1. Data controller and roles
For your merchant account and team data, Nawras acts as the data controller. For your end-customer data that you enter or import into the platform, you are the data controller and Nawras acts as a processor, hosting and processing that data on your behalf and according to your instructions.
2. Data we collect
Depending on how you use the service, we collect:
- Account and team data: name, email address, phone number, role and permissions within your workspace.
- Platform usage data: orders, products, stock, statistics and the history of actions performed.
- Technical data: sign-in logs, session identifiers, security tokens (App Check) and information about the device used.
- Your end-customer data: name, phone number and delivery address, entered by you or imported from your sales channels.
3. How we use your data
Your data is used only to:
- Provide and operate the COD order management platform.
- Ensure authentication and security, in particular through Firebase Authentication, phone number verification and App Check protection.
- Manage your subscription, credits and related billing.
- Send operational service notifications (email, WhatsApp) and provide support.
4. Legal basis for processing
We process your data based on the performance of our contract with you (providing the service), your consent where required, and compliance with our legal obligations. Processing is carried out in accordance with Law 09-08 on the protection of individuals with regard to the processing of personal data.
5. AI agents and conversation processing
When you enable AI agents, the content of the relevant conversations may be sent to artificial intelligence model providers in order to generate automated replies. This data is used to produce the requested response and operate the feature; it is not used to identify you for advertising purposes. You remain responsible for supervising the generated exchanges.
7. Hosting and data location
Your data is hosted on Google Cloud Platform infrastructure, primarily in the europe-west3 region (Frankfurt). Some processing may involve a transfer of data outside Morocco, governed by the safeguards offered by our processors.
8. Data retention
We keep your data for as long as your account is active and as needed to provide the service. When your account is closed, you may request the export or deletion of your data within a reasonable time, subject to legal retention obligations.
9. Security
We apply security measures aligned with industry standards: encryption of sensitive data, role-based restricted access, isolation of workspaces between merchants, and protection against unauthorized requests. As no system is infallible, we cannot guarantee absolute security.
11. Your end-customer data
As the controller of your customers' data, it is your responsibility to have a legal basis to collect and use their data, to inform them and to respect their rights. Nawras processes this data only on your behalf and does not use it for its own purposes.
12. Your rights
In accordance with Law 09-08, you have the right to access, rectify, object to and delete your personal data. You can exercise these rights by contacting us at contact@nawras.ma. You may also refer the matter to the National Commission for the Protection of Personal Data (CNDP).
13. Changes to this policy
We may update this policy to reflect technical, legal or functional changes. Changes take effect upon publication. In the event of a significant change, we will make reasonable efforts to inform you. For any questions, contact us at contact@nawras.ma.