Privacy Policy

Effective date: 11 October 2026

In brief

We collect the details you type into our forms (your name and email address and, depending on the form, your message, the type of enquiry, or a book code or receipt) so we can reply, send you what you asked for, or send the newsletter you signed up to. We also use contact-form enquiries to measure whether our adverts lead to enquiries.
The site uses cookies and similar browser storage for analytics (Google Analytics and Searchable Analytics), for measuring our ChatGPT adverts (OpenAI), to remember which campaign link brought you here, for security (Cloudflare) and for embedded content (YouTube videos and an Instagram feed). The full list is in section 5.
We do not show a cookie banner or ask before these are used. You can block or delete them in your browser at any time (section 6).
Google Analytics does not receive your name, email address or message from our forms. OpenAI never receives your message. If advanced matching is switched on, OpenAI receives a scrambled (hashed) version of the name and email address in your enquiry; we use it only to measure our adverts, and OpenAI handles it under its own privacy policy (sections 5 and 8).
Some companies whose content or tools appear on the site, such as YouTube, also use information for their own purposes (section 8).
Our service providers process data in the United States and other countries (section 9).
You can ask to see, correct or delete your information by contacting us (sections 12 and 16).

1. Who we are

This policy explains how Moustafa Hamwi ("we", "us", "our"), based in Dubai, United Arab Emirates, collects and uses personal information through moustafa.com (the "site").

We decide how and why this information is used, and we are responsible for it. Where another company also uses information for its own purposes, section 8 says so. Our contact details are in section 16.

2. What this policy covers

This policy covers information collected when you visit the site, fill in one of its forms, email us, or arrive on the site from one of our adverts or campaign links. It does not cover other websites, including sites we link to (section 14).

3. Information you give us

You can browse the site without telling us who you are. You do not have to fill in any form, but without your email address we cannot reply to you or send you what you ask for.

Contact form

The contact form on our contact page collects your first name, last name and email address and, if you choose to give them, the type of enquiry (chosen from a list) and your message. We use these to reply to you and deal with your enquiry, and to measure whether our adverts lead to enquiries (section 5, "Our campaign record" and "OpenAI advertising measurement").

The newsletter form at the bottom of every page collects your first name, last name and email address. We use them to send you our newsletter. You can unsubscribe at any time using the link in any newsletter email, or by contacting us.

Requests for free material

Some of our book pages let you request free material. These forms collect your name and email address and, on some pages, a code or receipt. We use these details to provide the material you asked for. If you also receive our newsletter, you can unsubscribe at any time using the link in any newsletter email.

Emails to us

If you email us, for example at [email protected], we receive your email address, your name as it appears in your email, and whatever you write. We use them to reply to you and deal with your request.

What else is sent with a form

When you submit a form, the following may be sent with it:

the address of the page you submitted it from, including any campaign tags in that address
a one-time spam-check token from Cloudflare Turnstile (section 5)

When you submit the contact form, it also carries the campaign values described under "Our campaign record" in section 5, if your browser has stored any.

Where form submissions go

Form submissions are collected and stored by Webflow, our website host, in the United States, and sent by email to our team. Newsletter sign-ups are also held by the service we use to send the newsletter.

If advanced matching is switched on, a scrambled version of the name and email address in a contact-form enquiry also goes to OpenAI (section 5).

Google Analytics records that one of these forms was started or submitted, but it does not receive what you type into them (section 5).

Site search

If you use the search box on the site, the words you type become part of the address of the results page. Webflow uses them to show you results, Google Analytics records them as a search term, and Searchable Analytics receives them as part of the page address. Please do not type personal details into the search box.

4. Information collected automatically

Server and security logs

When you visit the site, Webflow and Cloudflare (the network that delivers and protects the site) automatically receive the technical information your browser sends with every request, such as your IP address, your browser and device type, the pages you request, and the date and time. It is used to deliver the site and protect it from abuse. If a page fails to load, your browser may also send a short technical error report to Cloudflare.

Cookies and similar technologies

A cookie is a small text file that a website stores in your browser. Local storage and session storage are similar: they let a website keep small pieces of information in your browser.

We do not show a cookie banner or ask for your agreement before these technologies are used. The analytics, advertising measurement and embedded-content technologies described in section 5 run for all visitors. You can block or delete them at any time (section 6).

5. The services we use

Google Analytics

We use Google Analytics 4, a web analytics service provided by Google. Its script is delivered from our own web address, through Cloudflare, rather than from a Google web address, so some browser tools that block Google Analytics by its usual address may not block it on this site.

Google Analytics uses cookies (listed in the table below) to recognise your browser and count visits. It collects:

the pages you view, how long you stay, and how you reached the site (for example from a search engine, another website or a campaign link)
your approximate location (such as country or city), estimated from your IP address
your device type, browser, operating system, screen size and language
what you do on the site: scrolling, clicks on buttons and links (including links to other sites), file downloads, video plays, starting and submitting forms, and the words you type into the site search

How we have set it up:

Google Analytics does not receive what you type into our contact, newsletter or free-material forms, such as your name, email address or message.
Google's email-redaction feature is switched on, to reduce the chance of an email address being collected by mistake.
Google signals (which links activity to signed-in Google accounts) is switched off.
No Google Ads account is linked, and we do not use Google Analytics for advertising.
Detailed Google Analytics data is kept for 14 months. Summary figures, such as how many visits a page received, may be kept longer.

Google explains how it uses this information on its page "How Google uses information from sites or apps that use our services": https://policies.google.com/technologies/partner-sites

Searchable Analytics

We use Searchable Analytics, provided by Searchable, to understand how visitors reach the site, including visits that come from AI assistants, and how they use it. Searchable acts as our service provider. Each time you view a page, its script sends Searchable:

the page address and title, the page you came from, and any campaign tags (utm values) in the address
your screen size, browser language and time zone
how long you spend on the page, how far you scroll, links you click to other sites, files you download, and how quickly the page loads
a random visitor ID and a visit (session) ID

Like any website you connect to, Searchable's servers also receive your IP address and browser details.

The visitor ID is kept in a cookie and in your browser's local storage, and the current visit in session storage (see the table below). There is no switch on the site to turn Searchable Analytics off. Clearing cookies and stored site data for moustafa.com removes the visitor ID (deleting cookies alone does not remove the copy kept in local storage), but a new ID is created on your next visit. Blocking cookies and site data for moustafa.com stops the ID being stored, although the page information listed above may still be sent.

OpenAI advertising measurement

We may advertise in ChatGPT. To see whether these adverts lead to enquiries, we use OpenAI's Ads measurement pixel, a small script provided by OpenAI that loads on every page of the site.

When you click one of our ChatGPT adverts, the link to our site carries a click reference. The pixel stores it in a cookie called __oppref, which is set only when you arrive from one of our adverts. It lasts 30 days, and the 30 days start again each time you arrive from one of our ChatGPT adverts.
The pixel also sets a cookie called __obref, which holds a randomly generated reference for your browser on our site. It lasts 365 days and can be recreated on your next visit if you delete it.
Each time a page loads, the pixel sends OpenAI short technical notices that it has started. These carry the time, the address of the page (without any campaign tags), the address of the page you came from, and the references above. When an enquiry is successfully sent through the contact form on our contact page, the pixel also sends an enquiry notice with the same details and, if advanced matching is switched on (see below), a scrambled version of your name and email address. No notice is sent for newsletter sign-ups or for any other form.
OpenAI matches these notices to activity on our adverts in ChatGPT, such as clicks, and tells us how many enquiries followed our adverts.

OpenAI's "automatic advanced matching" may be switched on. When it is on, the pixel looks for contact details entered on our site, such as the name and email address in our contact form, scrambles them in your browser (a one-way process called hashing) and includes only the scrambled values in the enquiry notice it sends to OpenAI, so that OpenAI can check whether the enquiry came from someone who saw or clicked our adverts, by comparing them with the scrambled details it holds. Your name and email address are never sent in readable form, and the content of your enquiry is not sent. We do not send OpenAI any information from our own servers. Like any website you connect to, OpenAI receives your IP address and browser details when the pixel loads. OpenAI uses the information it receives under its own privacy policy, which is on its website.

Your choices: there is no switch on the site to turn the pixel off. Blocking these cookies makes it harder to link an enquiry to one of our adverts, but may not stop the measurement completely. Browser tools that block scripts from other websites can stop the pixel loading altogether, which also stops advanced matching. To ask us to delete campaign information linked to your enquiry, contact us (section 16); we cannot delete what OpenAI has already received.

Our campaign record

Links to our site from adverts and emails can carry campaign tags. When you arrive through such a link, our own code saves five of these values (source, medium, campaign, content and campaign ID: utm_source, utm_medium, utm_campaign, utm_content and utm_id), together with the time they were saved, in your browser's local storage (not in a cookie). If you later arrive through another tagged link, the new values replace the whole record.

The record expires 30 days after it was saved and is not used after that. It is not sent anywhere unless you submit the contact form within those 30 days; if you do, the five values are added to your enquiry. We use them only to see which campaign an enquiry came from. (Google Analytics and Searchable Analytics separately read campaign tags from the page address, as described above.)

Security and spam protection: Cloudflare

Cloudflare sits between your browser and the site. When certain security rules are in use, it may set a cookie called _cfuvid so that those rules can tell apart visitors who share the same IP address. If set, this cookie is needed for the site's security and is deleted when you close your browser.

Our forms use Cloudflare Turnstile to check that submissions come from a person and not from an automated program. Because the newsletter form appears on every page, Turnstile loads on every page you view, not only when you submit a form. Cloudflare processes your IP address, browser details (user agent), a technical fingerprint of your connection (TLS fingerprint), a code that identifies our site to Turnstile, and the website address. Cloudflare states that Turnstile does not set a cookie by default. Cloudflare uses this information to detect bots for us, and also for its own purpose of improving Turnstile. Cloudflare's Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/

Website hosting, delivery and scripts

Webflow hosts the site and stores form submissions. Some of the scripts the site uses are delivered through content delivery networks (networks of servers that deliver files quickly): Amazon CloudFront, and jsDelivr, a public network. When they deliver a file, these networks receive your IP address and browser details, which they use to deliver the file and run their networks.

Kartra. One of our book pages (/book/live-passionately) still loads a script from Kartra, a marketing and mailing-list service. The script is left over from an earlier version of the page, and we plan to remove it. When that page loads, Kartra receives your IP address, browser details and the page address, and may set cookies.

Instagram feed: Elfsight

The site shows an Instagram feed, displayed through a service from Elfsight, a company based in Andorra. On pages where the feed appears, Elfsight's script loads with the page. Elfsight receives your IP address, operating system and browser type, which it states it keeps for 7 days to detect faults and abuse. When the feed loads, it sets one cookie, elfsight_viewed_recently, which lasts 15 seconds. If the feed's images load from Instagram's own servers, Instagram (Meta) also receives your IP address and browser details.

Embedded videos: YouTube

Some pages show videos hosted on YouTube, a Google service: our blog's podcast and interview pages, our home page and our speaking page. On some pages the video is shown through Embedly, a service our website platform uses to display videos. YouTube and Embedly may receive your IP address, browser details and the page address when the page loads or when you play a video, and may set cookies at that point.

YouTube uses its cookies for its own purposes, under Google's privacy policy. Google says they are used for security and to detect spam and fraud, to remember playback preferences, for analytics and, depending on your Google settings, for personalised recommendations and advertising. Google describes YouTube's cookies at https://policies.google.com/technologies/cookies. The table below lists the main ones; YouTube may set others.

Cookie and storage table

Name	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes one visitor from another	2 years
_ga_RKKFFNMK9M	Google Analytics	Keeps track of your current visit	2 years
_sa_id (cookie)	Searchable Analytics	Random visitor ID and a count of visits	2 years
sa_id (local storage)	Searchable Analytics	Copy of the same visitor ID	Until you clear it
sa_session, sa_retry (session storage)	Searchable Analytics	Tracks your current visit; holds analytics messages that failed to send so they can be retried	Until you close the browser tab
__oppref	OpenAI (set on moustafa.com)	Click reference from one of our ChatGPT adverts; set only when you arrive from one	30 days, restarting each time you arrive from one of our ChatGPT adverts
__obref	OpenAI (set on moustafa.com)	Random reference for your browser on this site	365 days
Campaign record (local storage)	moustafa.com (our own code)	Remembers the five campaign values from the last tagged link you arrived through, and when they were saved	30 days
_cfuvid	Cloudflare	Security: may be set to tell apart visitors who share an IP address	Until you close your browser
__cf_bm	Cloudflare, through OpenAI's measurement service on bzr.openai.com	May be set to protect the service against automated traffic	30 minutes of inactivity
elfsight_viewed_recently	Elfsight	Stops the Instagram feed counting the same visitor twice within 15 seconds	15 seconds
YSC, __Secure-YNID, __Secure-YENID, PREF, AEC (or older equivalents such as VISITOR_INFO1_LIVE and __Secure-YEC)	YouTube (Google), set by YouTube on its own websites	Security and detecting spam and fraud, playback preferences, analytics and, depending on your Google settings, personalised recommendations and advertising	YSC: until you close your browser · others: 6 to 13 months
Kartra cookies, if any	Kartra	Set by Kartra's script on /book/live-passionately (see above)	As set by Kartra

Durations are the maximum. Your browser may delete some cookies sooner, for example if you do not return to the site.

6. Your choices about cookies

Browser settings. You can block cookies, delete cookies, or clear all stored data for moustafa.com (which also removes local and session storage). Your browser's help pages explain how. Clearing data for moustafa.com does not clear cookies that other providers, such as YouTube, set on their own websites, and it does not erase records that services have already received.
Google Analytics. Google offers the Google Analytics Opt-out Browser Add-on for supported browsers: https://tools.google.com/dlpage/gaoptout
Private browsing. Most browsers delete cookies and stored site data when you close a private window. Private browsing is not an opt-out: it does not stop the services in section 5 collecting information during your visit.
Browser privacy signals. The site does not currently change what it collects when your browser sends a Do Not Track or Global Privacy Control signal.

Blocking cookies stops them being stored in your browser, but some of the services in section 5 may still receive information about your visit, such as your IP address and the page you view, when the page loads. The site's pages and forms do not rely on the analytics, advertising or video cookies, so most of the site works without them.

7. How we use your information

We use personal information to:

reply to enquiries and deal with requests
send the newsletter to people who sign up
provide free material that people ask for
understand how the site is used, so we can improve it
measure whether our adverts and campaigns lead to enquiries
keep the site and its forms secure and free of spam
comply with the law and protect our legal rights

We do not sell or rent your contact details to anyone. We do not buy personal information from other companies.

Automated decisions. We do not use computer programs or profiling to make, or substantially help make, decisions about you that have a legal effect on you or affect you in a similarly significant way. Our automatic security checks, such as the spam check on our forms (section 5), may occasionally block a genuine visitor or form submission. If that happens to you, email us instead (section 16).

8. Who we share it with

We share personal information only in these ways:

Service providers who work for us. These process information to provide their services to us, as described in sections 3 and 5. They include Webflow (hosting and forms), Embedly (which Webflow uses to display some videos), Cloudflare (delivery and security), Amazon CloudFront and jsDelivr (file delivery), Google (Google Analytics), Searchable, Elfsight, and the services we use for email and to send the newsletter.
Companies that also use information for their own purposes. When their content or tools load on the site, these companies receive information about your visit and use it under their own privacy policies:

- YouTube (Google), for the purposes described in section 5

- Google, which may use Google Analytics information as explained on its page linked in section 5

- Cloudflare, which also uses Turnstile information to improve Turnstile

- OpenAI, which matches enquiry notices to our adverts (including, if advanced matching is on, scrambled names and email addresses)

- Meta, if the Instagram feed's images load from Instagram's servers

Our team and people who help us run the site, such as our website developer, who may see form submissions and must keep them confidential.
Legal requirements. We may disclose information in response to a court order or other legal process; to establish, exercise or defend our legal rights; where we believe it is necessary to investigate or prevent illegal activity, suspected fraud or threats to anyone's safety; or where the law otherwise requires it.
Change of ownership. If the site or our business is sold, transferred or merged, personal information may pass to the new owner, to be used in line with this policy.

9. International transfers

We are based in Dubai, United Arab Emirates. The services we use process personal information in other countries, which may be outside the country where you live:

United States: Webflow stores form submissions there, and Google (including YouTube), Cloudflare and OpenAI are based there and may process data there and in other countries.
United Kingdom: Searchable processes data there.
Andorra: Elfsight is based there.
Worldwide: Cloudflare, jsDelivr and Amazon CloudFront run global networks, so your requests may be handled in the country nearest to you.

Other providers we use, and people who help us run the site, such as our website developer, may be in other countries. These countries may have different data protection laws from yours. We rely on our providers' standard data-protection terms to protect the information they process for us. Companies that use information for their own purposes (section 8) handle it, including any transfer abroad, under their own privacy policies.

10. How long we keep it

Enquiries: up to 24 months after our last contact with you
Newsletter subscribers: until you unsubscribe; after that we keep a minimal record so we do not email you again
Requests for free material: up to 24 months after your request
Google Analytics: 14 months for detailed data; summary figures may be kept longer
Searchable Analytics and OpenAI: as kept by those providers under their own terms
Elfsight technical logs: 7 days, according to Elfsight
Server and security logs: as kept by our hosting and security providers under their own policies
Our campaign record in your browser: 30 days
Other cookies and browser storage: as shown in the table in section 5. Clearing your browser removes these from your device but does not erase records already held on servers.

We may keep information for longer if the law requires it, or if we need it to deal with a legal claim.

11. Keeping it secure

The site is served over an encrypted (HTTPS) connection, and our forms are protected against automated spam. No website or storage system is completely secure, so we cannot guarantee the security of information sent to us.

If a security breach affects your personal information, we will act to limit the harm. Where the law requires it, we will tell you and the relevant authorities.

12. Your rights

Depending on where you live and the law that applies to you, you may have the right to:

ask for a copy of the personal information we hold about you, and for details of how we use it
ask us to correct it or complete it
ask us to delete it
object to, or ask us to limit, how we use it, including for analytics or advertising measurement (if we limit how we use it at your request, we will tell you before we lift that limit)
ask us to stop using it for direct marketing, such as our newsletter
withdraw your consent at any time where we rely on it, for example for the newsletter (this does not affect anything done before you withdrew it)
receive the information you gave us in a commonly used, machine-readable format, or ask us to send it to another organisation where that is technically possible

To make a request, email us or use the contact form on our contact page (section 16). We may need to confirm your identity first. We will reply within 30 days. Some rights have limits; if we cannot do what you ask, we will tell you why.

Much of the analytics and advertising information described in section 5 is linked to a random ID rather than to your name (if advanced matching is on, OpenAI's enquiry notice is also linked to a scrambled version of your name and email address), so we may not be able to find it. Deleting cookies and site data in your browser removes those IDs from your device, but it does not erase records the services have already received.

Complaints

If you are unhappy with how we have handled your personal information, please contact us first (section 16). We will look into your complaint and reply within 30 days. If you are still unhappy, you can complain to the data protection authority where you live. In the United Arab Emirates, where we are based, that is the federal data protection authority. In Australia, it is the Office of the Australian Information Commissioner (www.oaic.gov.au).

13. Children

The site is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, contact us and we will take steps to delete it.

14. Links to other websites

The site links to other websites. We are not responsible for their content or privacy practices. Please read the privacy policy of any site you visit, especially before giving it personal information.

15. Changes to this policy

We check the services described in section 5, and how they are set up, regularly. We may update this policy. When we do, we will publish the new version on this page and change the effective date at the top.

16. Contact us

For questions about this policy, or to make a request about your personal information, contact Moustafa Hamwi (Dubai, United Arab Emirates):

Email: [email protected]
Contact form: moustafa.com/contact (choose "Other" as the type of enquiry)

This policy is free to read on this page. If you need it in another format, contact us.

‍