Privacy
Last updated
This site is a personal portfolio and consulting site operated by Houssem Eddine Zerrad. It collects as little as possible: no adverts, no newsletter, and no advertising or behavioural profiles built by me.
Three external processors run in your browser: PostHog EU for limited analytics, Google reCAPTCHA on the contact page, and Cal.com when you open booking. Netlify hosts the site and the contact function, and MailerSend delivers messages you submit. Each operates under its own privacy terms, and each is described below.
What the contact form collects
If you submit the contact form, the following is sent to me by email and is not stored in any separate database:
- Your name
- Your email address
- Your company or product, if you choose to give one
- The category you select
- Your message
It is used to reply to you and to have the conversation you asked for. Two providers process it on the way to my inbox: Netlify runs the function that receives the form, and MailerSend delivers the email. Neither uses it for anything else. It is never sold, and never shared for advertising.
Analytics
The site uses PostHog (EU region) for a small, deliberately curated set of measurements: page views, and named events such as opening the booking calendar, downloading the résumé, or successfully sending the contact form.
- Autocapture is disabled. Individual clicks and keystrokes are not recorded.
- Session replay is disabled. Your screen is never recorded.
- Heatmaps and dead-click capture are disabled.
- Do Not Track is respected. If your browser sends a Do Not Track signal, no analytics events are collected.
- Analytics run only on hzerrad.dev and www.hzerrad.dev. Local development and deploy previews are excluded by hostname, not just by configuration.
Alongside a successful contact-form submission, the site records coarse acquisition context: the
page you first landed on, the origin of the site that referred you (for example https://www.linkedin.com, never the full referring address),
and any UTM campaign parameters in the link you followed.
Deliberately never sent to analytics: your name, your email address, the contents of your message, meeting links, booking identifiers, or anything from the résumé.
Analytics requests go to a path on this domain (/ingest), which
forwards them to PostHog's EU region. They are same-origin requests from your browser's point of
view, but PostHog is still the processor receiving them. This routing applies only to analytics;
it does not change how the other providers described here work.
Browser storage
PostHog may store an anonymous identifier in first-party browser storage, so repeat visits are not counted as new people. Depending on the browser and its settings that can be a cookie, local storage, or both — blocking cookies alone does not necessarily prevent it. It contains a random id and nothing else: no name, no email address, and nothing typed into the contact form. Clearing or blocking site data for this domain removes it or prevents it being set. If your browser sends Do Not Track, analytics is disabled and nothing is stored.
Booking
The "book a call" control links to Cal.com. The Cal.com embed is only loaded once you interact with that control, and if it is blocked or fails to load, the link opens Cal.com normally instead. Anything you enter while booking is handled by Cal.com under their own privacy policy. The site records only that a booking was completed, plus the coarse shape of the event, never attendee details or the meeting URL.
Spam protection
The contact form is protected by Google reCAPTCHA v3, which is subject to the Google Privacy Policy and Terms of Service. reCAPTCHA runs only on the contact page. The form also includes a hidden field that real visitors never see or reach; if it is filled in, the submission is rejected.
Hosting and email delivery
- Netlify hosts the site and runs the function that handles the contact form. Like any web host, Netlify processes request metadata such as IP address and user agent in order to serve and secure the site.
- MailerSend delivers the contact-form email to my inbox and processes the message in transit.
Fonts and icons are served from this domain. The site makes no runtime request to a third-party font or icon service.
Where data is processed
These providers operate internationally, so your data may be processed outside your country, including outside the EU or UK. PostHog is configured to use its EU region. Each provider handles international transfers under its own terms.
How long it is kept
Contact-form emails are kept in my mailbox for as long as the conversation, and any resulting engagement, remains relevant, then deleted. Analytics events are kept for as long as PostHog's configured retention allows. Server and function logs are kept for the short period Netlify retains them. No fixed retention schedule is claimed here beyond that, because none is separately enforced.
Your rights and how to use them
You can ask what I hold about you, ask for it to be corrected, or ask for it to be deleted. Email contact@hzerrad.dev and say what you want done. If you are in the EU or UK, you also have the right to object to processing, to restrict it, to data portability, and to complain to your local data protection authority.
Changes
If this changes, the date at the top of this page changes with it.