1. Who is responsible
Ibrahim Alouissa is an independent software studio registered in Belgium. The studio is the data controller for the personal information described in this policy.
- Controller
- Ibrahim Alouissa
- Registered in
- Belgium
- Enterprise / VAT (BTW)
- BE 0776.419.474
- Privacy contact
- contact@ibrahimalouissa.company
2. What this policy covers
This policy applies to ibrahimalouissa.company, to the studio’s products HomeFindr, Rijklaar, EmporaMarkt and PlainRecord, and to any purchase, subscription or support request handled by the studio.
A product may publish an additional notice describing processing that is specific to it. Where that happens, the product notice adds detail to this policy; it does not replace it.
3. Information we collect
This website
This website sets no cookies, runs no analytics, loads no third-party scripts and has no sign-in. We do not build profiles of visitors and we do not track you across websites.
Our web server and our content delivery provider record technical request logs, as any web server does: the IP address, the date and time, the page or file requested, the referring address if your browser sends one, and the browser and operating system your request reports. These logs exist to keep the site available and to detect abuse.
When you contact us
If you email the studio, we receive your email address, any name or signature you include, and the content of your message and its attachments. We use this only to answer you and to keep a record of the exchange.
When you use a product
Products that offer an account collect the email address you register with, a password that is stored only as a cryptographic hash, your settings and language, and the content you choose to create or save. Products also record technical and security logs of their own, such as sign-in attempts and errors.
When you pay
Payments are processed by Stripe. Stripe collects your card or other payment details directly, over its own encrypted connection. The studio never receives, sees or stores your full card number, expiry date or security code.
For each purchase, the studio receives and keeps the information it needs to deliver the service and to issue a compliant invoice: your name, your email address, your billing address and country, your VAT number if you supply one, the item purchased, the amount and currency, the payment status, the payment reference and the brand and last four digits of the card used.
4. Why we use it
We use personal information only for the purposes listed here, each with its legal basis under the General Data Protection Regulation.
- To provide a product, an account or a purchased service, and to give support — necessary to perform our contract with you.
- To answer a question you send us — our legitimate interest in responding to the people who contact us.
- To keep our services secure, available and free of abuse and fraud — our legitimate interest in protecting our systems and their users.
- To issue invoices, keep accounts and meet tax obligations — a legal obligation under Belgian law.
- To send service messages about a purchase, an account or a material change — necessary to perform our contract with you.
- To send an occasional product email, where we offer one — your consent, which you can withdraw at any time.
We do not sell personal information. We do not share it for advertising or profiling, and we do not use the content of your account or your messages to train artificial intelligence models.
6. International transfers
We keep personal information in the European Economic Area wherever we can. Some of the providers above are established in the United States or operate infrastructure outside the European Economic Area. Where information reaches them, the transfer is covered by the European Commission’s standard contractual clauses, by the EU–US Data Privacy Framework where the provider is certified, or by another safeguard permitted under Chapter V of the General Data Protection Regulation.
7. How long we keep it
- Web server and delivery logs — no longer than 30 days, except where an entry is part of an ongoing security investigation.
- Email correspondence — as long as needed to handle the matter, and normally no longer than two years after the last message.
- Account information and its content — for as long as the account exists, and deleted within 30 days after you delete the account.
- Invoices, payment records and related accounting information — seven years, as Belgian accounting and VAT law requires.
When a retention period ends, we delete the information or irreversibly anonymise it.
8. How we protect it
We keep the studio small and its data footprint smaller. The measures below are the ones we rely on.
- All traffic to this website and to our products is served over HTTPS with current TLS. Plain connections are redirected and the site is served with a strict content security policy.
- Card details never touch our systems. They go directly to Stripe, a payment provider certified at PCI DSS Level 1.
- Passwords are stored only as salted cryptographic hashes and are never recoverable in readable form.
- Data at rest is stored on encrypted volumes, and backups are encrypted and stored separately.
- Administrative access is limited to the studio’s owner, over key-based authentication on a private network, with multi-factor authentication on every provider account that supports it.
- Systems and dependencies are kept up to date, and we collect the least information a feature can work with.
No service can promise perfect security. If a breach of personal information is likely to result in a risk to your rights, we will notify the Belgian Data Protection Authority within 72 hours and inform you where the law requires it.
9. Your rights
Under the General Data Protection Regulation you have the right to ask us for a copy of your personal information, to correct it, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw a consent you have given. Withdrawing consent does not affect processing carried out before you withdrew it.
Write to contact@ibrahimalouissa.company and we will answer within one month. We will ask you for enough information to be sure of your identity, and nothing more.
You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, or with the supervisory authority of the country you live in. See dataprotectionauthority.be.
10. Children
Our products are not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, write to us and we will delete it.
11. Changes to this policy
We update this policy when our products, our providers or the law change. The date at the top of the page always shows the current version. If a change materially affects how we use your information, we will tell you by email or in the product before it takes effect.
12. How to reach us
For any question about this policy, about your personal information or about a request under the rights described above, email contact@ibrahimalouissa.company.