Privacy Policy

This Privacy Policy describes how Foisal ("we", "us", or "our") handles personal information when you visit https://foisal.org, create an account, purchase products or services, subscribe to updates, or use site features such as the portfolio assistant.

By using the site, you agree to the collection and use of information as described here. If you do not agree, please do not use the site.

Foisal is a personal portfolio and client platform operated by Foisal. The application provides:

• A public marketing site where visitors can browse projects, blog posts, digital products, and professional service offerings.
• User accounts so clients can sign in, manage purchases and service orders, view wallet balances and transaction history, and exchange messages related to orders.
• Optional sign-in with Google or Discord, in addition to email and password registration.
• Cryptocurrency wallet top-ups (via third-party payment processors) used as site credits for product and service checkout.
• An optional AI-powered portfolio assistant that answers questions about the site, projects, services, and products.
• A newsletter signup for occasional updates about new content and offerings.

We may collect the following categories of information depending on how you interact with the site:

• Account information such as your name, email address, profile picture (when provided by an OAuth provider), authentication provider (email, Google, or Discord), and internal account identifiers when you sign up or sign in.
• Transaction and order details when you purchase products, request services, fund your wallet, or complete checkout with site credits.
• Communication content you send through dashboard messages, service order threads, or email.
• Newsletter subscription data, including your email address and signup source.
• Messages and optional page context you submit to the portfolio assistant, which are processed by third-party AI providers to generate replies. Conversation context may be sent with each request during your session but is not stored in our database.
• Technical and usage data such as IP address, browser type, device information, pages viewed, and cookies or similar technologies used for session management, authentication, and security.
• Analytics data collected through tools such as Microsoft Clarity when enabled, which may include interaction patterns and session recordings used to improve the site.

Foisal offers optional "Sign in with Google" so you can create or access your account without a separate password. Google OAuth is used solely for authentication and account management on this site.

When you choose Google Sign-In, we request the following OAuth scopes:

• openid — to verify your identity through Google's OpenID Connect flow.
• email (https://www.googleapis.com/auth/userinfo.email) — to receive your Google account email address so we can create or match your account and send transactional messages.
• profile (https://www.googleapis.com/auth/userinfo.profile) — to receive your display name and profile picture for your account profile on this site.

Information received from Google is used only to:

• Authenticate you and maintain your signed-in session.
• Create or link your account on this site using your verified Google email.
• Display your name and avatar in your user profile and dashboard where applicable.
• Send account-related communications such as order updates, security notices, and support replies.

Foisal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not use Google user data to serve advertisements, sell data to third parties, determine creditworthiness, or create advertising profiles. We do not use Google user data to train generalized artificial intelligence or machine learning models.

We do not read your Gmail, Google Drive, Calendar, Contacts, or other Google Workspace data. We only receive the basic profile information described above during sign-in.

You can review Google's policy at https://developers.google.com/terms/api-services-user-data-policy. To revoke Foisal's access to your Google account, visit your Google Account permissions at https://myaccount.google.com/permissions and remove access for this application.

If you sign in with Discord, we receive your Discord user identifier, username, email address (when available and verified on Discord), and avatar URL. This information is used only to authenticate you and maintain your account on this site, under the same principles described for Google Sign-In.

We use collected information to operate and improve the site, including to:

• Provide, authenticate, and maintain user accounts.
• Process purchases, service orders, deposits, and related transactions.
• Send transactional messages, order updates, and (where permitted) marketing or newsletter content.
• Respond to inquiries and provide customer support.
• Power site features such as the portfolio assistant and personalized dashboard experiences.
• Monitor performance, prevent abuse, enforce our Terms of Service, and protect the security of the site.
• Comply with legal obligations and resolve disputes.

The portfolio assistant sends your messages (and optional page context you are viewing) to Google Gemini or other configured AI providers to generate responses. This data is processed to answer your question in real time.

We do not use Google Sign-In profile data or your Google account contents to train AI models. Assistant messages are processed in real time and are not stored in our database.

Do not submit sensitive personal, financial, or confidential information to the assistant. AI responses are informational only and may be incomplete or inaccurate.

We may share information with service providers that help us run the site. These providers process data on our behalf under contractual safeguards and only as needed to deliver their service:

• Hosting and infrastructure providers that store and serve the website and API.
• Email delivery services for transactional and account-related messages.
• Cryptocurrency payment processors (such as NOWPayments) when you fund your wallet balance.
• Google (for optional Sign in with Google authentication).
• Discord (for optional Sign in with Discord authentication).
• Google Gemini and related AI infrastructure for the portfolio assistant.
• Analytics providers such as Microsoft Clarity when enabled.

We use cookies and similar technologies to keep you signed in, remember preferences, maintain OAuth state during sign-in, and protect against abuse. Session cookies include authentication tokens stored as httpOnly cookies.

You can control cookies through your browser settings, but disabling them may prevent you from signing in or using certain site functionality.

We retain personal information for as long as needed to provide the services you request, comply with legal obligations, resolve disputes, and enforce our agreements.

Account information is kept while your account remains active. If you request account deletion, we will delete or anonymize personal information within a reasonable period, except where retention is required by law or for legitimate business records (such as completed transaction records).

OAuth provider identifiers (Google ID, Discord ID) are stored to link your account on future sign-ins until you delete your account or revoke this app's access in your Google or Discord account settings.

Depending on your location, you may have rights to access, correct, delete, or restrict certain processing of your personal information, or to object to processing and request data portability.

To make a privacy-related request — including account deletion or export — contact us at [email protected]. We may need to verify your identity before responding.

You can stop receiving marketing or newsletter emails by contacting us at [email protected].

We implement reasonable technical and organizational measures designed to protect personal information, including encrypted connections (HTTPS), hashed passwords for email accounts, httpOnly session cookies, and access controls on administrative systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your information may be processed in countries other than your own, including where our hosting providers and third-party services operate. Where required, we rely on appropriate safeguards for cross-border transfers.

The site is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the latest revision. Continued use of the site after changes become effective constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, Google Sign-In data practices, or our data handling, email [email protected].