Privacy policy
This is a draft pending legal review and may change before it is finalized. It explains what personal data the Miraya website processes, why, how long we keep it and what rights you have.
Who is responsible
The controller of your personal data on this website is Moncef El hirech, who runs Miraya, a virtual digital agency. Contact: hirechsec@gmail.com.
CNDP declaration/authorization number: To confirm· CNDP declaration/authorization number. For any privacy question, contact hirechsec@gmail.com.
Legal framework
We process personal data in accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, under the supervision of the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel).
For visitors in the European Union, we also follow the core principles of the General Data Protection Regulation (GDPR), including a lawful basis for each processing activity and respect for the rights described below.
What we collect and why
Contact form: your name, email address, company (optional), project type, budget range, timeline and message. We use this to reply to your request and discuss your project. It is stored in Supabase on servers in the European Union (Paris).
Abuse prevention: we never store your IP address in plain form. We keep only a salted hash of it, used solely for rate limiting and to prevent spam and abuse. We also use Cloudflare Turnstile to check that forms are not submitted by bots.
Newsletter: if you subscribe, we keep your email address and the date you confirmed. Subscription requires double opt-in through a confirmation link, and every email includes a one-click unsubscribe link.
Client portal: clients sign in with a magic link sent to their email address (Supabase Auth), with no password. We process the email address, session data and the project content shared in the portal to deliver the agreed service.
Testimonials: if you agree to us publishing what you said about our work, we keep your name, role and company (both optional), your words, your photo if you provide one, and the date you agreed. Nothing is published without recorded consent, and any translation of your words is labelled as one.
“Ask Miraya” assistant: if you use this optional assistant, your questions are sent to Anthropic through the Claude API to generate answers. Please do not share personal or sensitive information in it. Miraya does not keep these conversations: neither questions nor answers are logged or stored.
Analytics: we use Vercel Analytics to measure visits in aggregate, in a privacy-friendly way and without advertising profiles. If PostHog is enabled, it runs in cookieless mode only. PostHog is not enabled at the moment.
Lawful bases
Consent, for the newsletter and the “Ask Miraya” assistant. You can withdraw your consent at any time; this does not affect processing that took place before.
Steps taken at your request before entering into a contract, or performance of a contract, for contact requests and client portal accounts.
Our legitimate interest in securing the website, preventing abuse and understanding its use in aggregate, provided this interest does not override your rights and freedoms.
Service providers and transfers
We rely on providers that process data on our behalf and under our instructions: Vercel for hosting and analytics, Supabase for the database and authentication (EU region, Paris), Resend for sending email, Cloudflare for bot protection (Turnstile), Anthropic for the “Ask Miraya” assistant, Sentry for error reports (technical details only, with no name, email or account attached), and PostHog for analytics if enabled. Cal.com (appointment booking) and YouTube (privacy-enhanced mode, for some videos) load only when you choose to open the calendar or press play, and each has its own privacy policy.
Some of these providers may process data outside Morocco, including in the European Union and the United States. We make sure any transfer abroad follows the requirements of Law 09-08 and CNDP guidance, and uses appropriate safeguards under the GDPR. To confirm· CNDP authorization for international transfers, and safeguards used (e.g. standard contractual clauses).
We do not sell or rent your personal data, and we do not share it for advertising.
Cookies and local storage
We do not use advertising or cross-site tracking cookies. We store only your theme and language preferences in your browser (localStorage), and you can clear them in your browser settings at any time.
Signing in to the client portal or the admin sets a session cookie (sb-…-auth-token) that keeps you signed in; it is removed when you sign out. Cloudflare Turnstile runs in a frame served by Cloudflare and processes technical data only for its anti-bot check.
Cal.com and YouTube are not loaded until you ask for them; once loaded, they may set their own cookies under their own policies.
How long we keep data
The following periods are proposed defaults, still to be confirmed: contact requests are kept for up to 24 months after the last contact, unless they lead to an engagement; IP hashes used for rate limiting are kept for 2 days; webhook logs are kept for 30 days.
Newsletter addresses are kept while you are subscribed. After you unsubscribe, we keep a minimal record so we do not email you again (only the address and the related dates). Client portal accounts are kept for the duration of the engagement and then deleted, together with their files, when portal access is closed at the end of the engagement or on request.
A testimonial stays published for as long as your consent stands, and is deleted from the site and the database as soon as you ask.
Your rights
You have the right to access your personal data, to have it corrected or erased, and to object to its processing on legitimate grounds. If you are in the European Union, you also have the right to restrict processing, to data portability and to withdraw consent at any time.
To exercise these rights, write to hirechsec@gmail.com. We will reply promptly and within the time limits set by law.
You also have the right to lodge a complaint with the CNDP in Morocco or, if you are in the European Union, with the data protection authority of your country.
Security
We take reasonable technical and organizational measures to protect your data, including encrypted connections, restricted access and storing IP addresses only as salted hashes. No system connected to the internet can, however, guarantee absolute security.
Changes to this policy
We may update this policy when our processing or the legal framework changes. The date of the latest update appears at the top of this page, and we will inform you of any significant change in an appropriate way.