Privacy Policy

We collect the following categories of personal data:

• Contact and AI-assistant form data: your name, email address, company, phone number if you provide it, your message, and the content of conversations you have with the AI assistant on our website.
• Newsletter data: the email address you subscribe with and your subscription status.
• Client portal account and project data: account credentials (passwords are stored hashed, never in plain text), profile details, and the project records you and we create in the portal: tasks, files, messages, proposals, and invoices.
• Payment metadata: transaction identifiers, amounts, currency, payment status, and billing details processed through Stripe or PayPal. We never store card numbers. Cards are handled entirely by Stripe and PayPal on their own systems.
• Server logs and security telemetry: IP addresses, request timestamps, user-agent strings, and security events. We use these to keep the service running and to detect abuse.
• Cookieless analytics: we measure website traffic with Cloudflare Web Analytics, which does not use cookies, does not fingerprint devices, and gives us only aggregated statistics.

We process personal data only where we have a legal basis to do so:

• Performance of a contract: operating your client portal account, delivering projects, providing support, and issuing and collecting invoices.
• Legitimate interests: answering inquiries you send us, securing our infrastructure, preventing fraud and abuse, and understanding aggregate website usage. We balance these interests against your rights, and you may object at any time (see Section 7).
• Consent: sending you our newsletter. You can withdraw consent at any time via the unsubscribe link in every email or by contacting us, with no effect on the lawfulness of processing before withdrawal.
• Legal obligations: keeping accounting, tax, and other records we are required to keep by law.

We do not sell personal data. We share it only with the service providers we need to run our business, each bound by contract to protect it:

• Cloudflare: content delivery, DDoS protection, security, and cookieless web analytics.
• Amazon Web Services Simple Email Service (SES), eu-west-3 region (Paris): sending transactional and newsletter email.
• Stripe: card payment processing.
• PayPal: payment processing.
• Our hosting provider: the infrastructure this website and the client portal run on.

We may also disclose personal data to professional advisers or public authorities where the law requires it, and to a successor entity in a merger or acquisition, subject to this policy.

We operate from Egypt, so personal data you give us is processed in Egypt and on the infrastructure of the providers listed above. Egypt has its own data protection framework, the Personal Data Protection Law No. 151 of 2020, under which we operate.

For personal data originating in the EU, EEA, or UK, we offer clients a data processing agreement under Article 28 GDPR that incorporates the 2021 EU Standard Contractual Clauses (and the UK International Data Transfer Addendum where UK data is involved). Ask us for a DPA at any time before or during an engagement. Signing one is a standard part of how we work with European clients.

We keep personal data only as long as needed for the purpose it was collected for:

• Inquiries (contact form and AI-assistant conversations): up to 24 months after our last exchange, then deleted.
• Client records (portal accounts, project data, invoices): for the duration of the contract, then for the statutory retention periods that apply to accounting and tax records.
• Newsletter data: until you unsubscribe.
• Server logs and security telemetry: typically no longer than 12 months, unless needed for an ongoing security investigation.

You have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data where we no longer have a legal reason to keep it.
• Restrict processing while a dispute about the data is resolved.
• Port the data you gave us to another provider in a machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent (for example, the newsletter).

To exercise any of these rights, email [email protected]. We respond within one month. We may ask you to verify your identity before acting on a request.

You also have the right to complain to your local supervisory authority. If you are in the EU or EEA, that is your national data protection authority; if you are in the UK, it is the Information Commissioner's Office (ICO).