Who is responsible
I’m Keith De Alwis, based in Dubai, United Arab Emirates. I operate de-alwis.com and am responsible for the personal information covered by this policy.
This policy covers this website and the associated tools and projects I operate that link to it, including The Source KWI. A service may provide additional information about a particular feature when you use it. It does not cover independently operated client or third-party services.
For privacy questions or requests, email keith@de-alwis.com.
Information collected
- Enquiries: your name, email address, optional telephone number and the message you send through the contact form or by email.
- Newsletter and resource requests: your email address, first name and surname. Case-study download requests also ask for a mobile number. The signup system records the source, the requested resource where relevant, subscription wording, time of signup and tags used to manage the request.
- Website use: technical information such as IP address, browser and device information, pages requested, referring pages and request times may be processed when your browser communicates with the website and its providers. Analytics records website activity, including page visits and successful form or resource requests.
- Connected tools: information you provide to a tool, such as keyword seeds, a website URL or research settings, and the information needed to connect an account you authorise. Google connections are explained below.
Please do not put passwords, access tokens or sensitive personal information into enquiry forms or keyword research inputs.
How information is used
Information is used to respond to enquiries, provide requested services and resources, manage newsletter subscriptions, operate connected tools, understand website use, diagnose problems and protect the services against spam or misuse.
The Sunday Blueprint is sent when you subscribe. Some resource-request forms include newsletter subscription, as stated beside the form. You can unsubscribe using the link in an email or by contacting me. A contact-form enquiry alone does not subscribe you to the newsletter.
Where data-protection law requires a legal basis, the relevant basis depends on the activity: your consent for subscriptions and authorised account connections; steps you request before entering an agreement or performance of that agreement; legitimate interests in handling enquiries, operating and securing the services where permitted; or compliance with a legal obligation. Where consent is required for a technology or activity, that requirement applies separately.
I do not sell personal information.
Cookies and browser storage
The website uses Google Analytics 4 to understand visits and interactions. Google Analytics can use cookies and device or browser identifiers. The site records successful enquiry, newsletter and resource-request events; the form-event code does not send the names, email addresses, telephone numbers or message text entered in those forms to Analytics.
Analytics loads after the initial page load or an interaction. This delay is a performance measure, not a consent choice. The website currently has no on-site cookie preference panel. You can manage cookies through your browser and use Google’s Analytics opt-out browser add-on where supported. Blocking cookies may affect functionality.
The site also uses session storage and local storage to remember whether a newsletter invitation has been shown, time that invitation, remember a completed subscription, and suppress a dismissed landscape-resource prompt. These are browser flags and timestamps, not stored copies of your form name or email. The landscape prompt uses a 30-day dismissal window; this does not mean the underlying browser entry is automatically deleted after 30 days. You can clear site storage in your browser.
Cloudflare Turnstile processes browser and device signals when checking a form interaction for abuse. Video thumbnails and players can also communicate with YouTube, as explained below.
Services and sharing
The website uses the following services for these purposes:
- Vercel: website hosting, delivery and server-side form handling.
- Resend: sending contact-form enquiries to my email inbox. The submitted contact details and message are included in that email.
- HighLevel, through its LeadConnector API: managing newsletter and resource-request contacts, subscription records, tags and related communications.
- Cloudflare Turnstile: checking form interactions and verifying submissions to help prevent spam and automated abuse.
- Google Analytics: measuring website activity.
- YouTube: providing video thumbnails and embedded playback. The player is loaded when you choose to play a video, using YouTube’s privacy-enhanced embed domain. A thumbnail can be requested from YouTube before playback, which exposes connection information such as your IP address.
Information is shared with providers as needed for those functions. Providers may process information in countries other than where you live, including outside the UAE. Their own privacy information explains their processing: Vercel, Resend, HighLevel, Cloudflare and Google.
Information may also be disclosed where necessary to comply with a legal obligation, respond to a lawful request or protect rights and security. Google API data is subject to the additional limits in the next section.
Google OAuth and Google API data
Certain tools or services I operate through de-alwis.com, including The Source KWI, may let an account holder authorise access to Google services using Google OAuth. Access occurs only after the account holder authorises it through Google. The tool does not ask for your Google password.
The Source KWI uses authorised access to the Google Ads API for keyword research and intelligence. It sends research inputs such as keywords or a URL, language and target market, and receives keyword ideas and metrics such as estimated search volume, bid ranges and advertiser competition. It uses Google Ads customer identifiers to make authorised requests and may list accessible Ads accounts during connection setup.
Only permissions required for the relevant functionality are requested. The current integration requests Google’s Google Ads permission (https://www.googleapis.com/auth/adwords). This is a broad Google Ads permission; the current tool uses it for keyword-planning requests and does not create or change advertising campaigns.
Authorised Google data is used only to provide the relevant functionality, including producing keyword-intelligence reports. Google user data is not sold, used for unrelated advertising or profiling, or passed to the website’s newsletter or analytics systems. Keyword research may also query search engines through a SearXNG service to assess public search results; those requests use research keywords, not Google account credentials.
Access credentials and tokens are handled as secrets. The current integration exchanges tokens with Google over HTTPS, provisions credentials over an encrypted connection and stores them in a server file restricted to its owner. It refuses a credentials file that grants access to other users. The authorisation flow uses state validation and a proof key to protect the exchange. Credentials are kept separately from generated research reports.
You can revoke the connection at any time through your Google Account’s third-party connections. Revoking access stops future authorised access; it does not automatically delete reports already generated. To request deletion of retained Google-related information or connection credentials, email keith@de-alwis.com.
Use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including any Limited Use requirements that apply. Google data will be shared only as permitted by those requirements, such as where needed to provide the authorised functionality, protect security or comply with law. Where Limited Use applies, any human access will also be restricted to its permitted circumstances.
Storage and security
Information is held in the systems used to provide the relevant service: enquiry emails, newsletter and contact records held with service providers, and tool credentials or research reports on the systems running those tools. The website uses HTTPS. Form handlers validate submissions, check their origin and verify Turnstile responses before passing information to the relevant provider. Website service credentials are used on the server rather than included in public pages.
No transmission or storage system can be guaranteed completely secure. If you think information associated with these services has been exposed or misused, contact me using the address below.
How long information is kept
The retention principle is to keep personal information only for as long as needed for the purpose it was collected, including handling enquiries, delivering a service, keeping necessary business records, resolving disputes and meeting legal obligations. There is no single retention period covering every service.
Subscription records support delivery and the handling of unsubscribe requests. A limited record may be needed to respect an unsubscribe request. Provider logs and backups are subject to the relevant service’s settings and retention arrangements.
The Source KWI can save keyword reports as spreadsheet, CSV and JSON files. The current integration does not automatically delete these reports or revoke stored connection credentials on a fixed schedule. Revocation and a deletion request are separate steps. Contact me to request removal of information retained under my control; I will explain any information that must be retained and why.
Your choices and rights
Depending on the laws that apply to you, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict or object to certain processing, receive a portable copy, withdraw consent, or complain to the relevant data-protection authority. These rights can have conditions and exceptions. Withdrawing consent does not affect processing that was lawful before withdrawal.
Send requests to keith@de-alwis.com, identifying the service and the request. I may need proportionate information to confirm your identity before disclosing or changing personal information. Do not send passwords or Google tokens. I will respond within the period required by applicable law.
You can unsubscribe from emails, manage browser cookies and storage, and revoke a Google connection independently. Deleting browser storage does not delete contact records or reports held on service systems.
Third-party websites
This website links to social networks, articles, resources and other independently operated websites. Following a link takes you to a service with its own privacy practices. This policy does not govern those services; check their privacy information before providing personal information.
Changes and contact
This policy may be updated as the website, tools or requirements change. The latest version will remain at this address with its updated date. Where a change requires additional notice or renewed consent, that will be provided before the changed processing takes place.
Keith De Alwis
Dubai, United Arab Emirates
keith@de-alwis.com