Privacy and cookies
Last updated: October 8, 2026
This site is a portfolio and a client platform. It has no advertising, does not sell data and sets no advertising or audience-measurement cookies: visits are counted without cookies. This page explains, in plain words, what is collected, which cookies are set and what you can do about it. It follows Moroccan law 09-08 on the protection of personal data (CNDP) and the principles of the GDPR.
1. Who is responsible
The data controller is Karim El Otmani, acting for the AlmaCorix agency (almacorix.com), operated by Alma Holding LLC, which is also the seller named on payments. For any question or request about your data, write to the address below.
2. What is collected
Only what you give us or what is needed to run and improve the service:
- Visit statistics without cookies: page views and coarse device and country data, through Vercel Web Analytics. It sets no cookie and does not follow you from one site to another.
- Chat messages you type to the assistant, and the answers, so the conversation can continue and be improved.
- IP address: read from the request and used briefly for abuse prevention and rate limiting (and stored in Upstash Redis when that service is enabled).
- Project briefs and contact requests: your email address, your name if you give it, and the text of the brief.
- Call bookings: name, email, the topic you write, the chosen time slot, and the calendar event created for it.
- Client space: your account (email, name), your projects, quotes, messages, files and payment status.
- Payments: card details are entered in Stripe's payment fields and never reach this site. We only keep the payment reference, amount and status.
- Voice input, if you use the microphone: it is processed by your browser vendor (for example Google or Apple) to turn speech into text. We only receive the resulting text.
3. Why, and on what basis
To answer your questions, reply to a brief, schedule and hold a call, deliver and invoice client work, secure the site, and understand which pages are useful. The basis is your request or consent (chat, brief, booking), the performance of a contract (client space, payments), and our legitimate interest in a secure, working site measured without cookies (abuse prevention and cookieless statistics). Your data is never sold and never used for advertising.
4. Who processes it
We use these providers, only for the purposes above:
- Vercel: hosting, cookieless Web Analytics, and Vercel Blob for the files shared in the client space.
- Neon: the database that stores chat, leads, bookings and client-space data.
- Stripe: payment processing (Stripe is the controller of card data). On the payment page, Stripe's script sets its own fraud-prevention cookies (see the table).
- Zoho Mail: sending and receiving the emails linked to your requests.
- Google: Google Calendar when a booking is created, to hold the time slot.
- Anthropic: generates the chat answers from the messages you type, called directly or, as a fallback, through the Vercel AI Gateway.
- Upstash (optional): short-lived counters for rate limiting, when enabled.
- Your browser vendor: speech recognition, if you use voice input.
5. Cookies and local storage
The table below lists the cookies this site sets, including the ones Stripe sets on the payment page. They are all needed for the site to work or for a payment to go through, and none is used for advertising or audience measurement. Your current chat conversation is also kept in this tab's session storage, and a small cache of static files (fonts, icons, scripts) makes the site load faster. Pages and personal data are never cached offline.
| Cookie | Set by | Purpose | Lifetime | When |
|---|---|---|---|---|
| NEXT_LOCALE, ktm_mode | This site | Remember your language and whether you browse as a recruiter or a client. | 1 year | Always (functional) |
| ktm_vid | This site | Random chat visitor identifier: keeps your conversation together and limits abuse. Not used for advertising or measurement. | 1 year | When you use the chat (functional) |
| better-auth.* | This site | Keeps you signed in to the client space. | The session (up to 30 days) | Only if you sign in (functional) |
| __stripe_mid, __stripe_sid | Stripe | Prevent payment fraud: help Stripe recognise the device and the payment session. | __stripe_mid: 1 year · __stripe_sid: 30 minutes | Only on the payment page (needed for the payment) |
| admin_show_demo | This site | Remembers whether the admin dashboard shows demo data. | The browser session | Only for the site administrator (functional) |
6. Your consent and how to change it
No cookie on this site currently needs your consent: they are all needed for the site to work (see the table), and the cookieless statistics described above store nothing in your browser. If audience-measurement tools that need consent are added, they will only run after you accept them in a banner, and this page will be updated first. A consent you gave for the chat, a brief or a booking can be withdrawn at any time by email.
7. How long it is kept
Data is kept only as long as needed for its purpose, then deleted or anonymised:
- Leads and contact requests with no follow-up: deleted after 24 months without contact.
- Chat conversations, bookings and client-space data: as long as needed for the purposes above.
- Invoices and payment records: for the period accounting law requires.
- Cookies: see the lifetimes in the table.
- You can ask for earlier deletion at any time.
8. Transfers outside Morocco
Several of these providers are US companies (Vercel, Neon, Stripe, Google, Anthropic) and may process data in the United States; others may process it in the European Union. They act under contractual safeguards, and we take care that these transfers follow law 09-08 and the requirements of the CNDP.
9. Your rights
Under law 09-08 and the GDPR you can, free of charge:
- access the data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data, or ask us to stop using it;
- object to processing for legitimate reasons, and withdraw a consent you gave;
- receive your data in a usable format.
10. How to exercise them
Email the address below with the email you used on the site. We answer within 30 days. If you are not satisfied, you can lodge a complaint with the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel, cndp.ma) or with your local data protection authority.
11. Changes
If this policy changes in a meaningful way, the date at the top is updated and, for clients, we tell you by email.
Privacy contact: info@karelotm.dev