Privacy policy

Controller

The data controller is Imad El Malki Jaddi. You can contact me at imadelmalkij@gmail.com.

Data and purposes

The form and mail command process the email address, subject and message you enter so I can answer your enquiry or prepare the services you request. The assistant sends your question and its recent conversation history to OpenAI to generate a response.

To prevent abuse, the IP address is transformed with an HMAC before requests are counted. First-party analytics records the event type, path, view and the text of the questions typed to the assistant, with no IP, cookies, user agent or session identifier: they cannot be attributed to a person or linked to one another. Questions are kept to learn what people want to know about this profile and to improve what the site says; the assistant's answer is not kept.

Legal basis

Answering an enquiry about a possible engagement relies on taking pre-contractual steps at your request. Other enquiries and service security rely on the legitimate interests of replying, keeping the portfolio available and preventing abuse. There is no consent checkbox because the requested submission does not rely on consent.

Providers and recipients

Cloudflare provides the infrastructure, rate limiting, analytics and technical email delivery. The mailbox provider stores the received conversation. OpenAI processes questions sent to the assistant. They act as processors or necessary categories of recipient for each feature; data is not sold.

International transfers

Questions sent to the assistant are processed by OpenAI, based in the United States, so that particular processing leaves the European Economic Area and must rely on an adequacy decision or safeguards such as standard contractual clauses. The database that counts request frequency is created in Cloudflare's European jurisdiction. You can ask the controller for information about the safeguards that apply.

Retention

Enquiries and related correspondence are kept only as long as needed to reply and for no longer than 12 months, unless a legal obligation or subsequent relationship justifies another period. HMAC rate-limit counters stop having any effect once their window expires, which lasts at most 24 hours, and the row itself is deleted on the first request after that expiry. First-party analytics records, including those questions, are kept for three months, which is Cloudflare Analytics Engine's retention period.

Your rights

You can request access, correction, erasure, objection, restriction or portability where applicable by writing to imadelmalkij@gmail.com. You may also withdraw consent if a future operation ever relies on it, without affecting earlier processing.

If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (www.aepd.es). AEPD