Legal
Privacy policy
Last updated:
This page explains what I collect about you on stayfen.com, why, who else sees it, and how to have it corrected or deleted. I wrote it in plain words. If anything is unclear, write to me.
On this page
Who I am
stayfen.com is the personal site of Mustapha Bouzig (Stayfen), a software engineer based in Algeria. I decide how the personal data described here is used, so in GDPR terms I am its controller.
For anything about your data, write to contact@brandz.tech.
This page covers stayfen.com. My agency has its own Brandz.tech privacy policy, and my app Al Fath has its own Al Fath privacy policy.
What I collect, and where it comes from
I collect only what I need to answer you and to run this site. It comes from you and from your browser.
- Messages you send me. What you write to me on WhatsApp, by email, or on Instagram, LinkedIn, TikTok or Facebook, with the name and the number or address you use there.
- The Revenue Strategy Blueprint. Your answers about your business (type, clients, goal, prices, competition, stage) are sent to an AI provider, which writes your playbook. If you ask to receive it by email, I use your name and email to send it, and I receive a copy of your name, email, answers and result so I can follow up.
- Zero to App sign up. Your name, email, WhatsApp number and your answers to the short survey (level, goal, computer). I receive them by email.
- The Brandz page form. On
/brandz: your name, email, phone, the package and services you pick, and your message. I receive them by email. - mini Stayf, the site assistant. What you type is sent to an AI provider, with a short summary of the conversation, to write the reply. I do not save the conversation. If the assistant fails, I get an error report with the length of your message, never its content.
- Proposals. When I prepare a proposal for you, I may enter notes about your business into an internal tool that uses the same AI provider.
- Analytics, only if you accept cookies. The pages you view, how you arrived, your device and browser type, and your approximate location. Google Analytics collects this with cookies. If you reject, none of it is collected.
- Booking a call. If you book through my Google Calendar page, Google passes me your name, your email, the time you picked and anything you write in the booking.
- Project data. If you become a client, the details I need to run your project and to invoice you.
- Technical data. To deliver the site and keep it safe, my host processes your IP address and keeps short technical logs. To stop floods of requests to the tools and the assistant, the server keeps your IP address briefly in memory, never in a database.
- Preferences on your device. Your language choice, the sound setting and your course progress are saved in your own browser. They never reach me.
Why I use it, and the legal basis
The GDPR asks me to name a legal basis for every use of your data (Article 6). Here they are.
| What I do | Legal basis |
|---|---|
| Reply to your messages, send the playbook you ask for, and run the assistant and tools when you use them | Steps you asked for, Article 6(1)(b) |
| Follow up by email or WhatsApp after you use the Blueprint or sign up for Zero to App | My legitimate interest in following up on a request you made, Article 6(1)(f). Tell me to stop and I will. |
| Run your project once you are a client | Our contract, Article 6(1)(b) |
| Analytics cookies | Your consent, Article 6(1)(a). You can withdraw it at any time. |
| Keep the site secure and working: technical logs, flood limits | My legitimate interest, Article 6(1)(f) |
| Keep invoices and accounting records once you are a client | My legal obligations, Article 6(1)(c) |
Where I rely on legitimate interest, you can object at any time (see your rights).
Who else sees it
I use a few providers to run the site and to talk with you. Each one sees only what its job needs.
- Vercel (United States) hosts the site and runs the tools on its servers.
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) writes mini Stayf's replies, the Blueprint playbook and my proposal drafts.
- EmailJS sends the Blueprint playbook to you, and form requests to me.
- Google (Google Ireland, with Google LLC in the United States) runs Gmail, where form requests arrive, Analytics (only if you accept) and the Calendar page where you can book a call.
- Hostinger hosts the contact@brandz.tech mailbox.
- Meta (WhatsApp Ireland and Meta Platforms Ireland), LinkedIn and TikTok, if you message me on WhatsApp, Instagram, Facebook, LinkedIn or TikTok.
I never sell your data. I never show one client’s data to another.
International transfers
I work from Algeria, which has no EU adequacy decision. I transfer your details there because it is necessary to answer the request you made (GDPR Article 49(1)(b)).
My providers outside the EU rely on Standard Contractual Clauses or the EU US Data Privacy Framework, where that applies.
DeepSeek is the exception. mini Stayf, the Blueprint and my proposal tool send text to DeepSeek in China. China has no EU adequacy decision, and I have no Standard Contractual Clauses with DeepSeek. If you are in the EU and do not want this, write to me by email or WhatsApp instead of using these tools.
How long I keep it
- Requests that do not become a project (messages, Blueprint copies, Zero to App sign ups, Brandz page requests): deleted 12 months after our last contact.
- Clients: for the length of the contract, then as long as accounting law requires.
- Analytics: Google Analytics keeps it for [GA_RETENTION], then deletes it.
- Cookies: as listed in my cookie policy.
- Technical logs: my host deletes them automatically within a few days.
- Preferences on your device: until you clear them in your browser.
Your rights
You have the right to:
- see the data I hold about you (access)
- have it corrected
- have it deleted
- limit what I do with it (restriction)
- object to how I use it where I rely on legitimate interest
- get it in a format you can reuse (portability)
- withdraw your consent at any time, without affecting what I did before.
How: write to contact@brandz.tech or message me on WhatsApp. I answer within 30 days. I may ask you to confirm it is you, for example by writing from the number or address you used with me.
You can also complain to your data protection authority. In the EU, you will find yours on the list of EU data protection authorities.
In Algeria, personal data is protected by Law 18-07 of 10 June 2018, overseen by the ANPDP, the national authority for the protection of personal data.
Social networks
I post on Instagram, LinkedIn, TikTok and Facebook, and link to them from this site. If you follow or message me there, those platforms handle your data under their own privacy policies.
This site does not use the Meta Pixel or any advertising tracker.
If you share your number, I message you there about your request. WhatsApp is run by Meta under its own terms. Your chat stays in my WhatsApp account. Ask me to stop at any time and I will.
Children
This site and my services are not meant for anyone under 16. I do not knowingly collect data about children.
No automated decisions
Nothing about you is decided by software alone. The assistant and the Blueprint only give suggestions. I read every request myself.
Security
The whole site runs over HTTPS. Requests arrive in my own inbox, which only I can open. The tools accept requests only from this site and limit how often they can be called.
Changes
I update this page when my tools or my use of your data change, and the date at the top moves with it. If a change affects you, I will make it clear on this page.