Privacy Policy & AI Data Safeguards
Transparent data protection standards governing enterprise systems engineering, AI voice pipelines, RAG vector knowledge bases, and cross-border client confidentiality.
Executive Summary & Direct Answer:
Sheharyar Siraj operates a strict, privacy-first engineering practice adhering to global data protection laws (GDPR, CCPA/CPRA, PIPEDA, UAE PDPL, and Saudi Arabia KSA PDPL). Client proprietary data, business documents, vector embeddings, and voice AI transcripts are processed through dedicated, zero-data-retention enterprise APIs and are never sold, monetized, or used to train public foundational AI models.
- Zero Model Training: Client data and vector knowledge bases are never fed into public LLM training corpuses.
- Bilateral Confidentiality: Default commercial NDA protection covering client codebases, APIs, and business data.
- AI Voice Governance: Telephony audio and transcription logs processed via encrypted endpoints (TLS 1.3 / AES-256).
- Full Cross-Border Compliance: Direct support for GDPR, CCPA, PIPEDA, UAE PDPL, and Saudi Vision 2030 standards.
1. Data Controller & Architectural Scope
This Privacy Policy explains how Sheharyar Siraj ("we", "us", or "Architect"), operating as an independent AI Automation Architect and WordPress Systems Engineer based in Karachi, Pakistan (+92 313 2080033, sherryansari870@gmail.com), collects, processes, and safeguards information when you visit https://sheharyarsiraj.com/, use our digital architecture services, or engage in B2B technical consultations.
When providing bespoke systems development (such as custom WordPress architectures, n8n workflow automations, or private vector indexing), Sheharyar Siraj acts primarily as a Data Processor on behalf of client enterprise Data Controllers, operating strictly under bilateral contract terms or platform guarantees (e.g., Upwork Enterprise Escrow).
2. Categories of Data Collected
A. Information You Voluntarily Provide
When you initiate a project inquiry, schedule an architecture review, message via WhatsApp (+92 313 2080033), or submit our contact form, we collect your name, business email address, company name, website URL, project specifications, and timeline requirements.
B. Technical Infrastructure Telemetry
To maintain 99.9% uptime, mitigate brute-force attacks, and guarantee sub-second server response times, our edge infrastructure automatically logs standard access headers, including client IP addresses, browser user agent, operating system, requested URI paths, and HTTP response codes.
C. What We Never Collect
We do not execute intrusive surveillance scripts, unconsented biometric profiling, credit card token harvesting on this portfolio, or third-party behavioral advertising network pixels (e.g. Meta Pixel or programmatic remarketing cookies).
3. AI Voice Telephony & Speech Processing Governance
For clients deploying conversational telephony voice agents through our architecture pipelines (utilizing Vapi, Retell AI, ElevenLabs, Deepgram, and Twilio SIP trunking), the following governance safeguards apply:
- Explicit Recording Consent: All telephony systems are programmed with jurisdictional disclosure prompts (e.g. "This call is recorded for quality assurance and automated scheduling") matching two-party consent laws in California, Florida, and EU jurisdictions.
- Encryption in Transit & Rest: Telephony media streams use Secure Real-Time Transport Protocol (SRTP) and TLS 1.3 encryption. Call recordings and transcription records stored in database buffers are encrypted with AES-256 keys.
- No Voice Biometric Resale: Voice audio samples, speech embeddings, and telephony logs are never commercialized, resold, or used for automated voice synthesis cloning outside the client's explicit authorization.
4. RAG Vector Knowledge Bases & LLM Model Isolation
When architecting custom Retrieval-Augmented Generation (RAG) knowledge systems using vector stores (Pinecone, pgvector) and foundation LLMs (OpenAI GPT-4o, Anthropic Claude 3.5 Sonnet, Google Gemini):
All client proprietary documentation, SOPs, customer tickets, and internal intellectual property are queried strictly via zero-data-retention (ZDR) enterprise API endpoints. Your company data is never used by foundation model providers to train or fine-tune public models.
Vector embeddings are stored within dedicated, namespace-isolated cloud clusters with role-based access control (RBAC), ensuring complete multi-tenant partitioning for enterprise and white-label agency clients.
5. International Jurisdictional Compliance
Because Sheharyar Siraj engineers systems for enterprise clients across North America, Europe, the GCC, and Asia-Pacific, our operations adhere to regional data protection frameworks:
6. Security Controls & Data Retention Timelines
We apply defense-in-depth security standards to prevent unauthorized access, alteration, or disclosure:
- Access Isolation: Production server credentials use SSH Ed25519 key authentication with passphrase protection; passwords are never shared via plaintext email.
- Retention Policy: Inactive consultation inquiry records are purged after 24 months. Active client repository backups are maintained under contract terms and archived or purged upon project completion.
- Immediate Incident Notification: In the unlikely event of a security anomaly affecting client assets, notice is provided within 24 hours of confirmation.
8. Data Protection Inquiries & Rights Execution
To request access to your personal data, submit an erasure request, or request an executed Data Processing Addendum (DPA) for enterprise contracts, contact our data governance desk directly: