Privacy policy

1. Who is responsible

Firas Bader, The Food Engineer, based in Lebanon, decides why and how the personal data described here is used. Under Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data, I am the person responsible for processing this data (in other laws, the “controller”).

You can reach me here:

• Email: firas@firasbader.com
• WhatsApp: +961 81 574 187

This notice covers firasbader.com, in English and in Arabic; the inquiries, messages and poll votes sent through it or through my ads; and the messages you send to my business WhatsApp or email, or to me on Instagram, Facebook or LinkedIn.

2. What I collect and why

The contact form

These are the fields you fill in:

If a required field is empty, the form can't be sent and I can't reply to you. The optional fields only help me prepare.

The site adds these details to your inquiry automatically:

• a reference number, and the date and time it arrived
• the page on this site you sent it from
• how it was sent: the form, the form filled in by an AI assistant in your browser and sent by you, or an AI assistant (see AI assistants)
• your country, as Cloudflare estimates it from your connection
• your browser's identification text (the “user agent”, up to 160 characters, which for most browsers is all of it) and, if the request carries one, the identity header that automated agents send (Signature-Agent)
• a hashed version of your IP address that changes every day. I never store the IP address itself.
• whether the email telling me about your inquiry was sent, or an error code if sending failed

Why: to read and answer your inquiry, to prepare in case we work together, and to keep the form free of spam and abuse. The hashed address and your email address are used to limit how many inquiries can be sent in a day. The browser text and country help me recognise automated abuse when I read the inquiries.

Where it goes: your inquiry is saved in my website's database, which Cloudflare hosts. An email with your inquiry is then sent to my business mailbox, firas@firasbader.com, which Google Workspace hosts. That email includes your answers, the reference number, the time it arrived, how it was sent, the country, the page and the language of the form. It does not include the hashed address or the browser details. When I reply, my reply goes to the email address you gave.

Please don't include formulas, recipes, ingredient percentages, or anyone's personal health information. A short, non-confidential overview is enough to start.

WhatsApp and email

When you message me on WhatsApp (+961 81 574 187) or by email (firas@firasbader.com), I receive what you send: your number or email address, the name and profile the app shows, and your messages and files. I use them to reply to you and, if we work together, for the project. The same applies when you message me or comment on Instagram, Facebook or LinkedIn; those platforms' own privacy policies apply there.

The WhatsApp buttons on this site open WhatsApp with a short message already written, for example “Hi Firas, I'd like to discuss a product.” On an article, project or service page, the message names it. The message is part of the link, so WhatsApp receives it when the chat opens. Nothing reaches me until you press send, and you can change it first. The site itself receives and stores nothing when you tap a WhatsApp button. The short links firasbader.com/whatsapp, firasbader.com/wa and firasbader.com/ar/whatsapp only send your browser on to WhatsApp, with a general greeting.

WhatsApp is run by Meta, and its own privacy policy applies inside the app. My email is hosted by Google Workspace.

I only message you to reply to you or about our work. I won't send you marketing messages unless you have agreed to them, and you can tell me to stop at any time.

AI assistants

You can ask an AI assistant, for example ChatGPT or Claude, to send me an inquiry for you. It does this through my site's public connection for AI assistants (the MCP server at firasbader.com/mcp) or through the inquiry address of the form. A browser AI can also fill in my contact form for you, and you then send it yourself.

• An assistant sends the same details as the form: your name, email, what you need and a summary, and optionally your company, phone and timeline.
• My site tells the assistant to show you exactly what it will send, and to send it only after you approve. The assistant tells my site that you approved, and the site stores that note with your inquiry. I can't check it myself. If an inquiry was sent in your name without your approval, tell me and I'll delete it.
• Your words pass through the AI provider first, under that provider's own terms and privacy policy.
• When an AI assistant sends an inquiry from its provider's servers, the country, browser text and hashed network address stored with it usually belong to those servers, not to you. If the assistant runs on your own device, they are yours.
• The other tools of this connection only give out public information about my services and work. No assistant can read stored inquiries or individual poll votes. Poll totals are public.

Polls in Insights articles (“Your turn”)

• Nothing is sent when the page loads. When you press Vote, the site sends the article and the option you chose. There is no free text. “See the results” asks only for that article's totals, and nothing about that request is stored.
• To allow one vote per article per connection, I store a hashed version of your IP address with your vote, and the date and time of the vote. The hash stays the same for that article, so it is pseudonymous, not anonymous. I don't store your IP address itself, and your vote is not linked to your name.
• The results show totals only. Because a vote is tied to the connection, if someone on the same connection (for example, in the same office) has already voted on that article, a second vote is not counted, and the site's reply to it includes the option already recorded.
• Your browser also remembers which option you chose (see Cookies and storage).

Calculators and checklists

The calculators in Insights articles work entirely in your browser. Nothing you enter is sent to me. Checklist ticks are saved only on your device.

Technical data (every visit)

• Hosting and security. The site runs on Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes technical data such as your IP address, your browser type and the page you ask for. Cloudflare does this under its own privacy policy and may keep its own security records.
• No request logs in my code. The site's own server code does not keep request logs. Cloudflare's dashboard can still show me, and the person who maintains the site, traffic summaries (such as visits per page and per country) and samples of security events, which can include IP addresses.
• Spam limits. To stop floods of requests, the site counts requests from the same network address over one minute. For this, Cloudflare briefly holds your IP address or a hash of it. Nothing is saved after that minute. The contact form also has daily limits: it counts the inquiries already stored that day with your hashed address or your email address, plus a total for the whole site. These counts use the stored inquiries and save nothing new.
• Error reports. Cloudflare asks browsers to report failed connections to Cloudflare (this is called “Network Error Logging”). These reports go to Cloudflare, not to me, and are sent only when a connection fails.
• Pages and videos. Reading pages and watching the videos on this site doesn't store anything about you on my side.

3. Why I may use it

• Your request and our agreement. To answer your inquiry or message, however it reaches me (the form, an AI assistant you ask to send it, WhatsApp, email or a form in an ad), to take the steps you ask for before we agree to work together and, if we do, to carry out our agreement.
• Legitimate interests. To keep the site secure, to limit spam and abuse, and to count poll votes fairly.
• Consent. Only if you agree to receive news or offers from me. You can withdraw it at any time; this doesn't affect anything done before.
• Legal duties. When the law requires me to keep or disclose something.

In Lebanon, personal data is covered by Law No. 81 of 2018 on Electronic Transactions and Personal Data. I collect only what I need for the purposes on this page, and I don't use it for anything else.

4. Who receives it

I don't sell or rent your personal data. I don't use data from this website for advertising.

Service providers that handle it for me:

• Cloudflare hosts the site, runs the database where inquiries and poll votes are stored, sends the inquiry email to my mailbox, and protects the site.
• Google (Google Workspace) hosts my business mailbox, where inquiry emails and our email conversations are kept.
• The person who builds and maintains this website for me can access its systems to keep it running.

Services you choose to use (their own privacy policies apply):

• Meta: WhatsApp, Instagram and Facebook
• LinkedIn: if you open my profile or share an article there
• Your AI assistant's provider: if you contact me through one

Anyone else: only if you ask me to or agree (for example, your manufacturer on a project we work on together); my professional advisers, such as an accountant or lawyer, when they need it; to establish or defend a legal claim; or if the law or a court requires it.

5. Cookies and storage on your device

Cookies. This site's own code sets no cookies. Cloudflare may set a short-lived security cookie (for example __cf_bm) if it needs to check that traffic is not coming from a bot. That cookie is not used for advertising.

Storage in your browser. Two features save a small note in your browser's local storage. These notes stay on your device until you clear this site's data, and they are never sent to me:

Neither note contains anything that identifies you.

Analytics and trackers. At the moment the site has no analytics, no advertising pixels (such as the Meta Pixel) and no third-party scripts, fonts or embedded content. If I ever add a tool to count visits, I will update this page before it starts.

Links to other sites. WhatsApp, Instagram and LinkedIn links take you to those services. This site asks your browser to tell other sites only that you came from firasbader.com, not which page you were on. Some links carry more, on purpose: on an article, project or service page, the WhatsApp button puts the name of that article, project or service into the ready-made message, and the share buttons send the article's title and address to LinkedIn or WhatsApp. WhatsApp (Meta) and LinkedIn receive that text in the link as soon as it opens, even if you don't send or share anything.

6. Ads on Instagram and Facebook

I may advertise on Instagram and Facebook.

• Meta runs these ads. I choose the general audience, such as the countries and age range, and Meta decides who sees each ad within it, using its own data and under its own policies. Meta knows when you see or tap an ad.
• If an ad opens a WhatsApp chat with me, the chat is handled as described under WhatsApp and email. WhatsApp may show me that the chat started from an ad.
• If an ad brings you to this website, the site sends nothing about your visit to Meta. It has no Meta Pixel and no other ad tracker. If the page opens inside the Instagram or Facebook app, that in-app browser is Meta's, and Meta's policy applies to it.
• Meta gives me ad reports with summary numbers, such as how many people saw or tapped an ad.

Forms inside Instagram or Facebook. If an ad asks you to fill in a form inside Instagram or Facebook, Meta passes me what you submit, such as your name, email, phone number and your answers. Meta may fill some of these in from your profile, and you can change them before you send. Meta keeps its own copy under its own policy. I use your answers only to answer the request in that form, and I handle them like a contact-form inquiry.

7. Where your data is processed

Your data is handled outside Lebanon as well as inside it, which means your personal data is transferred to other countries. If you are in the UAE, your data leaves the UAE: it reaches me in Lebanon and the providers listed below.

• Cloudflare runs a global network. The database is stored in Cloudflare's Western Europe region.
• Google Workspace keeps email in Google's data centres in several countries.
• Meta processes WhatsApp, Instagram and Facebook data on its own servers around the world.
• AI providers handle what you send them under their own terms.

I use established providers with published data protection terms, and data travels between your device and this site over an encrypted connection (HTTPS).

8. How long I keep it

Nothing on this site deletes data automatically at the moment. Data is deleted by hand, for example when you ask me to (see section 9). Today, this is how long each kind of data is kept:

• Inquiries, and the emails and WhatsApp chats about them: until I delete them. If we work together, I keep what the project needs for as long as the work lasts, then for as long as the law requires me to keep business records.
• The spam-check details stored with an inquiry (the hashed address, the browser text and the identity header): as long as the inquiry itself.
• Poll votes: the vote and its hashed address are kept until I delete them. Only the totals are ever shown.
• Forms inside Instagram or Facebook, if used: Meta lets me download the answers for 90 days. Anything I copy out is kept like an inquiry.
• Spam-limit counters: about one minute, at Cloudflare.
• Storage in your browser: until you clear it.
• Backups and recovery: after I delete something from the database, it can stay in Cloudflare's automatic backups for up to 30 days. An email I delete can still be recovered from my Google Workspace mailbox for up to about 55 days (30 days in the trash, then 25 days by the administrator). If my phone's WhatsApp chats are backed up, a deleted chat stays in that backup until it is next replaced.

If you ask me to delete your data, I delete it from my database, my mailbox and my WhatsApp within 10 days, except anything the law requires me to keep, which I'll tell you about. I can't single out one poll vote, because it is stored only with a scrambled code, not with your name or contact details. Copies that Cloudflare, Meta, Google or your AI provider keep under their own policies are outside my control; use their own settings for those.

When I set fixed deletion periods, I'll list them here and update the date at the top of this page.

9. Your rights

Lebanese Law No. 81 of 2018 gives you the right to:

• Access: ask whether I hold data about you, and get a copy, along with what I use it for, where it came from and who received it
• Correction and deletion: have it corrected, completed, updated or deleted when it is wrong, incomplete, unclear, out of date or no longer fits the purpose I collected it for
• Objection: object, for legitimate reasons, to my use of it, including for marketing
• Automated processing: ask me to review, and object to, the information used in any automated check that affected you (see below)

As my own practice, I also let you:

• withdraw any consent you gave, at any time; this doesn't affect anything done before
• stop marketing messages at any time, without giving a reason
• ask me to delete your data in other cases too, apart from what I must keep (see section 8)

If you live in the UAE, the UAE's data protection law also lets you ask me to limit or stop using your data, or to give you a copy in a form you can reuse.

Automated decisions. I don't make automated decisions about you. Automatic spam checks can refuse a message: when too many arrive from the same connection within a minute, when a daily limit for one connection, one email address or the whole site is reached, or when a hidden spam-trap field is filled in. A refused message is not stored. You can ask me to review any of these checks, and you can always reach me on WhatsApp or by email.

How to use them: write to firas@firasbader.com or message +961 81 574 187 on WhatsApp. I may ask you to confirm it's you, for example by writing from the same email address. Requests are free. I answer them, and make any correction or deletion, within 10 days of your request. These rights can't be given up in a contract.

If you're not satisfied: please contact me first. In Lebanon, you can go to the competent courts, especially the judge of urgent matters (قاضي الأمور المستعجلة). Lebanon has no separate data protection authority. If you live in the UAE, you can contact the UAE federal authority responsible for personal data, where it accepts complaints. Elsewhere, you can contact your local data protection authority if your law provides one.

10. Confidential product information

Please don't send formulas, recipes, ingredient percentages or other confidential details through the form, WhatsApp, email or an AI assistant when you first get in touch. A short, non-confidential overview of your product and your goal is enough to start.

11. Children

This site is for food brands, startups and manufacturers, including founders who don't have a company yet. It isn't meant for people under 18, and I don't knowingly collect their data. If you think a child has sent me personal data, tell me and I'll delete it.

12. Security

I take reasonable steps to protect your data:

• the site is served over HTTPS
• IP addresses are hashed before they are stored
• the database is not public
• spam and size limits apply to what can be sent
• inquiry emails go only to my business mailbox
• only I and the person who maintains the site can access the site's systems

No method of sending or storing data is completely secure. If I learn of a breach that affects your data, I'll tell the people affected whom I can reach, and post a notice on this page.

13. Changes to this notice

When what I collect, or how I use it, changes, I'll update this page and its “Last updated” date. If the change is significant, for example adding visit statistics, I'll say so at the top of this page before the change takes effect.

14. Contact

Firas Bader, The Food Engineer

• Email: firas@firasbader.com
• WhatsApp: +961 81 574 187