1. Data controller and roles
For your merchant account and team data, Nawras acts as the data controller. For your end-customer data that you enter or import into the platform, you are the data controller and Nawras acts as a processor, hosting and processing that data on your behalf and according to your instructions.
2. Data we collect
Depending on how you use the service, we collect:
- Account and team data: name, email address, phone number, role and permissions within your workspace.
- Platform usage data: orders, products, stock, statistics and the history of actions performed.
- Technical data: sign-in logs, session identifiers, security tokens and information about the device used.
- Your end-customer data: name, phone number and delivery address, entered by you or imported from your sales channels.
3. How we use your data
Your data is used only to:
- Provide and operate the COD order management platform.
- Ensure authentication and security, in particular through phone number verification and protection against unauthorised requests.
- Manage your subscription, credits and related billing.
- Send operational service notifications (email, WhatsApp) and provide support.
4. Legal basis for processing
We process your data based on the performance of our contract with you (providing the service), your consent where required, and compliance with our legal obligations. Processing is carried out in accordance with Law 09-08 on the protection of individuals with regard to the processing of personal data.
5. AI agents and conversation processing
When you enable AI agents, the content of the relevant conversations may be sent to artificial intelligence model providers in order to generate automated replies. This data is used to produce the requested response and operate the feature; it is not used to identify you for advertising purposes. You remain responsible for supervising the generated exchanges.
7. Hosting and data location
Your data is hosted in data centres located in the European Union (Germany). Some processing may involve a transfer of data outside Morocco, governed by the safeguards offered by our processors.
8. Data retention
We keep your data for as long as your account is active and as needed to provide the service. When your account is closed, you may request the export or deletion of your data within a reasonable time, subject to legal retention obligations.
9. Security
We apply security measures aligned with industry standards: encryption of sensitive data, role-based restricted access, isolation of workspaces between merchants, and protection against unauthorized requests. As no system is infallible, we cannot guarantee absolute security.
11. Your end-customer data
As the controller of your customers' data, it is your responsibility to have a legal basis to collect and use their data, to inform them and to respect their rights. Nawras processes this data only on your behalf and does not use it for its own purposes.
15. Our WhatsApp support channel
When you message the Nawras WhatsApp support number, it is your message that opens the exchange. Here is what this channel involves:
- What we collect: your WhatsApp number, the profile name you chose on WhatsApp, and the content of your messages — text, images and voice notes, including the automatic transcription of those voice notes into text.
- Why: to answer your support or information request. An AI assistant writes the first reply; it introduces itself as such, and you can ask for a human at any time.
- Who processes this data: Nawras, Meta Platforms Ireland Limited (WhatsApp Business message routing) and Google Cloud, including its Gemini models (hosting in Europe and reply generation).
- For how long: messages on this channel are kept for twelve months, then deleted automatically.
To exercise your rights over this data, write to contact@nawras.ma — not over WhatsApp: a request buried in a conversation is a request we can miss.
12. Your rights
In accordance with Law 09-08, you have the right to access, rectify, object to and delete your personal data. You can exercise these rights by contacting us at contact@nawras.ma. You may also refer the matter to the National Commission for the Protection of Personal Data (CNDP).
13. Deleting your data
You stay in control of deletion, at any time and without having to write to us:
- Disconnect your WhatsApp number: from WhatsApp → Channels, the "Disconnect" action removes the channel from Nawras, unsubscribes our application from your WhatsApp Business Account and deregisters the number with Meta. We then no longer have any access to your WhatsApp Business Account, and the corresponding access token is destroyed.
- Delete your WhatsApp conversations, messages and received media: write to contact@nawras.ma stating the number concerned. We process the request within 30 days and confirm the deletion by email.
- Delete your account and all of your data: write to contact@nawras.ma from the email address of your account. We process the request within 30 days and confirm the deletion by email.
Some data may be kept beyond these periods where the law requires it (accounting and tax obligations in particular). In that case it is isolated and no longer used to operate the service.
14. Changes to this policy
We may update this policy to reflect technical, legal or functional changes. Changes take effect upon publication. In the event of a significant change, we will make reasonable efforts to inform you. For any questions, contact us at contact@nawras.ma.