkedIn. In that case LinkedIn Ireland Unlimited Company / Microsoft's terms and privacy policy apply to the platform side of the conversation.
This website includes an interactive chatbot that allows you to ask questions about my portfolio, including projects, experience, skills, publications, and certifications. When you use the chatbot, the following information is processed:
Purpose: The purpose of processing your chat messages is to provide you with relevant information about my portfolio and answer your questions. The chatbot uses artificial intelligence to understand your queries and generate responses based on my portfolio data.
Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Processing your chat messages is necessary for my legitimate interest in providing an interactive way for visitors to learn about my portfolio. When you use the chatbot, you initiate the interaction and have a reasonable expectation that your messages will be processed to generate responses. I have conducted a balancing test and determined that my legitimate interest in providing this interactive service does not override your fundamental rights and freedoms, as the processing is limited to what is necessary to answer your questions, conversations are not stored permanently, and you can stop using the chatbot at any time.
Data storage: Your chat conversations are not persisted on my servers. Chat messages are processed in real-time to generate responses and the message content itself is not written to any persistent application log by me. Minimal error metadata (such as HTTP status codes and error categories, without your message content) may be captured by the hosting provider's standard server logs for debugging purposes (see section 4.1). To find relevant portfolio content, your message is matched against a knowledge base on my server using keyword search (no third-party embedding service). To generate the reply text, your message and retrieved context are sent to Groq, as described in section 4.2 below. Groq acts as a data processor and may temporarily process your data according to its privacy policy and Data Processing Addendum. I do not retain copies of your conversations on my servers.
Retention: Chat messages are not retained on my servers after the response is generated. The chat history shown in the chat window is kept only in your browser's memory for the duration of the session and is cleared when you close the chat or refresh the page. Groq may retain logs for security and troubleshooting purposes for up to 30 days, as specified in its privacy policy (see section 4.2).
Rate limiting: To prevent abuse of the chatbot and protect a free third-party AI quota, your IP address is briefly processed and stored only as a cryptographic hash (SHA-256, pseudonymized). Limits are about 5 messages per minute, 25 per hour, and 8 Ask messages per day per visitor, with a short pause between sends. When a shared Redis store (Upstash) is configured, those hashed counters apply across all servers. Otherwise they are held in short-lived server memory per instance. The chat UI shows how many daily messages remain. Repeated hard policy violations (secrets, jailbreaks, privacy probes) or repeated identical messages can trigger a temporary cooldown of about 10 minutes. Soft off-topic refuses do not pause chat. A shared process cap and a small daily budget for AI completions also protect the service under load. Most answers are generated locally from portfolio data. The third-party AI is used only for selected on-topic questions while budget remains. Each message is limited to about 500 characters and request bodies are size-capped so large pasted dumps are rejected without calling the AI provider. Off-topic, privacy-probing, or gibberish asks are refused without calling the AI provider. Hashes are discarded when each window expires. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in protecting the service from abuse.
Right to object: You have the right to object to the processing of your chat messages. If you object, you can simply stop using the chatbot. You are not required to use the chatbot to access information on this website, as all portfolio information is also available through the regular website pages.
AI transparency (EU AI Act): From 2 August 2026, Art. 50 of Regulation (EU) 2024/1689 requires clear notice when you interact with an AI system. The chatbot interface discloses at the start of the interaction that you are interacting with an AI system (not a human). Replies are generated automatically from my portfolio knowledge base. A third-party language model (Groq) is used only for some on-topic questions while free quota remains. The chatbot does not provide legal, medical, or other professional advice.
Please do not submit sensitive personal data (e.g. health, financial details, or other special categories of data under Article 9 GDPR) in the chat. The chatbot is intended only for general questions about my portfolio. Requests that try to extract secrets, private contact details, or to override the assistant rules are refused. Replies are filtered before they are shown.
This portfolio includes project case study pages (for example /projects/legal-medical-rag) with optional try-it widgets. When you use a demo, the following may be processed:
Purpose: To let visitors explore simplified portfolio demos on curated or synthetic data. This is separate from the portfolio chatbot (section 3.2).
Legal basis: Legitimate interest (Article 6(1)(f) GDPR). You choose to run a demo. Processing is limited to what is needed to return the demo result.
How requests are routed: Your browser calls same-origin API routes on this website (for example /api/demos/…). Those routes forward the demo payload to Cloudflare Workers I operate for portfolio demos (see section 4.3). The data platform demo is answered on this website from frozen sample data and does not call an external Worker.
Data storage: I do not persist demo inputs or outputs in an application database on this site. Demo API routes do not write your question or sample choices to persistent logs beyond what the hosting provider may record in standard server logs (section 4.1). For the legal / medical RAG demo, the Worker is designed to answer from a fixed corpus without storing your query after the response. Recent demo questions may be kept in your browser's localStorage on your device only (section 8.3).
Rate limiting: Demo API routes apply the same pseudonymous IP hashing as the chatbot (SHA-256 in server memory, scoped per demo type). Limit: 20 demo requests per minute per IP. Hashes expire when the window ends.
AI transparency: Some demos use retrieval or language models on sample corpora. They are portfolio illustrations only. They do not provide legal, medical, financial, inventory, or other professional advice. Do not submit sensitive personal data (Article 9 GDPR) or real patient, client, or business-confidential information into any demo field.
Source access requests: Case study pages may offer a mailto link to request full project source. That action opens your email client locally. I only receive data you choose to send by email (section 3.1).
In addition to this website, I operate two public social media presences operated by the same provider (see section 2 and the Impressum). They serve to share instructional, technical, and data-science content and to interact with viewers and followers.
On each platform, the platform operator (Google or Meta) is the primary responsible party for collection and processing of user data, cookies, and cross-border transfers. As the channel / profile administrator, I receive only aggregated, anonymized analytics from the platform and process limited public interaction data (e.g. usernames of commenters / followers). For YouTube and (where applicable) Facebook insights, the platform may treat the channel/page administrator and itself as joint controllers (Art. 26 GDPR) under the principles of the ECJ's "Wirtschaftsakademie" ruling (C-210/16). In that case, the platform acts as the lead controller and provides the corresponding joint-controller arrangement.
Channel: youtube.com/@NabidInMotion. Platform operator (and primary controller): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See Google's Privacy Policy.
Data processing by me (YouTube Analytics & monetization): I use the built-in YouTube Analytics dashboard, which provides aggregated statistical reports (general demographics, view metrics, geographic data, engagement). I cannot trace these aggregated statistics back to identifiable individuals. As a YouTube Partner Program participant, I receive monetization payouts from Google; the underlying viewer/ad data is processed by Google, not by me.
Direct interaction: If you leave a public comment, like a video, or subscribe, your platform username and public interactions are visible to me and to other users. I process this only to interact with the community.
Profile: facebook.com/shahabubnabid. Platform operator (and primary controller): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. See Meta's Privacy Policy.
Data processing by me: I receive aggregated, anonymized insights from Meta about the reach and engagement of my public posts/videos and (where applicable) monetization data via Facebook's Content Monetization / In-Stream Ads programs. I cannot identify individual users from these aggregated insights. The underlying viewer/ad data (cookies, device identifiers, IP addresses) is collected and processed by Meta, not by me.
Direct interaction: If you send me a friend request, follow my public posts, comment, react, or message me, your platform username and public interactions are visible to me. I process this only to interact with you and to operate the profile.
Legal basis (both platforms): Legitimate interest (Art. 6(1)(f) GDPR) in operating my professional social-media presence and interacting with my audience. Where joint controllership with the platform applies, the platform also relies on its own legal bases for its share of the processing.
Right to object: You can object to my processing at any time (see contact in section 12). To exercise rights regarding data processed by the platforms themselves (cookies, tracking, account data, advertising profiles), use the privacy controls and settings within your Google or Meta account, or contact those companies directly.
This website is hosted on Vercel Inc. (Hobby / free tier) by a company based in the United States. I use Vercel's hosting service to deploy and deliver this website. Under Vercel's terms, their Data Processing Addendum (Art. 28 GDPR processor agreement) applies only to customers on Pro or Enterprise plans. On the Hobby plan I do not have a separate Art. 28 DPA with Vercel.
To the extent that hosting-related technical data (e.g. server logs, IP addresses) is processed, Vercel may act as an independent controller for such "Service-Generated Data" and processes it under its own Privacy Policy, not as my processor under a DPA. I instruct Vercel only insofar as I choose to deploy this site on their platform; I do not control their internal logging systems.
When you visit this website, certain technical information is automatically collected by the hosting provider (Vercel) in server logs. This includes:
Purpose: This data is collected automatically for technical reasons necessary for the operation and security of the website, including:
Legal basis: Legitimate interest (Article 6(1)(f) GDPR). The collection of this technical data is necessary for the legitimate interest of ensuring the security, stability, and proper functioning of the website. This processing is essential for the website to operate and cannot be avoided. I have conducted a balancing test and determined that my legitimate interest in maintaining website security and functionality does not override your fundamental rights and freedoms, as the data collection is limited to what is technically necessary and the data is not used for profiling or marketing purposes.
Retention: Server logs are typically retained for a limited period (usually 30-90 days) by the hosting provider for security and technical purposes, after which they are automatically deleted. I do not have direct access to or control over these logs.
IP Address Anonymization: While I cannot directly control Vercel's server logs, I do not use any analytics services that would process IP addresses for tracking or profiling purposes. The IP addresses collected in server logs are used solely for technical and security purposes.
Right to object: You have the right to object to the processing of your IP address. However, please note that the collection of IP addresses in server logs is technically necessary for the website to function. If you object, you may not be able to access this website, as IP addresses are required for the technical delivery of web content.
Your data, including IP addresses, may be transferred to and processed in the United States and other countries outside the European Economic Area (EEA). Vercel participates in the EU-U.S. Data Privacy Framework (EU-U.S. DPF) for certain transfers; see their privacy policy for details. Because I am on the Hobby plan, I rely on Vercel's published privacy and security measures as an independent controller, not on a processor DPA between us.
In its judgment of 16 July 2020 (C-311/18, Schrems II), the European Court of Justice confirmed that data transferred to third countries may be subject to access by local authorities. Further information on Vercel's data handling can be found in their Privacy Policy. I do not have direct access to or control over Vercel's server logs.
I use Groq to provide AI-powered responses in the portfolio chatbot mentioned in section 3.2. When you use the chatbot, your chat messages are sent to Groq to generate AI responses. Groq acts as a data processor (Article 4(8) GDPR) on my behalf for this purpose. Groq is a service provided by a company based in the United States. Your data is transferred to and processed in the United States.
Groq has implemented appropriate safeguards to protect your data, including:
Groq processes your chat messages solely to generate responses and does not use your data for its own purposes beyond providing the service. According to Groq's privacy policy, customer data processed through their Cloud Services (including APIs) is governed by the Groq Services Agreement and Data Processing Addendum.
Please refer to Groq's Privacy Policy and Groq's Legal Documentation for more information. The Data Processing Addendum is available through the Groq console.
Several portfolio demos are implemented as Cloudflare Workers (serverless functions on Cloudflare's edge network). When you use a demo that calls /api/demos/…, the demo payload is forwarded from this website to the corresponding Worker so the demo can run. Cloudflare Inc. (United States) provides the infrastructure. Request data may be processed in the United States or other Cloudflare locations.
Cloudflare may process technical data (such as IP addresses and request metadata) under its own terms as an infrastructure provider. I do not operate a separate Art. 28 processor agreement with Cloudflare on the current free Workers plan. Cloudflare publishes a Data Processing Addendum and Standard Contractual Clauses for customers who contract for those services. See Cloudflare's Privacy Policy and Cloudflare's Customer DPA.
Demo Workers are configured for portfolio use on sample data. I do not use them to build advertising profiles or to sell visitor data.
Under Article 28 GDPR, I must have a Data Processing Agreement (DPA) with each service provider that processes personal data on my behalf as a processor. Where a provider acts as an independent controller (e.g. Vercel Hobby hosting logs), a processor DPA is not applicable; instead, their own privacy policy governs that processing (see section 4.1).
The following providers process personal data on my behalf under DPAs (or equivalent addenda incorporated into their terms):
Not covered by a processor DPA on my current plans:
Where DPAs apply, they include appropriate safeguards for transfers outside the European Economic Area (e.g. Standard Contractual Clauses or participation in the EU-U.S. Data Privacy Framework), as described in each provider's documentation.
Under GDPR, you have the following rights:
To exercise these rights, please contact me at contact@shahabub.com.
I implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.
This website uses localStorage (a browser storage mechanism) to store essential technical preferences. This site does not set its own cookies. If you follow links to third-party sites (for example GitHub, LinkedIn, YouTube, or Facebook), those sites may set cookies under their own policies.
The website stores your theme preference (light/dark mode) in your browser's localStorage. This is necessary for the website to remember your display preference and provide a consistent user experience.
Data stored: Theme preference (e.g., "light", "dark", or "system")
Purpose: To remember your display preference so the website appears in your preferred theme on subsequent visits.
Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Storing your theme preference is necessary for my legitimate interest in providing a user-friendly website experience. This processing is minimal, does not involve personal data beyond a technical preference, and enhances your user experience.
Retention: Your theme preference is stored indefinitely in your browser until you clear your browser data or change the preference. You can delete this data at any time by clearing your browser's localStorage.
No consent required: Under GDPR, this type of storage for essential technical purposes does not require consent, as it is strictly necessary for the service you have requested (displaying the website in your preferred theme).
The hosting provider (Vercel) does not set cookies on your device on my behalf for this website. Technically necessary processing (such as server-side logging) takes place without this site placing cookies in your browser.
This website is a Progressive Web App (PWA) and registers a service worker (/sw.js) in your browser. The service worker uses your browser's Cache API to store favicon images only. Page HTML and application scripts are always loaded from the network and are not cached by the service worker.
Data stored: Cached copies of favicon image files served by this website. No page HTML, no personal data, no tracking identifiers. The service worker itself does not set cookies.
Purpose: Faster display of site icons and limited offline availability of those icons (PWA support).
Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in providing a fast, reliable user experience. Because this storage is strictly necessary for the requested service (the PWA functionality the user accesses) and contains no personal data, no consent is required under § 25 (2) TDDDG (formerly TTDSG) / Art. 5(3) ePrivacy Directive.
Retention: Cached favicon assets remain in your browser until they are evicted by your browser, replaced by a newer version of the service worker, or you clear your browser data. You can remove the service worker and its cached data at any time via your browser's developer tools (Application tab → Service Workers / Cache Storage) or by clearing site data.
Some project demo widgets store small amounts of data in your browser's localStorage on your device only:
Purpose: Convenience on repeat visits. This data never leaves your browser unless you clear site data.
Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in a usable demo experience, or your initiation of the demo interaction.
Retention: Until you clear localStorage or site data for this website. Demo question history is not synced to my servers.
This website does not use tracking cookies, analytics cookies, or any other tracking technologies that require consent under GDPR. No personal data is collected for analytics, marketing, or profiling purposes. This site does not set its own cookies for those purposes.
You can manage or delete data stored in localStorage at any time through your browser settings:
Note: Clearing localStorage will reset your theme preference to the default setting and remove demo question history stored on your device.
I do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement.
The supervisory authority responsible for me is:
Die Berliner Beauftragte für Datenschutz und InformationsfreiheitI may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised.
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact me:
Md Shahabub Alam