Privacy Policy

Last updated: March 7, 2026

Your privacy matters. This page explains what personal data is collected when you use this website, how it is used, how long it is kept, and what rights you have. It is written in plain language โ€” no legal jargon.

This website is operated by Mohamed GALY, based in Europe. Questions? Email: [email protected].

1. What Data Is Collected and Why

Contact Form

When you send a message via the contact page, the following is collected: your name, email address, subject, and message. If you attach a file, it is forwarded directly to my email โ€” the file itself is never saved to the database, only a flag noting that an attachment was included.

Purpose: to reply to your message. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Callback & CV Requests

When you request a callback or a copy of my CV, the form collects your name, email address, phone number (callback only), and the reason for your request.

Purpose: to process and respond to your request. Legal basis: legitimate interest / pre-contractual steps (Article 6(1)(b) and (f) GDPR).

Post Comments

When you leave a public comment or send a private question on an Insight post, your name, email address, and message are collected. Email addresses in public comments are not displayed to other visitors. Private questions are sent directly to my inbox and are never publicly visible.

Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Newsletter Subscription

If you subscribe to the newsletter, your email address is collected and stored. You can unsubscribe at any time via the unsubscribe page. After unsubscribing your record is marked as inactive โ€” it will no longer receive emails.

Legal basis: consent (Article 6(1)(a) GDPR).

2. How Data Is Used

  • To reply to your messages, questions, and requests
  • To send you the newsletter if you subscribed
  • To send an automatic confirmation email after form submission
  • To protect the site from spam and bots via CAPTCHA verification

Your data is never sold, rented, or shared with third parties for marketing purposes.

3. Data Storage and Security

Data is stored in a MySQL database on a secured server in Europe. Database connections use SSL/TLS encryption. The website uses HTTPS with HSTS to encrypt all data in transit.

Admin passwords are hashed with BCrypt (strength 12) and never stored in plain text. File attachments sent with forms are forwarded directly to my email inbox and are never written to the database.

4. Cookies

This website sets only one functional cookie for visitors โ€” no tracking, advertising, or analytics cookies.

  • LANG โ€” Stores your language preference (English, French, German, or Arabic) for 30 days. Marked HttpOnly, Secure, and SameSite=Lax. You can clear it at any time via your browser settings.

5. Third-Party Services

Cloudflare Turnstile (CAPTCHA)

All public forms are protected by Cloudflare Turnstile, a privacy-friendly CAPTCHA. When you submit a form, your IP address and browser interaction data are sent to Cloudflare for bot verification. Their privacy policy: cloudflare.com/privacypolicy.

Cloudflare R2 (Image Storage)

Images in Insight posts are served from Cloudflare R2 cloud storage. When you view a post with images, your browser contacts Cloudflare servers to load them.

jsDelivr CDN (Icons)

Font Awesome icons are loaded from the jsDelivr CDN. Your browser requests icon files from jsDelivr servers, which may log your IP address. Their privacy policy: jsdelivr.com.

YouTube (Embedded Videos)

Some Insight posts may contain embedded YouTube videos. If you interact with the player, YouTube may set cookies and collect data according to their privacy policy: policies.google.com/privacy.

ProtonMail (Email Delivery)

When you submit any form, a notification email is sent to my inbox via ProtonMail, and a confirmation email is sent to your address. Your name and email are included in these emails.

6. Data Retention

  • Contact messages, callback & CV requests: Kept for up to 2 years, then deleted.
  • Post comments: Kept indefinitely unless you request deletion or the post is removed.
  • Newsletter email addresses: Kept until you unsubscribe. Permanently deleted on request.
  • Language cookie (LANG): Expires after 30 days.

7. Your Rights (GDPR)

If you are in the European Economic Area, you have the following rights regarding your personal data:

  • Right of access: Ask what data I hold about you.
  • Right to rectification: Ask me to correct inaccurate data.
  • Right to erasure: Ask me to delete your data.
  • Right to restriction: Ask me to pause processing while a dispute is resolved.
  • Right to data portability: Request a copy of your data in a structured, machine-readable format.
  • Right to object: Object to processing based on legitimate interest.
  • Right to withdraw consent: Withdraw consent at any time (e.g. unsubscribe from the newsletter).

To exercise any of these rights, email [email protected]. I will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

8. No Analytics or Tracking

This website does not use Google Analytics, Facebook Pixel, or any other behavioral analytics or advertising tracking tools. No user behavior is profiled or monetized.

9. Changes to This Policy

If this policy changes significantly, the "Last updated" date at the top of this page will be updated. Continued use of the site after a change is posted constitutes acceptance of the updated policy.

10. Contact

Mohamed GALY
[email protected]