Privacy policy
Version: 23 October 2026
This page explains what personal data mejbar.com collects, why, and what you can do about it. The short version: the site sets no tracking cookies and runs no analytics. I only get your data when you write to me.
1. Who is responsible
The data controller is:
- Mohamed Ali Mejbar, auto-entrepreneur (Moroccan law no. 114-13)
- Address: Fès, Morocco
- ICE: 003685880000039
- Email: ali@mejbar.com
2. What the site collects
2.1 When you email me
You choose what to send. Usually: your name, your email address, your company, the content of your message and any files you attach.
2.2 When you book a call
The booking form asks for your name, your email address, the time you pick and any note you add. Cal.com processes this data for me.
2.3 Technical logs
Like any web host, Vercel records technical data when your browser loads a page: IP address, browser and device type, the page requested, the date and time. Vercel uses these logs to run and secure the service. I do not use them to identify visitors. Vercel keeps these logs for the short period its own terms set.
2.4 Audience measurement
None. The site runs no analytics tool.
2.5 What the site does not do
- No advertising or tracking cookies. No cookie banner is needed for that reason.
- No social media pixels or embedded trackers.
- Fonts are hosted on mejbar.com itself. Your browser does not contact a font service.
- No account, no newsletter, no contact form that stores data on the site.
3. Why I use your data, and on what legal basis
| Purpose | Data | Legal basis (Morocco, law 09-08) | Legal basis (EU, GDPR) |
|---|---|---|---|
| Reply to your message and prepare a proposal you ask for | Email content, contact details | Steps taken at your request before a contract (art. 4-b) | Art. 6(1)(b) |
| Carry out a project once signed | Contact details, project exchanges | Performance of a contract (art. 4-b) | Art. 6(1)(b) |
| Keep invoices and related emails | Identity, billing details | Legal obligation (art. 4-a) | Art. 6(1)(c) |
| Keep the site running and secure (logs) | Technical data | Legitimate interest (art. 4-e) | Art. 6(1)(f) |
I do not send you marketing emails unless you agreed to receive them first.
4. How long I keep it
- Messages from people who do not become clients: 24 months after our last exchange, then deleted.
- Client correspondence: for the length of the relationship. Invoices and the documents that support them: 10 years, as Moroccan tax law requires.
- Booking data: 12 months after the call.
- Vercel logs: see 2.3.
5. Who receives it
Only me. I do not sell or rent your data. These providers process it for me, under their own terms:
- Apple (iCloud Mail, with my own domain) — my mailbox. Location: Apple’s data centres, mainly in the United States.
- Vercel Inc. — hosting and logs, United States.
- Cal.com, Inc. — call booking, United States.
6. Transfers outside Morocco and the EU
Some providers above store data in the United States or elsewhere.
- Under Moroccan law (arts. 43 and 44 of law 09-08), a transfer to a country without an adequate level of protection needs the CNDP’s authorisation or a legal exception. The exceptions include your express consent and the steps needed to reply to your request or perform our contract, which are the reasons your data reaches these providers.
- For visitors in the EU: these providers transfer data under the EU-US Data Privacy Framework or standard contractual clauses, as their own terms set out.
Email is not fully secure on open networks. It can pass through servers that neither of us controls. Do not send health data, passwords or other sensitive information by email.
7. Your rights
Under Moroccan law 09-08, you have the right to:
- be informed when your data is collected (art. 5);
- access your data (art. 7);
- have it corrected, completed or deleted (art. 8);
- object to its use for legitimate reasons, and object to direct marketing at any time (art. 9).
If you are in the EU, the GDPR also gives you the right to access, rectification, erasure, restriction, portability and objection (arts. 15 to 21).
To use any of these rights, write to ali@mejbar.com. I may ask you to prove your identity. I reply within 30 days at most; a request to correct your data is handled within ten clear days (article 8 of law 09-08).
You can also complain:
- in Morocco, to the CNDP: https://www.cndp.ma
- in the EU, to the authority of your country, for example the CNIL in France (https://www.cnil.fr) or the ANSPDCP in Romania (https://www.dataprotection.ro).
8. Security
I use providers that encrypt traffic (HTTPS), I protect my accounts with strong passwords and two-factor authentication, and I limit what I keep.
9. Automated decisions
None. No decision about you is made by a machine alone.
10. Children
This site is for businesses and adults. I do not knowingly collect data from children.
11. Changes
I will update this page if the site changes, for example if I add a contact form or analytics. The version date at the top shows the latest change.
12. Contact
Sources and notes
- Law no. 09-08 on the protection of individuals with regard to the processing of personal data (dahir no. 1-09-15 of 18 February 2009), consolidated text: https://adala.justice.gov.ma/api/uploads/2024/04/30/Protection%20des%20personnes%20physiques-1714464099884.pdf
- Art. 2: applies to a controller established in Morocco.
- Art. 4: consent, with exceptions (a) legal obligation, (b) contract or pre-contractual steps at the person’s request, (c) vital interests, (d) public mission, (e) legitimate interest that does not override the person’s rights.
- Art. 5: information at collection and, on open networks, a warning that data may circulate without security guarantees (5-4). Art. 5-1-d asks for the CNDP receipt where a declaration has been filed; the owner decided on 2026-10-23 not to file one for now (see docs/business/cndp-declaration.md).
- Arts. 7, 8, 9: access, rectification, objection. Art. 10: no email marketing without prior consent.
- Art. 12: prior declaration to the CNDP. Art. 23: security and choice of processors.
- Arts. 43 and 44: transfers abroad.
- GDPR (Regulation (EU) 2016/679): art. 3(2) (applies to a non-EU controller offering services to people in the EU), art. 6(1)(b), (c) and (f), art. 13 (information), arts. 15 to 21 (rights), art. 77 (complaint).
- GDPR art. 27 (EU representative): a non-EU controller covered by art. 3(2) must appoint one, unless processing is occasional, does not include sensitive data on a large scale, and is unlikely to create a risk (art. 27(2)(a)). Processing here is small and limited to emails, so the exception is likely to apply.
- Moroccan tax code (CGI), art. 211: invoices and supporting documents are kept 10 years.
- Vercel: address and DPF statement from https://vercel.com/legal/privacy-policy . Recheck it before publishing.
- Not verified: Vercel’s log retention for this plan and the CNDP’s current position on transfers to the United States.
- The retention periods for prospects and bookings are proposals, not legal requirements: neither law sets a fixed period for them.