Privacy policy
Last updated: October 18, 2026
This policy explains how KAHF (KAHF Academy, KAHF Consulting and KAHF SocOps, operated by Fares Alkhawaja in Montreal, Quebec) collects, uses, shares and protects personal information, in line with Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and Canada’s Personal Information Protection and Electronic Documents Act.
Person in charge of the protection of personal information
Fares Alkhawaja, founder, is responsible for the protection of personal information at KAHF. Write to [email protected] for any question, request or complaint about your information.
What we collect and why
- Course registrations (KAHF Academy): your name, email and/or phone number, the learner’s name and level, the courses you choose, your availability, preferred format and message. We use them to contact you and plan your courses.
- Consulting requests (KAHF Consulting): your name, email, phone number, company and role, the services you are interested in, timeline, budget and project description. We use them to answer you and prepare a proposal.
- SocOps sign-ups and accounts: your name, email and the profile details you provide (platforms and handles, audience, rates, categories, company details), plus agreements and electronic signatures (name, date and IP address). We use them to propose and manage partnerships, prepare contracts and pay creators.
- Public professional information (SocOps): to find relevant partners, we compile information that creators and brands make public: channel or company name, public statistics such as subscribers and views, public business contact details and website, from the YouTube Data API, TikTok, Instagram professional accounts (Meta), Wikidata, OpenStreetMap and public websites. We use it only to contact you about relevant partnerships, and you can ask us at any time to delete it and stop contacting you.
- Payments: your name, email, the amount and the payment reference. Payments are made through Wise or by bank transfer; we never receive or store card numbers.
- Technical information: our servers record limited technical data (IP address, browser and pages requested) to protect the sites against abuse and to fix problems.
Cookies and similar technologies
We only use what the sites need to work: a sign-in cookie for SocOps accounts and for our learning portal. There are no advertising or analytics cookies and no tracking across sites.
The course list you build on KAHF Academy stays in your browser (local storage) until you send your registration.
Sharing and service providers
We never sell or rent personal information. We share it only with providers that help us run the sites, under contract and only as far as needed:
- Brevo (France): sending emails such as confirmations and notifications.
- Cloudflare (United States): security and delivery of the sites.
- Google (United States): Gemini, used in SocOps to draft outreach messages and contracts from the profile of the person concerned, and YouTube API Services. SocOps uses YouTube API Services: see YouTube’s Terms of Service (youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy).
- Wise: when you pay through Wise, Wise’s own privacy policy applies to the payment.
- Within SocOps, a brand and a creator receive only the information needed for their partnership, and each sees only their own agreement.
Where your information is kept
Our databases are hosted on our own servers in Montreal, Quebec. Some of the providers above process information outside Quebec (elsewhere in Canada, in the United States or in Europe). Before any such transfer, we assess that the information will receive adequate protection, as Law 25 requires.
How long we keep it
- Course registrations and consulting requests: up to 24 months after our last exchange, unless you ask us to delete them sooner.
- Contracts, invoices and payment records: as long as tax law requires (generally six years).
- SocOps public information: until you ask us to delete it; statistics from YouTube are refreshed or deleted within 30 days.
- Technical logs: a short period, only as long as needed for security.
Security
Information is sent over encrypted connections (HTTPS), stored on servers we control and accessible only to the founder, with strong authentication and least-privilege access. If a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information du Québec.
Your rights
You can ask to access your information, correct it, withdraw your consent, have it deleted or de-indexed, and receive a copy in a structured, commonly used format. We do not make decisions about you based exclusively on automated processing: SocOps match scores are suggestions reviewed by a person.
Write to [email protected]; we answer within 30 days. To stop receiving our emails, reply “unsubscribe” to any message. If you are not satisfied with our answer, you can file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).
Children
Courses for minors are arranged with a parent or guardian, who provides the learner’s information. For children under 14, we need the consent of the person with parental authority.
Changes to this policy
We update this page when our practices change and show the date of the latest version at the top.