Last updated: 2026-10-19
1. Who is responsible
The controller of your personal data is IMAGINARIA CODE LAB, B 05, Résidence Abraj, Cité Ennakhil, 2045 La Aouina, Tunis, Tunisie, email contact@ouerfelli-raed.com.
We apply Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data and, for people in the European Union, the General Data Protection Regulation (EU) 2016/679 ("GDPR").
2. What we collect
- Account: your email address, your name if you enter one, and your preferred language.
- Sign-in: single-use sign-in links (stored only as a hash, valid 15 minutes) with the IP address of the request, and your active sessions (stored as a hash) with the browser description (user agent).
- Learning: lessons you completed, where you stopped in each video, your private notes, and the questions and answers you post.
- Orders: the course, price, order reference, dates, your acceptance of the terms of sale (date and version), the payment proof file and note you upload, the invoice (with the company name and tax ID you enter, if any), and our internal notes about the order. We never receive your card or bank login details.
- Messages: the emails we send you and the emails you send us.
- Technical data: our host processes request logs (IP address, browser, page, time) to run and protect the Platform.
We do not use analytics, advertising or social media trackers, and we do not sell your data.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, give access to your courses, save your progress and notes, Q&A | Performance of the contract |
| Process orders and payments, send order and access emails | Performance of the contract |
| Keep orders and payment records for accounting and tax purposes | Legal obligation |
| Prevent abuse and fraud, limit sign-in attempts, keep the Platform secure | Legitimate interest |
| Answer your messages | Legitimate interest, or the contract if you are a student |
We send no marketing emails.
4. Who receives it
- Cloudflare, Inc. (United States): hosting, database, file storage and request logs.
- Resend (United States): sending our transactional emails.
- The instructor and administrators of the Platform, to provide the courses and support.
- Other students with access to the same lesson see your questions and answers with your display name.
Our providers process the data only on our instructions.
5. Transfers outside Tunisia and the European Union
Our providers are located in the United States and Cloudflare serves the Platform from data centres around the world, so your data is processed outside Tunisia and the European Union. For people in the European Union, these transfers rely on the European Commission's standard contractual clauses or on the EU-US Data Privacy Framework when the provider is certified. Transfers from Tunisia follow the conditions of Organic Law No. 2004-63.
6. How long we keep it
- Account, progress and notes: until you delete your account.
- Sessions: they expire after 30 days without use. Sign-in links: valid for 15 minutes. Expired sessions are deleted, and so are sign-in link records (with the IP address of the request) and anti-abuse counters about one day after they expire; this cleanup runs whenever someone asks for a sign-in link, so it can take a little longer when the Platform is quiet.
- Questions and answers: for as long as the lesson is online; after you delete your account they stay without your name.
- Orders, invoices, payment proofs and terms acceptance: 10 years, for accounting obligations.
- Request logs: a few days, as set by our host.
- Backups: the database is backed up every week and each backup is kept for about 12 weeks, so deleted data disappears from backups within that time.
7. Your rights
You can ask to access, correct or delete your data, and object to its use. If you are in the European Union, you can also ask to restrict its use and to receive it in a portable format.
- Correct your name and language on your account page.
- Delete your account from your account page with "Delete my account". This deletes your notes, your progress and your sessions, removes your email and name, and keeps your questions and answers without your name. Your orders are kept for accounting.
- For anything else, write to contact@ouerfelli-raed.com. We answer within one month.
You can also complain to the Tunisian personal data protection authority (Instance Nationale de Protection des Données Personnelles, INPDP) or, in the European Union, to the data protection authority of your country.
8. Security
The Platform uses HTTPS only, stores no passwords, stores sign-in links and sessions only as hashes, and checks your access on every page and video request.
9. Children
The Platform is not intended for children under 16.
10. Cookies
See the Cookies page.
11. Changes
We will publish any change on this page and tell you by email if it is important.