Cookie statement

Niyrah is a trade name of Younes El Kouy. Younes El Kouy is responsible for the use of cookies and similar technologies on niyrah.be.

• Identity: Younes El Kouy — trading as Niyrah
• Company number: 1037.336.212
• Address: Turnersstraat 23, 2020 Antwerpen, Belgium
• Privacy contact: privacy@niyrah.be

Cookies are small files a website can store on or read from your device. Similar technologies include localStorage, pixels, SDKs and other mechanisms that store or read information on a device. The rules in this statement also apply to such similar technologies.

On your first visit, or when your earlier choice has expired or the consent version changes, Niyrah asks you to make a choice. You can:

• Accept all;
• Reject all;
• set your preferences.

Vercel Web Analytics and Google Analytics 4 are not loaded before you have explicitly accepted analytics: before that choice no analytics script is fetched, no analytics request is sent and no analytics cookie is placed. Rejecting analytics has no effect on access to the website, forms or other necessary functions.

You can change or withdraw your choice at any time via “Cookie preferences” in the footer. Withdrawing is as easy as accepting.

4.1. Necessary technologies

These technologies are needed to run the website safely and reliably, or to deliver a function you requested. They cannot be switched off through the preferences interface.

They include:

• the first-party cookie that remembers your cookie choice;
• technical hosting, routing and security processing necessary to deliver the website;
• server-side rate limiting via Upstash to limit spam and abuse;
• server-side processing via Supabase and Resend when you submit a form.

Supabase, Resend and Upstash are not browser-based marketing or analytics categories. They are used server-side for storage, e-mail delivery and security.

4.2. Analytics

Analytics is optional and stays off until you give consent.

Niyrah uses two analytics services, both exclusively after your consent:

a) Vercel Web Analytics — aggregated statistics about visited pages and general technical characteristics. According to Vercel:

• no third-party cookies are used;
• a temporary hash of the incoming request is used to distinguish visitors within a limited period;
• the temporary visitor session is discarded after 24 hours;
• data points are processed anonymously and used for aggregated statistics.

Vercel Web Analytics may process, among other things, timestamp, URL or route, referrer, filtered query parameters, coarse geolocation, browser, operating system and device type.

b) Google Analytics 4— website and usage statistics and a limited set of functional events. Google Analytics 4 runs in so-called Consent Mode v2: the analytics signal is only set to “granted” after your consent, and all advertising signals (ad_storage, ad_user_data, ad_personalization) are permanently set to “denied”. There is no Google Ads link and no ad personalisation.

The events Niyrah sends to Google Analytics contain only fixed, predefined values: the type of event (such as a submitted contact request, a click on an e-mail or phone link, or the selection of a service page), the language of the page and the location on the website. Names, e-mail addresses, phone numbers, message content, form values or person-linked IDs are never sent.

4.3. Marketing

Niyrah currently uses no marketing or advertising tracking — no Meta Pixel, no LinkedIn Insight Tag, no Google Ads tracking, no Hotjar, no Microsoft Clarity. No active marketing category is therefore offered.

Technology: niyrah_cookie_consent

• Provider: Niyrah
• Domain: host-only on the visited Niyrah host, unless later configured differently and transparently
• Path: /
• Purpose: remembering whether optional analytics was accepted or rejected and which consent version applies
• Category: strictly necessary
• Type: first-party preference cookie
• Contents: a minimal, versioned preference without name, e-mail address, phone number, visitor ID, lead ID or form content
• Retention: 180 days at most
• SameSite: Lax
• Secure: enabled in production
• Third-party access: no
• Legal basis: necessary to remember the preference you requested

Technology: Vercel Web Analytics

• Provider: Vercel
• Purpose: aggregated website and usage statistics
• Category: optional analytics
• Status before consent: disabled
• Activation: only after explicit consent
• Type: no third-party cookie in its standard operation; a temporary request hash and analytics requests
• Session duration: the temporary visitor session is discarded by Vercel after 24 hours
• Legal basis: consent
• Recipient: Vercel and its applicable sub-processors
• Withdrawal: via “Cookie preferences” in the footer

Technology: Google Analytics 4 (cookies _ga and _ga_*)

• Provider: Google Ireland Limited / Google LLC
• Purpose: website and usage statistics; limited functional events
• Category: optional analytics
• Status before consent: not loaded — no script, no request, no cookie
• Activation: only after explicit consent, in Consent Mode v2
• Cookies: _ga (distinguishes visitors) and _ga_<stream-id> (session state), both first-party, placed by the Google script after consent
• Retention: 2 years by Google default; modern browsers limit the lifetime in practice to roughly 400 days
• Advertising signals: permanently denied (ad_storage, ad_user_data, ad_personalization = denied); no Google Ads link
• Legal basis: consent
• Recipient: Google and its applicable sub-processors
• Withdrawal: via “Cookie preferences” in the footer — see section 06

Technology: Upstash rate limiting

• Provider: Upstash
• Purpose: spam and abuse prevention on forms
• Category: necessary for security
• Type: server-side hashed keys; not a marketing cookie
• Retention: normally 10 minutes for the IP limit and 1 hour for the e-mail limit
• Legal basis: legitimate interest in securing systems and forms

Technology: hosting and security traffic

• Provider: Vercel and underlying infrastructure
• Purpose: delivering, securing and routing the website, load balancing and incident analysis
• Category: strictly necessary to deliver the website
• Type: technical network and server processing; the concrete technical means may depend on the platform configuration
• Retention: limited to what is technically and security-wise needed according to the provider settings
• Legal basis: legitimate interest and necessity to deliver the website

On the first layer you can choose “Accept all” or “Reject all”. Both choices give full access to the website. Via “Preferences” you can switch analytics on or off separately.

Analytics is off by default. There are no pre-ticked optional choices. Continuing to browse, staying silent or accepting the general terms does not count as consent.

You can change your choice at any time via “Cookie preferences” in the footer. When you withdraw analytics, the following happens: your rejected choice is stored, future analytics events are blocked immediately, the first-party Google Analytics cookies (_ga and _ga_*) are removed on a best-effort basis, and the page reloads so no analytics script remains active.

Withdrawal does not affect processing that lawfully took place before the withdrawal: data already collected by Vercel or Google is not automatically erased by withdrawing your consent. For erasure of previously collected data you can send a request to privacy@niyrah.be.

The preference cookie is kept for 6 months at most. After that, Niyrah asks for a choice again. The banner can also reappear when:

• you delete the preference cookie;
• the cookie is missing or invalid;
• the consent version changes because of a material change in purposes, categories or technologies used.

Niyrah keeps earlier versions of the consent text and this Cookie statement internally, to be able to demonstrate which information was shown at the time of a choice.

You can view, block or delete cookies and site data through your browser. When you delete the preference cookie, the consent interface appears again on a next visit. Blocking strictly necessary technologies may break certain functions.

Vercel (Web Analytics) and Google (Google Analytics 4) act as service providers for analytics and may engage sub-processors. Some providers or sub-processors may process data outside the European Economic Area, including in the United States. Where required, such transfers rely on an adequacy decision (such as the EU-US Data Privacy Framework), EU standard contractual clauses or other legally recognised safeguards.

More information about providers and international transfers is available in the Privacy statement.

To the extent the legal conditions are met, you can request access, rectification, erasure, restriction, portability or object to processing. You can withdraw your consent for Analytics at any time via “Cookie preferences”.

For questions or requests: privacy@niyrah.be.

You can also lodge a complaint with the Belgian Data Protection Authority.

Cookies and analytics are not used to make solely automated decisions with legal effects, or to profile visitors for advertising purposes.

This statement is updated when purposes, categories, cookies, analytics, embeds, providers or other tracking technologies change. The date and version number at the top show the applicable version.