Privacy

Last updated 23 September 2026

This site is a personal portfolio and contracting site operated by Houssem Eddine Zerrad. It collects as little as possible: no adverts, no newsletter, and no advertising or behavioural profiles built by me.

This page also covers my blog, insights.hzerrad.dev, which works differently in one important way: it shows adverts. See The blog below.

Three external processors run in your browser: PostHog EU for limited analytics, Google reCAPTCHA on the contact page, and Cal.com when you open booking. Netlify hosts the site and the contact function, and MailerSend delivers messages you submit. Each operates under its own privacy terms, and each is described below.

What the contact form collects

If you submit the contact form, the following is sent to me by email and is not stored in any separate database:

• Your name
• Your email address
• Your company or product, if you choose to give one
• The category you select
• Your message

It is used to reply to you and to have the conversation you asked for. Two providers process it on the way to my inbox: Netlify runs the function that receives the form, and MailerSend delivers the email. Neither uses it for anything else. It is never sold, and never shared for advertising.

Analytics

The site uses PostHog (EU region) for a small, deliberately curated set of measurements: page views, and named events such as opening the booking calendar, downloading the résumé, or successfully sending the contact form.

• Autocapture is disabled. Individual clicks and keystrokes are not recorded.
• Session replay is disabled. Your screen is never recorded.
• Heatmaps and dead-click capture are disabled.
• Do Not Track is respected. If your browser sends a Do Not Track signal, no analytics events are collected.
• Analytics run only on hzerrad.dev, www.hzerrad.dev and the blog at insights.hzerrad.dev. Local development and deploy previews are excluded by hostname, not just by configuration.

Alongside a successful contact-form submission, the site records coarse acquisition context: the page you first landed on, the origin of the site that referred you (for example https://www.linkedin.com, never the full referring address), and any UTM campaign parameters in the link you followed.

Deliberately never sent to analytics: your name, your email address, the contents of your message, meeting links, booking identifiers, or anything from the résumé.

Analytics requests go to a path on this domain (/ingest), which forwards them to PostHog's EU region. They are same-origin requests from your browser's point of view, but PostHog is still the processor receiving them. This routing applies only to analytics; it does not change how the other providers described here work.

Browser storage

PostHog may store an anonymous identifier in first-party browser storage, so repeat visits are not counted as new people. Depending on the browser and its settings that can be a cookie, local storage, or both — blocking cookies alone does not necessarily prevent it. It contains a random id and nothing else: no name, no email address, and nothing typed into the contact form. Clearing or blocking site data for this domain removes it or prevents it being set. If your browser sends Do Not Track, analytics is disabled and nothing is stored.

The cookie is set for hzerrad.dev and its subdomains, so the blog and this site share the same anonymous identifier. That is what lets me see that a reader who followed a link at the end of an article went on to get in touch. It is still a random id, and no name or email address is attached to it.

Booking

The "book a call" control links to Cal.com. The Cal.com embed is only loaded once you interact with that control, and if it is blocked or fails to load, the link opens Cal.com normally instead. Anything you enter while booking is handled by Cal.com under their own privacy policy. The site records only that a booking was completed, plus the coarse shape of the event, never attendee details or the meeting URL.

Spam protection

The contact form is protected by Google reCAPTCHA v3, which is subject to the Google Privacy Policy and Terms of Service. reCAPTCHA runs only on the contact page. The form also includes a hidden field that real visitors never see or reach; if it is filled in, the submission is rejected.

Hosting and email delivery

• Netlify hosts the site and runs the function that handles the contact form. Like any web host, Netlify processes request metadata such as IP address and user agent in order to serve and secure the site.
• MailerSend delivers the contact-form email to my inbox and processes the message in transit.

Fonts and icons are served from this domain. The site makes no runtime request to a third-party font or icon service.

The blog: insights.hzerrad.dev

The blog uses the same PostHog analytics, with the same settings described above. On top of page views it records which article you opened, whether you scrolled far enough to reach the box at the end of it, and whether you followed a link from the blog to this site or to one of my profiles. It records the article and which link, never anything you type.

Unlike this site, the blog shows adverts through Google AdSense, which loads on every blog page. Google and its advertising partners may use cookies and similar identifiers to serve ads, including ads based on your earlier visits to the blog and to other websites. That processing is Google's, under the Google Privacy Policy. Google explains how it uses information from sites that use its services, and you can turn off personalised ads in My Ad Center. I do not receive any information about you from AdSense beyond aggregate earnings and page-level reports.

Two other providers are involved when you read the blog:

• Contentful, where the articles are written, serves article and author images from its own CDN (images.ctfassets.net), so your browser requests them from Contentful directly.
• GitHub serves embedded code snippets (gists), in any article that includes one.

The blog has no comments and no account system, and its newsletter signup is switched off, so it collects nothing you type. Netlify hosts it, as it hosts this site.

Where data is processed

These providers operate internationally, so your data may be processed outside your country, including outside the EU or UK. PostHog is configured to use its EU region. Google (for AdSense on the blog), Contentful and GitHub are not region-restricted. Each provider handles international transfers under its own terms.

How long it is kept

Contact-form emails are kept in my mailbox for as long as the conversation, and any resulting engagement, remains relevant, then deleted. Analytics events are kept for as long as PostHog's configured retention allows. Server and function logs are kept for the short period Netlify retains them. No fixed retention schedule is claimed here beyond that, because none is separately enforced.

Your rights and how to use them

You can ask what I hold about you, ask for it to be corrected, or ask for it to be deleted. Email contact@hzerrad.dev and say what you want done. If you are in the EU or UK, you also have the right to object to processing, to restrict it, to data portability, and to complain to your local data protection authority.

Changes

If this changes, the date at the top of this page changes with it.