Sandeep Bhalothia
Privacy noticeLast updated: 2 October 2026

Privacy, settled.

I collect almost nothing and sell absolutely nothing. I’m also a certified privacy professional, so getting this wrong would be very embarrassing.

  1. 01

    Just browsing

    You’re a ghost. A well-read ghost.

    What happens
    Pages load. No ad scripts, no tracking cookies, nothing that follows you around, and the fonts are served from this site itself. The hosting provider sets two small technical cookies: one for security (Cloudflare’s bot protection, which expires after about 30 minutes) and one for serving the site. Neither is used to track you or to advertise to you.
    Visit counts
    The hosting provider, Lovable, adds a small script that counts visits in aggregate: pages viewed, rough country, device type and the site you came from. It’s a headcount, not a stalker. It doesn’t build profiles or follow you between visits, and it may report site errors so they can be fixed.
    Technical logs
    Like every website, the hosting and database providers may keep short-lived technical logs, including IP addresses and error reports, to keep the service secure and running.
  2. 02

    The newsletter

    One email a month, give or take. One click to leave. No guilt trip.

    Collected
    Your email address, the date and page you signed up on, the consent sentence you agreed to, and a random unsubscribe code.
    Why
    To send you new pieces from Cleared & Settled. That’s it. Your consent is the legal basis, and you can withdraw it at any time.
    Who sees it
    Me. When I send an issue, the email-sending service I use receives your address only to deliver it.
    Kept for
    Until you unsubscribe. After that I keep your email address marked ‘unsubscribed’, with the dates you joined and left, so I never add you back by mistake. Ask, and I’ll delete even that.
  3. 03

    The contact form

    You write, I reply. Old messages quietly self-destruct, like in spy films, only slower.

    Collected
    Your name, email, organisation (if you give one), topic and message.
    Why
    To read and reply to your message, and nothing else. My legal basis is my legitimate interest in replying to people who write to me.
    Kept for
    Until I’ve dealt with it and archived it. Archived messages self-destruct 12 months later; anything never archived goes after 24 months.
  4. 04

    The spam shield

    Bots get bounced. Your IP address gets put through a blender.

    What happens
    When you send a form, your IP address is turned into a one-way scrambled code (a salted hash) and stored with the time, so I can limit sign-ups to 5 an hour and messages to 3 an hour from one connection.
    Kept for
    About a day, then deleted automatically. The raw IP address itself is never stored.
    Legal basis
    My legitimate interest in keeping bots out.
  5. 05

    Where it lives

    In a database, not in a spreadsheet called ‘leads_final_v3’.

    Providers
    The site is hosted by Lovable, and form data is stored in its database service, which runs on Supabase. Their servers may be outside the UAE.
    Never
    Sold, rented, traded or used for advertising. This site has no AI features, and I don’t use anything you send me to train AI.
  6. 06

    Your rights

    Please use them. A privacy lawyer getting a data request is like a chef getting a compliment.

    You can ask me to
    Show you what I hold about you, correct it, delete it, or stop using it. I’ll reply within 30 days.
    How
    Email hello@sandeepbhalothia.com, or use the contact form on the home page. You can also complain to your data protection regulator.

Who I am

This site is run by Sandeep Bhalothia in a personal capacity. It isn’t my employer’s site, and my employer doesn’t receive any of this data.

Children

The site isn’t aimed at anyone under 18. If you’re under 18, please don’t send me your details.

Changes

If anything here changes, I’ll update this page and the date at the top.