Privacy Policy

1. Controller

2. General information

This privacy policy explains how I process personal data when you visit this website, contact me or use one of my digital applications. I treat your data confidentially and in line with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Legal bases

4. Hosting

This website is hosted on servers operated by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Vercel processes IP addresses and server logs in order to deliver the website. A data processing agreement is in place, and the transfer to a third country is covered by the EU standard contractual clauses.

5. Server log files

When you open the website, the following data is collected automatically and stored temporarily in server log files:

• Anonymised IP address
• Date and time of access
• URL requested
• Referrer URL
• User agent (browser and operating system)

This data is neither merged with other sources nor passed on to third parties. Retention period: 30 days at most.

6. SSL/TLS encryption

This website uses SSL/TLS encryption throughout. You can recognise an encrypted connection by the padlock icon in your browser's address bar and by the https:// prefix.

7. Cookies

This website sets technically necessary cookies (session management, security). It also uses the analytics software Microsoft Clarity — see section 11. The cookie banner lets you decide whether analytics stays active. Your choice is stored locally in your browser and you can change it at any time via “Cookie-Einstellungen” in the website footer or in section 11 below.

8. Contacting me

If you contact me by email, your details are stored for the purpose of handling your enquiry. This data is not passed on without your consent. Legal basis: Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR.

9. Social media integration via Postiz

In the background, this website runs a self-hosted instance of the open-source software Postiz (postiz.daaniyalkhan.com) to schedule and publish my own social media posts on platforms such as Instagram, LinkedIn, Threads and Facebook.

What data is processed?

• OAuth access tokens for the connected social media accounts
• Profile metadata (username, account ID, profile picture URL)
• Content of scheduled and published posts (text, images, video)
• Publication timestamps and status information
• Analytics data for published posts (reach, likes, comments)

Who has access?

Only the controller (Daaniyal Khan). The Postiz instance runs exclusively on my own infrastructure (Hetzner Cloud, Frankfurt, Germany) and is not publicly accessible. No data is passed on to third parties.

Whose data is affected?

Only social media profiles belonging to Daaniyal Khan and profiles where Daaniyal Khan acts as an authorised administrator (for example DFC profiles in the course of my work). No third-party data (followers, people who comment, other users) is processed beyond the engagement metrics that Meta, LinkedIn and X make publicly available.

Transfer to platforms

When I schedule or publish a post through Postiz, the content is transmitted to the respective platform (Meta Platforms Ireland Limited for Instagram, Facebook and Threads; LinkedIn Ireland Unlimited Company for LinkedIn). The privacy terms of that platform apply in addition.

Retention

OAuth tokens are stored for as long as the connection to the platform is active. Post content and analytics data are kept for 12 months and then deleted automatically. On request, deletion happens immediately — see Data deletion.

10. Third-party services

11. Microsoft Clarity

To improve usability I use Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA). It records sessions — mouse movements and clicks — in anonymised form.

The legal basis is your consent (Art. 6(1)(a) GDPR). The transfer to the USA is covered by the EU standard contractual clauses. You can change your choice at any time via “Cookie-Einstellungen” in the website footer, or reset it directly here:

Reset cookie choice

12. YouTube (videos)

This website embeds videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EEA).

The videos do not load automatically. As long as you do not click, no connection to Google is established. You first see a placeholder that is served entirely from this website. Only your click loads the video, and it does so in extended privacy mode via youtube-nocookie.com.

With that click, your IP address and information about your device and browser are transmitted to Google. If you are logged into a Google account at the same time, Google can associate the request with that account. I have no influence on Google's further processing.

The legal basis is your consent, given through the active click on the placeholder (Art. 6(1)(a) GDPR). The transfer to the USA is based on the EU standard contractual clauses. Details can be found in Google's privacy policy.

13. Use of artificial intelligence

This website does not process your data with AI systems: there is no chatbot, and what you submit (for example when contacting me) is not sent to any AI service.

Text and illustrations on this website are created using generative AI. Every piece of content is editorially reviewed before publication, and Daaniyal Khan holds editorial responsibility for it. How an article is produced, which sources are checked and how this relates to Art. 50 of the AI Act (Regulation (EU) 2024/1689) is set out on the page Redaktion, Quellen und KI-Einsatz (German).

14. Your rights as a data subject

You have the right at any time to:

• Access the data I hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure, the “right to be forgotten” (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent you have already given (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

An informal message to privacy@khans.ai is enough to exercise these rights.

15. Data deletion

Instructions for immediately deleting all data processed via Postiz and the Meta APIs are on the separate Data deletion page.

16. Changes to this privacy policy

This privacy policy is updated whenever the technical procedures or the legal framework change. The current version date is shown at the top.