1. Introduction
This Privacy Policy explains how CoreStack ("we", "us", "our") operating the website khannasir.com collects, uses, and safeguards information when you visit our website, fill out our contact form, or engage our professional services.
We respect your privacy and are committed to protecting your personal data in accordance with applicable laws, including the Digital Security Act of Bangladesh (2018), the EU General Data Protection Regulation (GDPR) where applicable, and other international privacy standards.
2. Information We Collect
2.1 Information You Provide
- Contact details: name, email address, phone/WhatsApp number, country, company name (via contact form)
- Project information: service requirements, budget range, technical descriptions you share
- Communication content: messages, emails, WhatsApp chats, call notes
2.2 Information Collected Automatically
- IP address, browser type, device type, operating system
- Pages visited, time spent, referring website
- Cookies and similar tracking technologies (see Section 7)
3. How We Use Your Information
- To respond to your inquiry within 24 hours
- To schedule consultations and prepare proposals
- To deliver contracted services (database administration, infrastructure, ERP, AI, hosting, SEO)
- To send service updates, project status, and invoices
- To improve our website and service offerings
- To comply with legal obligations
4. Legal Basis (GDPR)
For visitors in the European Union, we process personal data on these legal bases:
- Consent — when you submit the contact form
- Contractual necessity — when delivering paid services
- Legitimate interest — to improve our website and respond to inquiries
- Legal obligation — to comply with applicable laws
5. Confidentiality & NDA
All client information, project details, technical configurations, database credentials, and business data we receive during engagements are treated as strictly confidential. A formal Non-Disclosure Agreement (NDA) is available upon request before any engagement begins.
6. Data Sharing
We do NOT sell, rent, or trade your personal information to third parties. We may share information only:
- With your explicit consent
- With service providers (email delivery, hosting, form processing — e.g. FormSubmit.co) under strict data-processing terms
- When required by law, court order, or regulatory authority in Bangladesh or your jurisdiction
7. Cookies
Our website uses minimal cookies, primarily for:
- Essential site functionality
- Google Fonts delivery
- Anonymous analytics (if enabled)
You can disable cookies in your browser settings without significantly affecting site functionality.
8. Data Retention
We retain your data only as long as necessary for the purposes outlined above:
- Inquiry forms: 12 months from last contact
- Active client data: duration of engagement + 7 years (for tax/accounting)
- Marketing communications: until you unsubscribe
9. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction or deletion of your data
- Object to processing
- Withdraw consent at any time
- Lodge a complaint with a supervisory authority
To exercise these rights, email info@khannasir.com.
10. Data Security
We implement reasonable technical and organizational measures to protect your information — including HTTPS encryption, secure password storage, access controls, and regular security reviews. However, no internet transmission is 100% secure; we cannot guarantee absolute security.
11. International Data Transfers
As we serve clients worldwide, your data may be processed in Bangladesh, the United States (where our form-processing service is hosted), and other countries. We ensure appropriate safeguards are in place for international transfers.
12. Children's Privacy
Our services are intended for businesses and adults aged 18+. We do not knowingly collect data from children under 16.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Continued use of the website after changes constitutes acceptance.
14. Contact Us
For privacy questions or data requests:
15. Social Autopilot Personal & LinkedIn
This section applies specifically to Social Autopilot Personal, a locally operated application maintained by Nasir Uddin Khan. Its LinkedIn connection is for the owner's own personal profile. It is not a public account-management service and is not endorsed by LinkedIn. Company Page verification does not grant this application permission to publish to a company Page.
Purpose and permission
The connection uses LinkedIn's official sign-in and consent pages. Before connecting, the owner reviews this section and explicitly agrees to the data use. The requested permissions are openid and profile to identify the signed-in member, and w_member_social for owner-directed sharing. Although the last permission allows posting on the member's behalf, connecting does not publish anything or activate a schedule. Unattended LinkedIn posting is not enabled. Any future sharing must comply with LinkedIn's applicable terms and the owner's explicit instructions.
Information processed
- Account identity: LinkedIn's application-specific member identifier and basic profile information returned during connection or an owner-requested connection check. The name is displayed for confirmation; the connection does not retain the profile name or photograph.
- Authorization: the OAuth access token, granted permissions, expiry time and application identifier. A short-lived authorization code is exchanged for the token; the code is not saved or logged.
- Owner-provided information: the intended profile URL and connection confirmation. Content the owner may later choose to share is separate from information received through LinkedIn's API.
The connection does not request the email permission, collect LinkedIn passwords, scrape profiles, or read connections, private messages, feeds or other members' posts. LinkedIn information is not sold, used for advertising targeting, or used to train AI models.
Storage, transfer and access
Application credentials and member authorization are stored on the owner's Windows computer using Windows-user encryption (DPAPI), outside this public website and source control. Requests to LinkedIn use HTTPS. The temporary sign-in callback listens only on the same computer's loopback interface; it does not expose a public login service. LinkedIn receives authorization requests and, if sharing is separately authorized, the selected content. LinkedIn processes that information under its Privacy Policy, which may involve processing outside Bangladesh. Publicly shared content can be visible to other people.
Retention, withdrawal and deletion
The member token, identifier and connection metadata are kept locally while the connection is needed. An expired token stops working; expiration alone does not erase the local encrypted file, and reconnecting requires fresh authorization. The website/client retention periods in Section 8 do not set a seven-year retention period for LinkedIn connection data.
The owner can remove Social Autopilot Personal from LinkedIn's permitted services to revoke access and use the application's local disconnect command to delete its member authorization and identifier. Revocation on LinkedIn and deletion on the computer are separate actions. Deletion requests, including requests to remove application credentials, can also be sent to info@khannasir.com; LinkedIn-derived data is deleted when requested or when the integration is no longer used, unless retention is required by law. Disconnecting does not delete posts already shared on LinkedIn; those must be managed on LinkedIn itself.
15. Social Autopilot Personal & LinkedIn
This section applies specifically to Social Autopilot Personal, a locally operated application maintained by Nasir Uddin Khan. Its LinkedIn connection is for the owner's own personal profile. It is not a public account-management service and is not endorsed by LinkedIn. Company Page verification does not grant this application permission to publish to a company Page.
Purpose and permission
The connection uses LinkedIn's official sign-in and consent pages. Before connecting, the owner reviews this section and explicitly agrees to the data use. The requested permissions are
openidandprofileto identify the signed-in member, andw_member_socialfor owner-directed sharing. Although the last permission allows posting on the member's behalf, connecting does not publish anything or activate a schedule. Unattended LinkedIn posting is not enabled. Any future sharing must comply with LinkedIn's applicable terms and the owner's explicit instructions.Information processed
The connection does not request the
emailpermission, collect LinkedIn passwords, scrape profiles, or read connections, private messages, feeds or other members' posts. LinkedIn information is not sold, used for advertising targeting, or used to train AI models.Storage, transfer and access
Application credentials and member authorization are stored on the owner's Windows computer using Windows-user encryption (DPAPI), outside this public website and source control. Requests to LinkedIn use HTTPS. The temporary sign-in callback listens only on the same computer's loopback interface; it does not expose a public login service. LinkedIn receives authorization requests and, if sharing is separately authorized, the selected content. LinkedIn processes that information under its Privacy Policy, which may involve processing outside Bangladesh. Publicly shared content can be visible to other people.
Retention, withdrawal and deletion
The member token, identifier and connection metadata are kept locally while the connection is needed. An expired token stops working; expiration alone does not erase the local encrypted file, and reconnecting requires fresh authorization. The website/client retention periods in Section 8 do not set a seven-year retention period for LinkedIn connection data.
The owner can remove Social Autopilot Personal from LinkedIn's permitted services to revoke access and use the application's local disconnect command to delete its member authorization and identifier. Revocation on LinkedIn and deletion on the computer are separate actions. Deletion requests, including requests to remove application credentials, can also be sent to info@khannasir.com; LinkedIn-derived data is deleted when requested or when the integration is no longer used, unless retention is required by law. Disconnecting does not delete posts already shared on LinkedIn; those must be managed on LinkedIn itself.