Legal
Privacy Policy
Last updated: 22 October 2026
This page explains what personal data mekawyaipm.com collects, why, who helps me process it, how long it is kept, and the rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible
This website is run by Mostafa Mekawy ("I", "me"). I am the controller of the personal data described here. For any privacy question or request, write to me through the contact form.
What I collect and why
Free guide signup (homepage)
Data: your name, email address, that you ticked the consent box and when, and which form you used.
Why: to email you the AI Product Playbook PDF and, as you agreed, occasional emails about AI product management.
Legal basis: your consent (GDPR Art. 6(1)(a)).
Community signup (/join)
Data: your name, email address, that you ticked the consent box and when, and which form you used.
Why: to email you an invitation to the AIPM community on Skool and, as you agreed, occasional updates. This website does not send your details to Skool; you decide whether to join there.
Legal basis: your consent (GDPR Art. 6(1)(a)).
Contact form (/contact)
Data: your name, email address, the topic you picked, your message and when you sent it.
Why: to read and answer your message. A copy is emailed to my personal inbox so I see it quickly.
Legal basis: my legitimate interest in replying to messages people send me (GDPR Art. 6(1)(f)), or steps you ask for before working together (Art. 6(1)(b)).
Google Analytics (only if you allow it)
Data: pages you view, clicks on links to /join and to Skool, that a form was sent successfully (never your name, email or message), the article you opened, your browser and device type, and an approximate location that Google works out from your IP address.
Why: to understand how visitors use the site and improve it.
Legal basis: your consent (GDPR Art. 6(1)(a)). Nothing is loaded or sent to Google until you accept analytics in the cookie banner.
Running the website
Data: when any page loads, the hosting service processes technical details such as your IP address, browser type and the page requested. Its built-in visitor statistics count visits, pages viewed, the site you came from, your browser and device type, and a country estimated from your device's time zone.
Why: to deliver pages, keep the site secure and see basic visit numbers.
Legal basis: my legitimate interest in running a secure, working website (GDPR Art. 6(1)(f)).
Name and email are needed to send you the guide, the invitation or a reply. Without them I can't provide these. I don't sell your data, use it for advertising, or make automated decisions about you.
Cookies and browser storage
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
| aipm-analytics-consent | This site (browser storage) | Essential. Remembers your cookie choice. | 12 months, then you're asked again |
| __cf_bm | Cloudflare (hosting network) | Essential. Helps tell people from automated bots. | 30 minutes |
| session-id | Lovable (hosting) | Groups page views of one visit for the basic visitor statistics. | 30 minutes |
| _ga, _ga_* | Google Analytics | Optional. Only set if you accept analytics. | Up to 2 years, deleted when you withdraw consent |
You can accept, reject or change analytics at any time in , also found in the footer of every page. Rejecting doesn't limit anything on the site.
Who processes your data for me
- Lovable: website hosting, which runs on Cloudflare's network, and the service that passes my emails to Resend.
- Supabase: the database that stores form entries, and file storage for the guide PDF and blog images.
- Resend: sends the guide email, the community invitation and contact-form notifications.
- Google: Google Analytics (only with your consent) and Gmail, where I receive contact-form notifications.
Links to Skool and Instagram take you to their sites, where their own privacy policies apply.
Some of these providers may process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on the safeguards each provider offers, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long I keep it
- Guide and community signups: until you withdraw consent or ask me to delete them.
- Contact messages: until you ask me to delete them, or I delete them once they're no longer needed.
- Google Analytics: for the retention period set in my Google Analytics account. Analytics cookies are deleted from your browser when you withdraw consent.
- Your cookie choice: 12 months.
Your rights
Under the GDPR you can ask me to:
- give you a copy of the personal data I hold about you,
- correct it if it's wrong,
- delete it,
- limit how I use it,
- send it to you or another service in a common format, and
- stop using it where I rely on legitimate interest.
Where I rely on your consent, you can withdraw it at any time. This doesn't affect anything done before. To stop receiving emails or use any of these rights, send me a message through the contact form. To withdraw analytics consent, use .
You can also complain to the data protection authority in the EU country where you live, work, or where you think the problem happened.
Changes
If this policy changes, I'll update this page and the date at the top.