Privacy Policy

Last updated: 1 November 2026

This policy explains what information Shaheer Malik (“we”, “us”) collects, why, and what you can do about it. It covers this website (shaheermalik.com) and ShipItLive, our client workspace: the portal at portal.shaheermalik.com and the ShipItLive iPhone app.

In short: we collect only what we need to do your project with you, we never sell your data or use it for advertising, and when you sign in with Google we receive only your name, email address and Google account ID.

1. Who we are

Shaheer Malik is an independent design and development studio based in Dubai, United Arab Emirates. We are the controller of the personal information described here. You can reach us about anything in this policy at support@shaheercare.com.

2. Information we collect

Information you give us. When you use the contact form, the proposal chat or the booking calendar: your name, email address, company and the details of your project. When you use ShipItLive: your name, email address, company, role, an optional profile photo and, if you choose one, a password (stored only as a salted hash, never in plain text).

Sign in with Google.If you choose “Continue with Google”, Google shares, with your permission, the basic profile information covered by the openid, email and profile permissions: your name, your email address, whether Google has verified that address, and your Google account ID. Google also makes your profile picture available; we do not store it. We do not ask for and cannot see your Gmail, Google Drive, Contacts, Calendar or any other Google data.

Sign in with Apple.If you choose “Continue with Apple”, Apple shares your Apple user ID, your email address (or a private relay address if you choose to hide yours) and, the first time only, your name.

Email codes. If you sign in with a one-time code, we use your email address to send it. Codes expire after 10 minutes and work once.

What you share in ShipItLive. Messages, files you upload, briefs and orders, approvals, comments, agreements, invoices and their payment status, and, for calls with the studio, meeting recordings, transcripts and summaries, which are shared with your team in the workspace.

Technical information. Sign-in sessions, security logs (such as the time of a sign-in and a hashed form of the IP address it came from), the browser or device you use, and, in the iPhone app, a push notification token if you allow notifications.

Website analytics. On shaheermalik.com we use PostHog to understand how people use the site: pages visited, clicks, scrolling and session recordings. Anything you type, and the contents of the proposal chat, are masked in recordings. If you give us your email, we link your visits to it so we can follow up on your enquiry.

Testing the wording of pages. We sometimes show two versions of a line of text to see which one is clearer. Your browser remembers which version it showed you, so you keep seeing the same one. We count how many visitors saw each version and how many went on to take a step such as starting a proposal. The count holds no cookie, no identifier and nothing about you. If your browser sends a Global Privacy Control or Do Not Track signal, you see the usual page and are not counted.

3. How we use it

To create your ShipItLive account, sign you in and keep your account secure.
To connect you with your company's workspace, and to show you a proposal when you arrive from one.
To do the work: talk with you, share files and progress, take approvals and deliver what you ordered.
To send invoices and receipts and record payments.
To send you the emails and notifications you need (sign-in codes, messages, approvals). You can change notification settings in the workspace.
To prevent abuse and fraud, fix problems and improve the service.
To meet our legal, tax and accounting obligations.

We do not sell personal information, we do not use it for advertising, and we do not build advertising profiles.

4. Google user data

ShipItLive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access: your name, email address, email verification status and Google account ID, through the openid, email and profile permissions. Nothing else.
How we use it: only to create your ShipItLive account, sign you in, recognise you when you return, and show your name to the people you work with in your workspace.
How we store it: in our database on Cloudflare, encrypted in transit, linked to your workspace account.
Who we share it with: no one, except the people in your own workspace (who see your name and email), and where the law requires it. We do not sell it, use it for advertising, or transfer it to data brokers.
AI: we do not use Google user data to develop, improve or train AI or machine-learning models, and we do not send it to AI services.
People: nobody reads it except where you ask us to (for example, for support), where it is needed for security, or where the law requires it.
Deleting it: choose Delete my account in Settings → Security (web or app) and your account and the Google sign-in link are deleted straight away, or email support@shaheercare.com and we do it within 30 days. You can also remove ShipItLive's access at any time at myaccount.google.com/connections.

5. AI features

Some features use OpenAI's API to help us work faster: drafting proposals from your brief, and summarising meetings with the studio. For these, the relevant content (your brief, a meeting transcript) is sent to OpenAI as our service provider. OpenAI does not use data sent through its API to train its models. Google and Apple sign-in data is never sent to AI services.

7. Storage and security

Data is stored with Cloudflare and our other providers, which may process it in countries other than yours, including the United States and the European Union. All traffic is encrypted with HTTPS. Passwords are stored only as salted hashes, sign-in sessions can be ended at any time, and access to client data is limited to the studio. No system is perfectly secure, but we take reasonable measures to protect your information.

8. How long we keep it

Account information and workspace content: for as long as your account is active.
When you delete your account in Settings → Security: your sign-in, sign-in links (Google, Apple), devices, name, photo, email and other personal details are deleted at once. Messages and files you shared in your company's project conversation stay with that project, shown as “Former member”; email us and we remove those too, within 30 days. Backups roll off within a further 30 days.
Invoices and payment records: for as long as tax and accounting law requires, even after an account is deleted.
Enquiries that do not become a project: up to 24 months, or sooner if you ask.

9. Your choices and rights

You can download a copy of the personal information we hold about you (Download my data) and delete your account (Delete my account) yourself, in Settings → Security on the web or in the app. You can also ask us to show you, correct, export or delete it, or to stop using it: email support@shaheercare.com and we will reply within 30 days. You can update your name and photo, change your password and choose your notifications yourself in the workspace settings.

Depending on where you live (for example, under the EU and UK GDPR or California law), you may have further rights, including the right to complain to your local data protection authority.

10. Children

Our services are for businesses and are not directed to anyone under 16. We do not knowingly collect their data.

11. Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will tell ShipItLive users by email or in the workspace before it takes effect.

12. Contact

Shaheer Malik, Dubai, United Arab Emirates. Email support@shaheercare.com. See also our terms of service.