Privacy policy

Rayan Studio, represented by Rayan Sekkat. Contact for any question about your data: rayan.sekkat@gmail.com.

When you use the contact form, we collect: name, email address, subject, message and the language of the site you used. Purpose: answering your request and, if relevant, following up on it.

Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in handling requests sent to us.

When you use the project qualification form, we collect: project type, current stage, objective, desired timing, name, company, email address, an optional budget indication and the language of the site you used. Purpose: understanding your project and preparing a first exchange and a proposal.

Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in following up on business requests.

To limit spam and automated submissions, the form endpoints apply a rate limit per IP address (5 submissions per 10 minutes). The IP address is only kept in the server's memory for those 10 minutes and is never stored. The forms also contain a hidden field that is invisible to visitors; a submission that fills it is silently ignored. Legal basis: our legitimate interest in protecting the site.

With your consent, the site uses Google Analytics to measure audience (pages viewed, sections reached, clicks on calls to action, web performance metrics). IP anonymisation is enabled and advertising features are disabled.

No analytics script is loaded, and no analytics cookie is set, before you click "Accept" in the cookie banner. Legal basis: your consent, which you can withdraw at any time (see "Cookies and trackers").

Rayan Studio sends a limited number of prospecting emails to businesses whose website looks like it could benefit from a redesign or a custom application. This only concerns professional contact details of businesses, never private individuals.

Data used: company name, website domain, city and country, the professional email address published on the company's website or in a public directory, the page it was found on, the technical signals observed on the website (technologies, mobile display, security, freshness) and the history of messages sent.

Sources: the INSEE SIRENE public register, a search engine to find the official website, and the company's own public website. Website signals may be scored by a third-party AI service (OpenAI); that step receives structured technical signals only, never an email address, a name or an address.

Legal basis: our legitimate interest in proposing our services to businesses, in connection with their professional activity. Every email contains an unsubscribe link. When you unsubscribe, we keep a non-reversible fingerprint (hash) of the email address and of the domain, never the value itself, so that we never contact you again. You can also object at any time by writing to rayan.sekkat@gmail.com.

• Contact or project request without follow-up: 3 years from the last exchange.
• Client relationship: for the duration of the contract, then archived to meet legal obligations (contractual and accounting documents: 10 years).
• IP address used for rate limiting: 10 minutes, in server memory only.
• Cookie choice: stored in your browser for 6 months, after which the banner is shown again. You can change it earlier via "Manage cookies" or by clearing your site data.
• Audience measurement: analytics cookies expire after 13 months at most; the associated data is kept by Google Analytics for 14 months at most from your last visit.
• B2B prospecting: 3 years at most from collection or from the last exchange without a reply. Unsubscribe fingerprints are kept as long as needed to honour your objection.
• Hosting logs: kept by the hosting provider for security purposes, for a limited period set by the provider.

Your data is never sold. It is only accessed by Rayan Sekkat and by the processors needed to run the site and the services described above:

• Vercel (site hosting and technical logs);
• Brevo (delivery of form submissions to the studio mailbox);
• Google (Google Analytics, with your consent);
• Resend (delivery of prospecting emails and delivery events);
• Neon (database of the prospecting pipeline);
• OpenAI (scoring of website technical signals, without personal data).

Some processors are located in the United States. Transfers rely on the safeguards provided by the GDPR (adequacy decision or standard contractual clauses).

The site itself sets no cookie. Your cookie choice is stored in your browser's local storage (key rayan_cookie_consent_v1), which is required to remember your decision and needs no consent.

If you accept audience measurement, Google Analytics sets its cookies (_ga and _ga_*). If you decline or make no choice, nothing is loaded. You can change your choice at any time with the "Manage cookies" link in the footer.

Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. To exercise these rights, write to rayan.sekkat@gmail.com.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL), www.cnil.fr.

This policy may be updated when the site or the services evolve. The date at the top of the page indicates the current version.