Last updated 24 October 2026

Privacy policy

This is the website of Reem Elsayed, a beauty creator known as Roma After Hours. I am an individual, not a company. This policy explains what personal data this website handles, why, and your rights. In short: no tracking or advertising cookies, no selling of data, and only what is needed.

Who is responsible

The data controller is Reem Elsayed. For anything about your data, email privacy@reemelsayed.com.

Visiting the website

When you visit, your browser sends technical information (such as your IP address and browser type) to the server so the page can be delivered. The site is hosted by Cloudflare, which processes this information on my behalf to deliver and protect the site. I do not store IP addresses.

To understand which pages are useful, the site keeps anonymous counts: how many times each page was viewed per day, and from which country. It does not use cookies or any identifier for this, and it cannot recognise you or follow you between visits or websites. Legal basis: my legitimate interest in running and improving the site (GDPR Art. 6(1)(f)).

Cookies

Visitors get no cookies from this site. The only cookie is a sign-in cookie used by me and my team to manage the site, which is strictly necessary and never set for visitors. If you dismiss the privacy notice, that choice is saved in your own browser's local storage, not in a cookie, and is never sent to me.

Fonts are served from this website itself, so no data is sent to Google or other font services.

"Shop" buttons

When you tap a Shop button, the site counts the click (product, day and country only) and sends you to the brand's own store or a trusted local seller. The link includes labels (UTM tags) showing that the visit came from reemelsayed.com and from me, which helps brands see the value of my work. Those stores are not run by me and have their own privacy policies. In the future some Shop links may become affiliate links, which can earn me a commission at no extra cost to you; I will always say so on the page.

If you sign up for my monthly email, I store your email address, the country you signed up from, and the date and wording of your consent. I use it only to send the newsletter. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw consent any time by using the unsubscribe link in any email or by writing to privacy@reemelsayed.com; I then delete your address.

Collaboration requests

If you contact me through Work with me, I store your name, email, company, website and message so I can reply and discuss a collaboration. Legal basis: taking steps at your request before a possible agreement, and my legitimate interest in answering business enquiries (GDPR Art. 6(1)(b) and (f)). I keep requests for up to 24 months, unless we work together, in which case records are kept as long as the law requires. To stop abuse, a one-way scrambled code derived from your IP address and the date is stored for a short time; it cannot be turned back into your IP address.

Who else handles data

Cloudflare, Inc. hosts the website, database, files and email forwarding. Cloudflare may process data outside the EU; such transfers are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
Google (Gmail) receives emails sent to my @reemelsayed.com addresses and collaboration notifications, because my inbox is hosted there.

I never sell or rent personal data, and I don't use advertising or social media tracking pixels.

Your rights

Under the GDPR (and similar laws such as the UK GDPR and Turkey's KVKK) you can ask to access, correct or delete your data, restrict or object to its use, receive a copy of it, and withdraw consent at any time. Email privacy@reemelsayed.com and I will reply within one month. You can also complain to your local data protection authority.

Children

This website is not aimed at children under 16, and I don't knowingly collect their data.

Changes

If this policy changes, the new version will be posted here with a new date.