Privacy policy

1. Who is responsible

Salaheddine Elfatimi, freelance web developer, Marrakech, Morocco. Email: job.elfatimi@gmail.com.

2. What the public site collects

• Contact form. Your name, email, phone number, message, the service and timeline you pick, the page you sent it from and its language. It's used only to answer your request and follow up on it. It's stored in the site's database, and an email notification is sent to me through Resend.
• Visit statistics (first-party, no cookie). For each page view: the page, the referring site, the approximate country, the browser language, the device type, browser and operating system, the time spent on the page, and an anonymous visitor code that doesn't identify you. No IP address is stored.
• Google Analytics. The site also uses Google Analytics, which sets cookies, to measure visits in aggregate. Google processes this data under its own privacy policy.
• Chat assistant. Messages you type in the site's chat are sent to Google's Gemini API to generate the answer. Don't share sensitive information in the chat.

3. The private dashboard and connected accounts

The site has a private dashboard used only by me, the site owner (sign-in with GitHub, limited to my account). From it, I connect my own YouTube, LinkedIn and Instagram accounts to publish my own content. It doesn't access the accounts of visitors or anyone else.

YouTube (Google API Services). With my permission, given through Google's sign-in, the dashboard uses YouTube API Services to:

• upload my videos to my own YouTube channel, with the title, description and tags I write;
• read my channel's name, picture and handle, and its statistics (subscribers, views, watch time, recent videos and their view, like and comment counts) to show them on the dashboard.

The Google access token is stored encrypted (AES-256-GCM) in the site's database so the dashboard can act for me without asking every time. The statistics are read when the dashboard page opens and are not stored. This data is never sold, shared with third parties, or used for advertising.

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

By using YouTube features through the dashboard, the account owner agrees to the YouTube Terms of Service; Google's handling of the data is described in the Google Privacy Policy. Access can be revoked at any time in Google account permissions or with "Disconnect" on the dashboard, which deletes the stored token.

LinkedIn and Instagram. The dashboard publishes my posts on my own LinkedIn profile and Instagram account through their official APIs. Their access tokens are stored encrypted the same way and deleted when I disconnect.

4. Cookies

The site itself doesn't set cookies for visitors: its visit statistics work without them, and the language comes from the address (/, /fr, /ar). Google Analytics sets its own cookies. The dashboard uses a sign-in cookie for the site owner only.

5. Who processes the data

• Hosting: the site and its database run on a server rented from Contabo, in the European Union.
• Email: Resend sends the contact-form notifications.
• Google: Gemini (chat answers), Google Analytics (visit measurement), YouTube API Services (dashboard, my own channel).
• Anthropic: Claude helps me write blog posts and social media texts in the dashboard. Visitor data isn't sent to it.
• GitHub: dashboard sign-in for the site owner.

Data isn't sold or rented to anyone.

6. How long it's kept

• Contact requests: as long as needed to handle your request and follow up, and at most 3 years after our last exchange, or until you ask me to delete them.
• Visit statistics: up to 2 years.
• Connected-account tokens: until the account is disconnected.

7. Your rights

You can ask to see, correct or delete the data I hold about you, or object to its use, by writing to job.elfatimi@gmail.com. I answer within 30 days. These rights come from Moroccan law 09-08 on personal data protection and, for visitors in the European Union, the GDPR.

8. Security

The site is served over HTTPS only. Access tokens are encrypted, the dashboard is limited to the owner's account, and the database isn't reachable from the public site.

9. Changes

If this policy changes, the new version is published on this page with its date.