Privacy Policy
This is a one-person site and it collects very little. Nothing analytics-related is stored until you agree to it, wherever in the world you are. Advertising and personalisation stay switched off unless you actively turn them on. If you refuse, the site behaves exactly the same. Last updated 12 August 2026.
Quick answer
Google Analytics runs here, but only after you agree to it on the banner - and the banner is shown to everyone, not only to visitors in countries whose law demands it. Refusing is a real refusal: no cookie is created, nothing identifying you is stored or sent, and any cookie already there is deleted. No advertising pixels are active. No newsletter list. The only personal data I ever receive directly is what you type into the contact form and choose to send. You can change your mind at any time from Cookie settings in the footer of every page.
Who is responsible
This site, shashikantshah.com.np, is run by me, Shashikant Shah, an independent consultant based in Kathmandu, Nepal. There is no company, no team and no third-party marketing department behind it. If you want anything on this page explained or acted on, email [email protected] and you will be talking to me.
What I actually collect
One thing: the contact form. When you submit it, the following is sent to my inbox.
| Field | Required | Why |
|---|---|---|
| Name | Yes | So I know who I am replying to. |
| Email address | Yes | So I can reply. My reply goes to this address and nowhere else. |
| Message | Yes | The enquiry itself. |
| Phone number | No | Only used if you ask me to call, or if email bounces. |
| Subject | No | Helps me triage. |
| Page URL | Automatic | The page you submitted from, taken from the browser referrer header. It tells me which page prompted the enquiry. Nothing more. |
The form also contains a hidden field that real visitors never see. Automated bots fill it in, humans do not, so it lets me discard spam without a CAPTCHA. If it is filled in, the submission is silently discarded and never reaches my inbox.
Cookies, analytics and your consent
This site used to run with no measurement at all. That changed on 10 August 2026: it now uses Google Analytics 4, and it asks you first. Nothing analytics-related is stored or sent until you press Accept. Pressing Reject is a real refusal, not a delay - no analytics cookie is created, no identifier is generated, and the site behaves identically. Prior consent is only legally required in some countries; it is asked for here in all of them, because a rule that only protects some visitors is not much of a rule.
The banner is my own code, served from this domain. It is not a third-party consent platform, so no outside company is told that you visited, or what you chose.
How the refusal is enforced
The Google tag is loaded in consent mode with every storage category set to denied before the tag executes, in every country. Consent is not something the page asks for and then hopes the tag respects - the tag is started in a state where it is not permitted to write anything, and only a decision from you lifts that. Seven signals are controlled:
| Signal | Default | Controlled by |
|---|---|---|
analytics_storage | Denied | The Analytics toggle |
ad_storage | Denied | The Advertising toggle |
ad_user_data | Denied | The Advertising toggle |
ad_personalization | Denied | The Advertising toggle |
personalization_storage | Denied | The Advertising toggle |
functionality_storage | Granted | Strictly necessary - stores your refusal so it can be honoured |
security_storage | Granted | Strictly necessary - abuse prevention |
While advertising consent is absent, Google's ads_data_redaction is switched on, which strips the ad-click identifier from the request rather than merely declining to store it. If you refuse, that identifier never leaves your browser.
What is actually stored on your device
| Name | Type | Set when | Lifetime | Purpose |
|---|---|---|---|---|
ss_consent_v1 | Local storage, first-party | You press a button on the banner | 12 months | Records your choice so you are not asked again on every page. Never sent to any server - it stays in your browser. This is the one item that exists even if you refuse everything, because a refusal that is not remembered cannot be honoured. |
_ga | Cookie, first-party | Only after you accept analytics | Up to 400 days (about 13 months) | Distinguishes one browser from another so two page views can be counted as one visit rather than two visitors. |
_ga_29LW6B003F | Cookie, first-party | Only after you accept analytics | Up to 400 days (about 13 months) | Holds the session state for this specific property. |
If you refuse, Google still receives a cookieless signal that a page was loaded, containing no identifier and nothing that can be linked to you or to any other visit. Google uses those to estimate aggregate totals. There is no way for me, or for Google, to turn that back into a person.
What I see in the reports
Aggregate counts, and only aggregate counts: which pages were read, roughly which country or city a visit came from, whether it was a phone or a desktop, and which site or search engine referred it. Your IP address is used by Google to derive that approximate location and is then discarded - GA4 does not store it and does not expose it to me. I cannot see who you are, I cannot see an individual person's browsing history, and there is no report in GA4 that would let me.
Google is the data processor for this. Their handling is governed by Google's privacy terms, and data may be processed on servers outside your country, including in the United States, under the transfer mechanisms Google maintains. Data collected through this property is retained for 14 months and then deleted automatically.
Change your mind
Withdrawing is as easy as giving - that is a legal requirement and it is also just correct. Cookie settings appears in the footer of every page on this site, so you never have to come back here to change your mind. The button below does the same thing: it reopens the banner with your current settings, whatever you save takes effect immediately, and refusing also deletes the analytics cookies rather than merely leaving them unused.
You can also delete the stored choice through your browser's "clear site data" control, or block cookies for this domain entirely. Either way the site keeps working.
What I deliberately do not collect
- No analytics at all unless you agree. Google Analytics 4 is the only measurement product on this site, it is loaded with every storage category denied, and it stays that way until you accept.
- No cookies before consent. Nothing is written to
document.cookieuntil you press Accept. The single item stored on refusal is your refusal itself, in local storage, so the site can honour it. - No advertising or remarketing pixels are live. No Meta Pixel, no LinkedIn Insight tag, no Google Ads conversion tag is currently installed. The advertising consent signals are wired up and default to denied so that if a Google Ads tag is ever added, it is refused by default rather than switched on behind you.
- No session recording or heatmaps. No Hotjar, no Clarity, no scroll or mouse-movement capture.
- No account creation, login, or user profiles. The site is static HTML.
- No cross-site tracking or data brokers. Nothing here builds an advertising profile of you, and no visitor data is sold or shared for anyone else's targeting.
- No mailing list. Sending me a message does not subscribe you to anything, because there is nothing to be subscribed to.
Fonts, stylesheets, icons and JavaScript libraries are all self-hosted on this domain rather than pulled from Google Fonts or a public CDN. That was originally a performance decision, but it has a privacy consequence worth stating: apart from the Google tag described above, loading a page here does not hand your IP address to any third-party font or script provider. The consent banner itself is first-party code, so it does not introduce another one.
Who else touches your data
Four services are involved, and only four.
| Service | Role | What it sees |
|---|---|---|
| Cloudflare Pages | Hosting and CDN for the site | Standard web request data such as your IP address, user agent and requested URL, handled under Cloudflare's own policies. This is the same for every site served through Cloudflare and is not something I query or retain. |
| Google Analytics 4 | Aggregate traffic measurement | Only if you accept. Page URL, referrer, approximate location derived from your IP, device type, and a first-party identifier that links your page views into one visit. If you refuse, it receives an anonymous, identifier-free signal instead. Retained 14 months. |
| Resend | Delivers the contact form email to my inbox | The contents of your submission, in transit. Used only when configured as the mail provider. |
| EmailJS | Alternate mail provider for the same form | Same as above. Only one of Resend or EmailJS is active at a time. |
The form does not post directly to either mail provider from your browser. It posts to /api/contact on this domain, which runs on Cloudflare's edge and forwards the message server-side. No API keys or provider identifiers are exposed to your browser.
Once the email arrives, it sits in a Google-hosted Gmail inbox. Google's handling of that inbox is governed by Google's own privacy terms.
How long I keep it
Contact form submissions live in my email inbox. I keep enquiries that turn into conversations or work, because I need the history. Enquiries that go nowhere get deleted when I clear out my inbox, which is not on a fixed schedule. If you want your message deleted at any point, ask and I will delete it.
There is no database. Nothing is stored on this website itself.
Who I share it with
Nobody. I do not sell, rent, trade or share enquiry data. I do not pass your details to partners, agencies or recruiters. The only exception would be a legal obligation under Nepali law, and that has never happened.
Your rights
You can ask me to show you what I hold about you, correct it, or delete it. Email [email protected] and I will action it. Given that what I hold is almost always a single email thread, this is usually a two-minute job.
If you are in the EU or UK and want to lean on GDPR language: there are two lawful bases in play. For your enquiry, it is legitimate interest - specifically, responding to someone who deliberately contacted me; you can object at any time by asking me to delete the message. For analytics cookies, it is consent under Article 6(1)(a) and the ePrivacy Directive, which is why nothing is stored until you press Accept, and why withdrawing is one button. Withdrawal does not affect the lawfulness of what was collected while consent was active. You also have the right to complain to your national supervisory authority, though I would appreciate the chance to fix it first.
Children
This is a business services site. It is not directed at children and I do not knowingly collect data from anyone under 16.
Changes to this policy
If I add a newsletter, an advertising tag, or any other data collection to this site, I will update this page and change the date at the top before that change goes live. I will not quietly start collecting something and backdate the disclosure. Google Analytics was added on 10 August 2026 and this page was rewritten in the same deployment, which is the standard I intend to keep.
Question about any of this?
Ask me directly. I would rather answer a privacy question than have you guess.