Privacy policy
This policy explains what personal data ORACLEYES collects when you use oracleyes.com, why, for how long, with whom we share it, and what rights you have. ORACLEYES is established in Morocco, so this policy follows Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data. Because this site also serves customers abroad, it also gives the information that Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) require, and it applies the same protections to every visitor, wherever they are.
1. Who is responsible
The controller of the personal data described here is ORACLEYES, the publisher identified on the Publisher page of this site. You can reach us, for anything about your data, at contact@oracleyes.com. We do not sell personal data, and we do not use it for advertising or profiling.
This site is meant for businesses and professionals. It is not directed at children, and we do not knowingly collect data from them.
2. What we collect, why, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Configuration and e-mail address: your choices in the configurator (activity, pages, look, features), an optional free-text note, and the e-mail address you give | To record your order, to send you the confirmation link and the link that opens your account | Taking steps at your request before a contract (GDPR art. 6(1)(b)) |
| Confirmation and account data: whether you confirmed, the dates, a fingerprint of the confirmation and account tokens (never the token itself) | To make the order and the account links work, and to delete what is not confirmed in time | Contract; our legitimate interest in security (art. 6(1)(f)) |
| Project information once your account is open: your name or business name, country, a description of the project, and your answers to our intake questions. We do not accept file uploads | To qualify your project, write the proposal, build and deliver the site | Contract (art. 6(1)(b)) |
| Contract, signature and payment records: the signed Statement of Work, the signature audit trail, the identifier, amount and date of the payment event, invoices | To prove the contract and the payment, to account for it, to refund if needed | Contract; legal obligation to keep accounts and supporting documents (art. 6(1)(c)) |
| Messages: what you write to us, and our replies | To answer you and to run the project | Contract; legitimate interest in handling requests |
| Technical data: your IP address and the technical information your browser sends | To serve the pages, to limit abuse (for example too many orders from one place), to keep the service secure and to find faults | Legitimate interest in security and stability (art. 6(1)(f)) |
We do not run analytics, tracking pixels or advertising tools on this site.
3. Cookies and what your browser keeps
We use only cookies that are strictly necessary for the service you ask for. They are set with the Secure and HttpOnly flags, are tied to our exact address, and are used for nothing else:
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-oy_applicant | Keeps you signed in as an applicant after you open your account from the order link | 14 days |
__Host-oy_session | Your signed-in session | 7 days (customer); 12 hours (our administrator) |
__Host-oy_challenge | A short step of our administrator's two-step sign-in | Short, ends with the sign-in |
Because they are strictly necessary, they do not need your consent, and there is no cookie banner. Our configurator also keeps your choices in the session storage of your browser tab, so that you do not lose them while you look at the templates. It stays on your device, is not sent to us until you submit an order, and disappears when you close the tab. It never contains your e-mail address.
4. How long we keep it
| Situation | We keep it |
|---|---|
| Order not confirmed | 72 hours, then it is deleted |
| Order confirmed, account not opened | 7 days, then it is deleted |
| Account opened, not paid | 14 days of your own time, then it is deleted. The time stops while the next step is ours, not yours |
| Order paid | The account stays open for everything that follows. Contracts, signed Statements of Work, invoices and payment proofs: 10 years, the accounting period. The contents you supplied for your site: 3 months after the project is closed, after which only the generic structure of the site is kept, never your content |
| A request or message that does not become an order | 6 months, then it is deleted |
| No answer within the 10-day test of your site | The test link and your content are deleted |
| A business contact we found ourselves and who never answered (clause 7) | 12 months, then it is deleted. If it objects, it is deleted at once and only its address stays on an opt-out list, so that it is not contacted again |
| Payment events | Identifier, amount and date only, with no personal data, for as long as the proof is needed |
A deletion is recorded in a log that holds only an identifier and a date, with no personal data. A deleted order cannot come back from a backup: after any restoration, that log is replayed before the service reopens. Encrypted backups are rotated; they hold daily copies for the most recent 7 days, so data deleted from the live service can remain in an encrypted backup until it is rotated out. If our deletion mechanism is unavailable, data stays inaccessible and is deleted as soon as it is back.
5. Who receives your data
We use a small number of providers (processors) who handle data only on our instructions and under contract:
- Hetzner: hosts our servers and database, in Germany;
- Resend: delivers the e-mails that the service sends to you (confirmation links, reminders, replies);
- Cloudflare: provides the domain name system (DNS) of oracleyes.com;
- Zoho Sign: carries out electronic signature of the Statement of Work.
Payments are made on the hosted page of an independent provider, Contra or Payoneer. They receive and keep your payment details under their own policy, as independent controllers, and tell us only that a payment was made, its amount and its date. We never receive or store card numbers or bank credentials.
We may disclose data where the law requires it, to a court or authority, or to protect our legal rights. If our business is sold or reorganised, the data may pass to the new owner under the same protections.
6. Transfers outside your country
Your data is processed in Germany (our hosting) and in Morocco, where we are established and where we keep encrypted backups and a copy of each delivered site on our own computer. Some of our providers operate outside Morocco and outside the European Economic Area, including in the United States. Where we transfer personal data to them, we rely on a recognised safeguard: an adequacy decision, the European Commission's standard contractual clauses, or the other mechanism that the applicable law allows. You can ask us for a copy of the safeguard that applies by writing to contact@oracleyes.com.
7. Prospecting of businesses
We may contact a business that has no website, using its professional contact details taken from official or public sources (for example public company registers or the business's own website). We record the source and the date, we contact a person only in the way the local law allows, we keep an opt-out list, and we stop at once if you tell us you do not want to be contacted. We do not use our e-mail delivery provider for cold outreach. If we hold professional details about you that we did not collect from you, we tell you their source when we first contact you. To object, write to contact@oracleyes.com; we then delete the contact at once and keep only its address on our opt-out list.
8. Your rights
You have the right to ask for access to your data and a copy of it, to have it corrected, to have it deleted, to restrict or object to its processing, to receive it in a portable form, and to withdraw any consent you have given, without affecting what was done before. Under Moroccan Law 09-08 you also have the right of access, rectification and opposition.
To use a right, write to contact@oracleyes.com from the address your account uses. We answer within one month. We may ask you to prove your identity first. We cannot delete what we must keep by law, such as accounting records, but we will tell you what we keep and why.
You may complain to the data-protection authority of your country: in Morocco, the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP); in the European Union, the authority of your country of residence or work; in the United Kingdom, the Information Commissioner's Office.
9. Security
We protect data with encrypted connections (HTTPS), cookies bound to our exact address, tokens stored only as fingerprints, separate database accounts with limited rights, two-step sign-in for the administrator, rate limits against abuse, and encrypted backups kept away from the production server. No system is perfectly secure. If a breach is likely to put your rights at risk, we tell you and the competent authority without undue delay.
10. Your own site's visitors
When we build a website for you, you are the controller of the personal data that your site collects from your own visitors. You are responsible for its privacy notice, its legal basis and its cookie rules. We do not process that data for you after handover unless we first sign a data-processing agreement.
11. Changes
We publish any change on this page with a new version number. Where a change is important, we also tell account holders by e-mail.
12. Contact
Everything about your data: contact@oracleyes.com.