Website & demo privacy policy

Last updated: [DATE]

Who we are. This website and demo are run by Hossem Eddine Kentache, independent software developer, Algiers, Algeria ("we"). Contact: hossemeddinekentache@gmail.com.

This policy covers the Clefo marketing website and the public online demo only. It does not cover data that car-rental agencies store in their own Clefo instance — for that, the agency is the controller and our Data Processing Agreement applies.

1. The demo stores nothing on our servers. The demo is read-only and requires no sign-up. It runs in your browser with fictitious sample data. Anything you type in the demo stays in your browser (it may use your browser's local storage to keep the demo state) and is never sent to us. You can clear it by clearing your browser's site data. [TO VALIDATE: confirm the demo build makes no API calls and uses no analytics.]

2. When you contact us. If you email us or message us on LinkedIn, we receive your name, email/LinkedIn profile, company and whatever you write. We use it only to reply, discuss a possible purchase and follow up. Legal basis: steps prior to a contract / our legitimate interest in answering business enquiries (GDPR Art. 6(1)(b) and (f)). Retention: up to 24 months after our last exchange if no contract follows, then deleted [TO VALIDATE]. LinkedIn messages are also governed by LinkedIn's own privacy policy. Emails are handled through Google (Gmail), which acts as our service provider [TO VALIDATE: Gmail consumer account vs Google Workspace — a Workspace account with a DPA is recommended].

3. Hosting and cookies. The site is hosted on Cloudflare Pages (Cloudflare, Inc.). To deliver the site and protect it from attacks, Cloudflare processes technical data such as your IP address, browser type and request time, and may keep short-lived security logs. We do not use advertising, tracking or analytics cookies. Cloudflare may set only cookies strictly necessary for security or performance (for example bot-protection cookies), which do not require consent under ePrivacy rules — to confirm against the live configuration [TO VALIDATE]. If we ever add analytics, we will update this policy and ask for consent where required.

4. No sale, no profiling. We do not sell your data, do not use it for advertising and do not make automated decisions about you.

5. International transfers. We are based in Algeria, which has no EU adequacy decision, and Cloudflare and Google are US-based companies with global infrastructure. Where your data leaves the EU/EEA, we rely on the providers' safeguards (EU-U.S. Data Privacy Framework certification and/or Standard Contractual Clauses) and, for our own access from Algeria, on the necessity of the transfer to answer your request (GDPR Art. 49(1)(b)) [TO VALIDATE].

6. Your rights. You may ask to access, correct or delete your data, object to its use, or ask for a copy, by writing to hossemeddinekentache@gmail.com. We answer within one month. You may also complain to your data-protection authority (e.g. CNIL in France, APD/GBA in Belgium, FDPIC in Switzerland, ICO in the UK, CAI in Quebec, OAIC in Australia).

7. Changes. We will post any update on this page with a new date.