Last updated JULY 23, 2026
Privacy
This is a one-person practice. I collect as little as I can get away with, I don't sell anything to anyone, and everything below is a plain description of what actually happens.
This website
Pages are static. Two analytics tools run: Google Analytics and PostHog. Both record anonymous usage — pages viewed, rough location, browser and device type. Neither is used to build a profile of you, and I don't run advertising anywhere.
If you submit the contact form, the name, email, organization, budget, timeline and message you type are emailed to me through Resend. That's the entire journey — the form writes to no database. I keep the email as long as the conversation is useful, and delete it on request.
The Instagram automation
I run a self-hosted tool on my own Instagram account. When someone comments a keyword
(like SHIELD) on one of my posts, it replies with a direct message containing
the resource they asked for. It only ever reacts to a comment somebody chose to leave. It
cannot and does not send unsolicited messages.
It receives, from Instagram's official API:
- the comment text
- the comment's ID
- the commenter's Instagram user ID and username
- the ID of the post the comment is on
Of that, it stores a delivery log: which comment triggered which message, when, and whether the send succeeded. That log exists for two reasons, both boring and both necessary — making sure nobody is messaged twice for the same comment, and being able to debug a failure. Nothing else is retained.
This data is not sold, shared, rented, given to advertisers, used to train anything, or used for any purpose other than delivering the thing you asked for.
How long it's kept
Delivery logs are kept for 90 days and then deleted. Contact-form emails are kept for as long as the conversation is live.
Deleting your data
Email salman@salmaninayat.com from the address you contacted me on, or send the request from the Instagram account in question, and say what you want removed. I'll delete it and confirm. There's no form and no account to log into — it's one person reading an inbox.
You can also revoke the automation's access at any time from your own side by removing the comment, or by restricting who can message you in Instagram's settings.
Changes
If this changes, the date at the top changes with it. There's no mailing list to notify, so the date is the honest signal.