Cookie policy

Two cookies are strictly necessary for this site to work and are exempt from consent on that basis. The others are not: two for audience measurement and, for advertising, those of the Meta pixel and the Google Ads tag. Those start the moment you arrive — a choice we own rather than a banner that blocks the page — and one link, at the foot of every page, stops them all and deletes them.

Each is described by name, purpose, content and duration, so you can check in your own browser that nothing else is set. A cookie policy that does not name the cookies allows no verification at all.

Name: NEXT_LOCALE. Purpose: to remember which language you are reading, so the site root sends you back to it on your next visit.

Content: one of three public values — fr, ar or en. Nothing identifying. Duration: one year.

Deleting it breaks nothing: the site root will simply show French, and the small message under the language switcher will remind you that the other languages exist.

One key, aa.language-hint, is kept in your browser’s local storage. It is not a cookie: nothing is sent with your requests. It records only that this message has been shown to you and that you closed or followed it, so that it is not shown again. It holds nothing but a yes, and stays until you clear the site’s data. Another, aa.recent-searches, keeps your last five searches to offer them again when you open the site’s search; it never leaves your browser, and the “Clear history” link in the search deletes it.

Name: audit_rt. Purpose: to timestamp the page load so a human submission can be distinguished from an instant automated one.

Content: a signed timestamp, with no personal data. Duration: thirty minutes.

Without it, form submissions may be rejected.

We measure the site with Google Analytics 4: how many visits it gets and which pages are actually read. Measurement starts the moment you arrive — that is a choice we are making, and you can undo it in one click. It exists to tell us which pages genuinely answer a question; it does not exist to identify you.

Two cookies are set: _ga and _ga_ followed by the property identifier, each lasting two years. They exist to tell visitors and sessions apart. The IP address is anonymised by Google, none of this data is used for advertising, and none of it is joined to anything you send through the forms.

Two keys are kept in your browser's local storage. They are not cookies: nothing is sent with your requests. aa.analytics-consent exists only if you have turned measurement off, or turned it back on after turning it off — leave it alone and the key is absent. aa.analytics-notice records that you closed the strip announcing the measurement, so it is not shown to you again. Those two stay until you clear the site's data. A third, aa.conversion-handoff, exists only between sending a form and the confirmation page that follows it: it carries which form, the identifier of that submission and, if measurement is on, the irreversible fingerprint described below. It is gone when the tab closes, and the fingerprints are stripped from it as soon as they have been used.

You can stop the measurement at any time through the "Turn off audience measurement" link at the foot of every page. It acts immediately: measurement stops on the page you are reading, with no reload, the two cookies above are deleted, and Google is told that storage is no longer permitted. The same link reads "Turn on audience measurement" if you change your mind.

We have installed the Meta pixel on this site — the measurement code behind Facebook and Instagram. It does not do the same job as Google Analytics, and that is worth saying sharply: Analytics tells us which pages get read, the pixel tells Meta which advertisement produced a contact request. It is what lets us buy advertising without wasting it, and it is also what makes it an advertising tracker in the full sense of the term.

Two cookies are set. _fbp, lasting three months: a random identifier assigned to your browser. _fbc, lasting the same, written only if you arrived here by clicking one of our advertisements, in which case it records which one. Meta receives the pages you view on this site, and the moments when you send a form, request an appointment or open a conversation with us. If you have a Facebook or Instagram account, Meta can join all of that to that account: this is precisely what the pixel is for, and we have no way of preventing it.

Until September 2026 this page promised that the pixel reported only the fact of a submission and never its contents. That is no longer true, and we would rather say so here than withdraw the sentence quietly: when you send a form, an irreversible fingerprint of your email address or telephone number goes to Meta and to Google Ads. A fingerprint is not the address — nobody can reconstruct it from one — but it does let them recognise an account already holding the same address, which is exactly what it is for.

What those two companies still do not receive from us: the content of your messages, your name, your company name, your budget, or the slot you booked.

The same "Turn off audience measurement" link, at the foot of every page, stops the pixel at the same time as Google Analytics and Google Ads, and deletes its two cookies. There are deliberately not two separate settings: a button that switched off one tool and left the other working would be a lie told in the interface.

We buy advertising on Google too, and we measure what it produces with the Google Ads conversion tag. It shares the same file as Google Analytics — it is the same script — but it does not do the same job: Analytics tells us which pages are read, the tag tells Google which advertisement produced a request.

One cookie is set, _gcl_au, lasting three months. It records the advertising click that brought you here, so that the request you send afterwards can be attributed to it. Depending on the campaign Google may write other cookies whose names begin with _gcl_; the opt-out link deletes all of them.

The tag fires only on the confirmation page that follows a form submission and, on the free consultation page, when the request is stored and when you press “Call” or “WhatsApp” — nowhere else. What it sends: the fact that a request was sent or a button pressed, which one, the request’s identifier and the irreversible fingerprint described above. Never the contents of the form.

Name: algeria-agency-help-v1, in the browser cache storage. It is not a cookie: nothing from it is sent with your requests, and it only exists if you sign in to your portal and open at least one help guide.

Contents: the guide pages you have opened, exactly as they were served to you, so they stay readable with no connection. No invoice, no message and no document is written to it. Duration: until you clear the site data, or a new version of the guides replaces the old one.

Deleting it breaks nothing: the guides reload the next time you sign in.

It only exists if you have access to your client area or to our internal console. A visitor who only reads the site does not have one.

Name: it starts with sb- and ends with -auth-token; it is issued and read by Supabase, our authentication provider, and is not written by us. Content: the token proving you are signed in. Duration: the length of your session, renewed while you stay active, deleted when you sign out.

Until August 2026 two separate sign-in cookies were confined to the /admin and /dashboard addresses, so they never accompanied a public page. This one applies to the whole site: if you are signed in and you read a page, it goes with the request. It does nothing but identify you, and it is never used for analytics.

Deleting it signs you out. That is all it does.

Name: aa.sahbi-thread, in your browser’s session storage. It is not a cookie: nothing is sent automatically with your requests, and the key only exists if you open the assistant.

Contents: a random identifier, unconnected to your identity. It ties the questions in one conversation together and counts your messages for the rate limit. Duration: the life of the tab — closing the tab deletes it.

A second key, aa.sahbi-nudged, records only that the assistant’s greeting has already been shown to you, so that it is not shown again on every page. It holds nothing but a yes, and it too disappears when the tab closes.

A third, aa.sahbi-nudged-dash, does exactly the same inside your client area and inside the team console: the message there is different, so it is counted separately. It holds nothing but a yes, and disappears when the tab closes.

A fourth, aa.mfa-nudge, records that you dismissed the offer to turn on two-factor authentication for your account. It holds nothing but a yes, and stays until you clear the site’s data — longer than the ones above, because an offer that returns every time the browser reopens is an offer that ends up ignored. It disappears by itself if you turn two-factor on.

A fifth, aa.demo-nudged, does the same on the demonstration pages: it records that the demonstration assistant’s greeting has already been shown to you. One key for every demonstration, holding nothing but a yes, and it disappears when the tab closes.

A sixth, nr.curtain-seen, belongs to the Maison Nouara demonstration alone: it records that the salon’s opening curtain — the logo drawing itself — has already been shown to you, so it does not replay on every page. It holds nothing but a yes and disappears when the tab closes.

Deleting it breaks nothing: the assistant makes another one and starts an empty conversation. Sahbi is never required to use the site: every page it cites can be read directly.

Name: aa.demo-pizza, in your browser’s local storage, and only if you open the Pizzeria Dar Zitoun demonstration. It is not a cookie: nothing is sent automatically with your requests.

Contents: a random “sandbox” identifier, the list of what you did in the demonstration — an order placed, a ticket out of the oven, a pizza marked sold out — and what is in the pizza box. Nothing personal: no field in the demonstration lets you type a name, a number or an address. It is what makes the customer space, the kitchen screen and the order tracker show the same order, in a second tab too.

Duration: until you clear the site’s data, or choose “Reset the demo”. The same list is kept for 24 hours on our server so a second device can join the demonstration, then deleted.

They exist only if you open the clinic demonstration, Sakina Clinic. They concern that fictional clinic alone, and no other page of the site reads them.

sk_session: a random identifier followed by the demonstration role you chose (visitor, patient, doctor, front desk, nursing or management) and the fictional character you picked. It names the demonstration space holding your appointments, consultations, validated results and the changes made in the dashboards, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are then deleted from our database. It holds no personal data: the demonstration’s patients, records and results are fictional.

Four tab keys, in your browser’s session storage, which are not cookies: sk.large-text remembers that you chose large text; sk.intro-seen remembers that the opening animation has already been shown to you; sk.triage-prefill briefly keeps the words you typed to the assistant or in the search, so the triage can pick them up without putting them in the page address, and is erased as soon as the triage has read them; sk.tour-step remembers the step of the guided tour in progress, so a reload resumes it, and is erased when the tour closes. All of them disappear when the tab closes.

It exists only if you open the insurance demonstration, Hima Insurance. It concerns that fictional company alone, and no other page of the site reads it.

hm_session: a random identifier followed by the demonstration role you chose (visitor, policyholder, agent, assessor, claims handler or management) and the fictional character you picked. It names the demonstration space holding your quotes, policies, claims and the changes made in the dashboards, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are then deleted from our database.

If you add a damage photo of your own to a demonstration claim, an image-analysis model reads it to estimate the damage, and it is kept for twenty-four hours at most in that space before being deleted. The demonstration’s identity documents are never yours: they are fictional specimens you pick from.

They exist only if you open the real-estate demonstration, Qaws Real Estate. They concern this fictional agency alone, and no other page of the site reads them.

im_session: a random identifier followed by the demonstration role you chose (visitor, client, owner, agent or management) and the fictional persona you chose. It names the demonstration space holding your viewings, offers, reservations, fictional payments and the changes made in the dashboards, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are then deleted from our database.

In your browser’s local storage, four keys that are not cookies: im.saved-homes (the listings you saved), im.compare-list (the four listings at most you are comparing), im.saved-searches (your saved searches) and im.price-unit (whether prices show in dinars or centimes). They stay until you clear the site’s data. In session storage, im.curtain-seen records that the opening animation has already been shown to you; it holds nothing but a yes and disappears when the tab closes.

None of them holds personal data: the demonstration’s contacts, documents and payment cards are fictional and pre-filled. Deleting them resets the demonstration, and that is all they do.

They exist only if you open the travel-agency demonstration, Numidia Voyages. They concern that fictional agency alone, and no other page of the site reads them.

nv_session: a random identifier followed by the demonstration role you chose (visitor, client or a member of the team). It names the demonstration space holding your basket, bookings, requests and the changes made in the console, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are then deleted from our database.

nv_prefs: the currency you chose for prices (dinar, euro or dollar). Duration: ninety days.

nr_session: set only if you open the salon & spa demonstration, Maison Nouara. A random identifier followed by the role and persona you chose (visitor, client, specialist, reception or management). It names the demonstration space holding your bookings, orders and changes, visible to you alone. Duration: twenty-four hours; the space is then deleted from our database. It holds no personal data.

Neither holds personal data: the demonstration’s travellers, passports and payments are fictional and pre-filled. Deleting them resets the demonstration, and that is all they do.

They exist only if you open the Tarab demonstration, the fictional ticketing platform and events agency. No other page of the site reads them.

ev_session: a random identifier followed by the demonstration role you chose (visitor, ticket buyer, event client, promoter, vendor, door staff, agency team or management). It names the demonstration space holding your tickets, orders, quotes, invitation replies, seating plans and the changes made in the trade workspaces, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are then deleted from our database.

tarab_scan (IndexedDB) and the door-control app’s cache: the list of tickets scanned while the phone was offline, waiting to be sent, and a copy of the app’s screens so it opens with no signal. Duration: until the scans are sent, or until you clear the site’s data.

None holds personal data: the demonstration’s buyers, guests and payments are fictional and pre-filled. Deleting them resets the demonstration, and that is all they do.

It exists only if you open the private-school demonstration, Nakhla School. It concerns that fictional school alone, and no other page of the site reads it.

ep_session: a random identifier followed by the demonstration role you chose (visitor, parent, pupil, teacher or direction) and the fictional account opened. It names the demonstration space holding applications, booked visits, marks entered, roll calls, simulated payments and messages, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are then deleted from our database.

It holds no personal data: the demonstration’s families, pupils, teachers and payments are fictional and pre-filled, and no field lets you type a real name or number. Deleting it resets the demonstration.

They exist only if you open the fashion demonstration, IBRA, a fictional ready-to-wear label. No other page of the site reads them.

ib_session: a cookie set by our server that the page’s scripts cannot read. A random identifier followed by the demonstration role you chose (visitor, client, influencer, sales assistant, workshop, stockist or management) and the fictional character you picked. It names the demonstration space holding your bag, orders, measurements, saved try-ons, live-chat messages and the changes made in the staff spaces, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are deleted from our database twenty-four hours after your last action.

ib.curtain-seen, in session storage: records that the label’s opening curtain — the needle sewing the logo — has already been shown to you, so it does not replay on every page. It holds nothing but a yes and disappears when the tab closes.

ib.fit-answers, in session storage: the answers you gave the size advisor — your height, weight, body shape, usual size in another brand and the fit you prefer — so the try-on and the outfit builder open on the closest model. They leave your browser only if you choose to save them to your demonstration profile, and disappear when the tab closes.

ib.recent, in local storage: the last eight pieces you looked at — their name, link and photo — for the “Recently viewed” row. Duration: until you clear the site’s data.

The demonstration’s clients, orders and payments are fictional and pre-filled; nothing personal goes in except what you choose to put there — your measurements, a saved try-on photo, a live-chat message — and all of it goes with the space. Deleting these resets the demonstration.

They exist only if you open the building-materials demonstration, Qarmoud, a fictional group of showrooms, depots and a renovation arm. No other page of the site reads them.

qm_session: a cookie set by our server that the page’s scripts cannot read. A random identifier followed by the demonstration role you chose (visitor, client, pro, sales advisor, work site, logistics or management) and the fictional character you picked. It names the demonstration space holding your bag, quotes, orders, planner projects and the changes made in the staff spaces, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are deleted from our database twenty-four hours after your last action.

qm.preloader-seen, in session storage: records that the brand’s opening — the logo laying itself tile by tile — has already been shown to you, so it does not replay on every page. It holds nothing but a yes and disappears when the tab closes.

qm.favourites, in local storage: the identifiers of the catalogue items you marked as favourites. Duration: until you clear the site’s data.

qm.recent-searches, in local storage: your latest catalogue searches, to offer them again. Duration: until you clear the site’s data.

qm.planner-draft, in local storage: the draft of the room you are drawing in the 3D planner — walls, openings, fittings and finishes — so you find it again if you close the page. Duration: until you discard it or clear the site’s data.

The demonstration’s customers, orders, deliveries and payments are fictional and pre-filled; no field lets you enter a real name or number. Deleting these data resets the demonstration.

They exist only if you open the logistics demonstration, Khatt, a fictional carrier of parcels, freight and warehousing. No other page of the site reads them.

kh_session: a cookie set by our server that the page’s scripts cannot read. A random identifier followed by the demonstration role you chose (visitor, seller, shipper, courier, hub, control tower or management) and the fictional character you picked. It names the demonstration space holding your shipments, scans, cash collected, quotes, bookings and the changes made in the staff spaces, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are deleted from our database twenty-four hours after your last action.

kh.preloader-seen, in session storage: records that the brand’s opening has already been shown to you, so it does not replay on every page. Duration: until you close the tab.

kh.calc-draft, in session storage: the tariff calculator’s current simulation (origin, destination, weight, options), so you find it again if you come back to the page. Duration: until you close the tab.

kh.recent-tracking, in local storage: the latest tracking numbers you looked up, to offer them again. Duration: until you clear the site’s data.

kh.courier-queue, an IndexedDB database: the courier’s day and the actions taken without a network (deliveries, cash collected, scans), waiting to be sent to our server. Duration: until you clear the site’s data; an action is removed from the queue once sent.

kh.courier-v1, in the browser’s cache: the courier app’s pages and files, kept by its service worker so that it opens without a network. They contain only what the site publishes. Duration: until a new version of the app, or until you clear the site’s data.

A barcode scanned with the camera is decoded in the page and nothing is sent; a notebook page’s photo and a pasted order message are read once and not kept, as the privacy policy explains. The customers, parcels, payments and vehicle positions are fictional; no field lets you enter a real name or number. Clearing the site’s data in your browser removes these keys and this cache; the demonstration space itself is deleted by our server.

They exist only if you open the hotel demonstration, Dar Chemâa, a fictional hotel with its restaurants and salons. No other page of the site reads them.

dc_session: a cookie set by our server that the page’s scripts cannot read. A random identifier followed by the demonstration role you chose (visitor, guest, front desk, restaurants, housekeeping, events or management) and the fictional character you picked. It names the demonstration space holding your bookings, orders, requests, quotes and the changes made in the staff spaces, so that what you do there is visible to you alone. Duration: twenty-four hours; the space and everything in it are deleted from our database twenty-four hours after your last action.

dc.preloader-seen, in session storage: records that the opening candle has already been shown to you, so it is not lit again on every page. Duration: until you close the tab.

dc.mood, in local storage: the mood you chose for the house, day or night, when you do not let it follow the hour. Duration: until you choose « By the hour » or clear the site’s data.

dc.ramadan, in local storage: the demonstration’s switch that shows the house during Ramadan. Duration: until you switch it off or clear the site’s data.

dc.table-cart, in local storage: the basket of an order placed from a table’s or a room’s QR code (dishes and quantities), so it does not empty if the page reloads. Duration: until the order is sent, or until you clear the site’s data.

The guests, rooms, tables, dishes, payments and documents are fictional; no field lets you enter a real name, a real identity document or a real number. Clearing the site’s data in your browser removes these keys; the demonstration space itself is deleted by our server.

They exist only on the free consultation page our Google advertisements lead to (/lp/marketing-digital) and its thank-you page.

aa_lp_click: a cookie set by our server, which the page’s scripts cannot read, when you arrive from an advertisement. It records the Google click identifier (gclid, gbraid or wbraid), the campaign’s utm parameters, the headline shown and the page variant, so that a request you send later, even on another day, is attributed to the advertisement that brought you. Duration: ninety days.

aa.lp-session, in session storage: your business name to thank you on the next page, the request already counted so it is not counted twice, and how far you watched the video. None of it goes into the page’s address. Duration: until the tab is closed.

If the Cloudflare Turnstile bot check is enabled, it runs inside the form and sets no cookie on our domain.

This page long denied carrying any social-network tracker of this kind. That denial stopped being true in September 2026, and the section above describes what replaced it: the Meta pixel is an advertising tracker, it sets two cookies, and we would rather write that plainly than file it behind a form of words.

What remains true: no sale and no sharing of your browsing data with anybody else, no cookie set by a third-party advertiser, and three measurement tools in total — Google Analytics, the Meta pixel and the Google Ads tag — which the same link switches off together. Other providers do receive data in specific cases — sending the email that notifies us of your message, the Sahbi assistant, and WhatsApp if you choose that channel — but none of them sets a cookie or follows you from page to page; they are described in the privacy policy.

If another tool were ever added, this page would be updated before anything was set, and it would appear in the list above with its duration and its purpose. We do not treat this policy as a document that is written once.

For analytics, the "Turn off audience measurement" link at the foot of the page is enough. For everything else, browsers let you inspect, delete and block the cookies a site sets from their privacy settings, and we provide no separate tool for it: the browser does it better, and you do not have to trust us to carry it out.

What that changes in practice: deleting the language cookie shows the French site at the root, and blocking the anti-spam token can cause form submissions to be rejected. No other function of the site depends on either.

This page describes the real state of the site as of its last modification. It is updated whenever a cookie is added or removed, not on a schedule.

A cookie that is not strictly necessary is named here, with its purpose and its duration, before it goes into service, and it can be refused in one click from the foot of any page. This sentence said until September 2026 that such a cookie was only set after explicit consent; it had become false in August 2026, when audience measurement moved to starting immediately with a one-click refusal, and we would rather correct the sentence than leave it describing a site that no longer exists.