Effective date: 3 November 2026

Updated 3 November 2026: this version adds my Instagram account, the services that handle it and the AI assistant I use.

This policy explains what personal information sturdyshelf.com and my Instagram account, @sturdy.shelf, collect, why, who else handles it, and what you can ask me to do with it. I've kept it short and plain.

 

WHO I AM

Sturdy Shelf is run by one person, Ahmed Sameer Bahlawan (shown as Ahmad Bahlawan on Gumroad), based in Saudi Arabia. I'm not a company. I decide how the personal information described here is used, so I'm responsible for it (in legal terms, the "controller").

Contact for anything about privacy: abahlawan@gmail.com

 

I also run the Instagram account @sturdy.shelf. Nora, who appears on that account, is a fictional AI character. She isn't a person and isn't responsible for your information; I am. If you comment or message there, I receive your handle, your name if your profile shows one, and what you write, through Instagram (Meta) and Manychat, which sends the first automated messages. I use this only to answer you and send what you asked for. Legal basis: my legitimate interest in answering people who write to me. My AI assistant, Claude (Anthropic), connected through Composio, reads new comments and messages, writes me a daily summary and sends replies I approve. My daily summary lists only your handle and a link while a reply is waiting. I don't delete Instagram messages on a schedule. They stay in my Instagram inbox and Manychat until you ask me to delete them, or until I close the account. If you ask, by Instagram message or by email, I'll delete your messages and your Manychat contact within 30 days. That doesn't remove the copy in your account or what Instagram and Anthropic keep under their own policies, and Composio keeps what passes through it for up to one year. Comments are public. They stay on the post until you or I delete them. Please don't send health details there.

 

WHAT THIS SITE COLLECTS

1. What you send me by email: your email address, any name shown on your email or in your message, and your message. Please don't include medical or health details.

2. Technical information collected automatically when you visit, through cookies and similar tools set by Wix, the platform that hosts this site. This can include your IP address, browser and device type, the pages you view, and when you visit.

This site does not ask for health information, and no form on it asks about your health, weight, medication or age.

If you live in Washington State or Nevada, my Consumer Health Data Privacy Policy, linked at the bottom of every page, also applies. It explains how I handle any information that could say something about your health, such as a message that mentions it or a purchase of the Eat Enough guide.

 

WHY I USE IT

- To read and reply to your message. Legal basis: my legitimate interest in answering people who write to me.

- To keep the site working and secure, including Wix's platform monitoring and error reporting, which sends Wix technical details on every visit, such as your IP address, browser, the page loaded and how it performed. Legal basis: my legitimate interest in running a safe, working website. And, only if you agree in the cookie banner, to see site statistics, such as how many people visit and which pages are read. Legal basis: your consent.

- To meet a legal obligation, such as keeping tax records.

I don't sell your personal information, I don't share it for advertising, and I don't use it to make automated decisions about you.

If you send health details by email anyway, I'll use them only to answer you, and I'll delete that message from my inbox within 30 days of my last reply. If it passed through Composio, its copy stays for up to one year.

 

BUYING A GUIDE

Purchases don't happen on this site. The Buy buttons take you to Gumroad, which handles checkout, payment, any sales tax or VAT, and delivery of the file. Gumroad collects your payment details under its own privacy policy: https://gumroad.com/privacy. Gumroad doesn't give me your card number.

When you buy, Gumroad shares some order details with me as the seller, such as your email address and what you bought. I use them only to deal with your order, refunds and questions about it, and to keep the business records the law requires. The legal basis is carrying out your purchase and the record-keeping the law requires.

 

WHO ELSE HANDLES YOUR INFORMATION

- Wix (Wix.com Ltd.) hosts this site. Wix says it may store site data in data centers in the United States, Ireland, South Korea, Taiwan and Israel. Wix's privacy policy: https://www.wix.com/about/privacy

- Usercentrics (Usercentrics GmbH, Germany) runs the cookie banner for me. It records your cookie choice, such as a consent ID, the time and whether you accepted or declined, so the site can respect it. Usercentrics says it stores this in Germany and Belgium and deletes it after 12 months. Its privacy policy for this service: https://usercentrics.com/wix-privacy-policy/

- Gumroad (Gumroad, Inc., United States) handles purchases, as described above.

- My email provider, Google (Gmail), when I receive and reply to your message.

- Instagram (Meta) carries comments and messages and handles them under its own privacy policy: https://privacycenter.instagram.com/policy

- Manychat (Manychat, Inc., United States) sends the first automated messages on Instagram and stores those conversations in my account. Its privacy policy: https://manychat.com/legal/privacy

- Composio (Sampark Inc) connects my AI assistant to my accounts. It handles the Instagram comments and replies described above, and the emails in my inbox that it reads. Its privacy policy: https://composio.dev/privacy

- Anthropic makes that assistant, Claude, and handles the same information under its own privacy policy: https://www.anthropic.com/legal/privacy. I've turned off the setting that lets it train its models on my chats. Anthropic's policy lists exceptions, such as chats flagged for safety review.

- Authorities, if the law requires it.

I'm based in Saudi Arabia, and Wix, Usercentrics, Gumroad, Meta, Manychat, Anthropic and my email provider store data in other countries, including the United States. Composio's privacy policy doesn't say where it stores data. So your information is handled outside your country, where privacy laws may differ from yours. Wix and Gumroad publish the terms they follow when they handle information for me as my service providers. Wix's Data Processing Agreement says that information sent from the European Economic Area, the UK or Switzerland goes first to Wix in Israel, under the European Commission's adequacy decision, and that onward transfers to countries without one use the European Commission's standard contractual clauses or similar safeguards: https://www.wix.com/about/privacy-dpa-users. Gumroad's Data Processing Addendum, which covers what Gumroad handles for me as a seller, says it uses the European Commission's standard contractual clauses (with the UK addendum for UK transfers) for information sent from those places to countries without an adequacy decision: https://gumroad.com/dpa. Google explains how it handles data transfers in its privacy policy: https://policies.google.com/privacy.

 

COOKIES

Wix places some cookies that the site needs to work and stay secure, and Wix's platform monitoring and error reporting runs on every visit. Wix treats these as essential, so they are always on and I can't switch them off. Other cookies, such as ones used for site statistics, are only used if you agree to them in the cookie banner. You can change your choice at any time with the cookie settings button on the site, and you can block or delete cookies in your browser settings.

I don't currently respond to "Do Not Track" browser signals. I haven't added any third-party tools that track you across other websites. Wix lists its cookies, what each one does and how long it lasts at https://support.wix.com/en/article/cookies-and-your-wix-site.

The cookie banner uses its provider's standard wording, which mentions advertising; this site shows no ads and uses no advertising or cross-site tracking cookies.

 

HOW LONG I KEEP IT

- Emails you send me and my replies: up to 24 months after our last exchange, then deleted.

- Emails that include health details: deleted from my inbox within 30 days of my last reply. If it passed through Composio, its copy stays for up to one year.

- Instagram messages: kept in my Instagram inbox and Manychat until you ask me to delete them or I close the account. There's no fixed deletion date. If you ask, I'll delete them within 30 days. Instagram, Anthropic and Composio keep their own copies, as described under WHO I AM.

- My daily summary lists only your handle and a link while a reply is waiting.

- Instagram comments: they stay on the post until you or I delete them.

- Order details from Gumroad: as long as tax and business record-keeping rules require.

- Cookies: for the periods set by Wix, listed on the Wix page linked above. Your cookie-banner choice is kept by Usercentrics for 12 months.

 

YOUR RIGHTS

Depending on where you live, you can ask me to:

- tell you what personal information I hold about you and give you a copy;

- correct it;

- delete it;

- stop using it, or use it less, and object to how I use it;

- send it to you in a common format;

- withdraw any consent you gave, at any time. This doesn't affect anything done before you withdrew it.

I'll do this for anyone who asks, wherever they live, except where the law requires me to keep something (for example, order records for tax). Email abahlawan@gmail.com. I may need to check that the request comes from you. I'll reply within 30 days.

If you're unhappy with how I've handled your information, please tell me first. You can also complain to the data protection authority where you live, for example your national authority in the EU, the Information Commissioner's Office in the UK, or the Saudi Data & Artificial Intelligence Authority (SDAIA) in Saudi Arabia.

 

CHILDREN

This site and its guides are for adults. I don't knowingly collect information from anyone under 16. If you think a child has sent me their details, email me and I'll delete them.

 

SECURITY

I keep access to the Wix, Gumroad, Instagram and Manychat accounts limited to me and the AI assistant described above, and use the security settings those services offer. No website or email system is perfectly secure, so please don't send anything by email that you'd want kept strictly private.

 

CHANGES TO THIS POLICY

If I change this policy, I'll post the new version on this page with a new effective date. If a change is significant, I'll say so at the top of the page.