Privacy policy

Version 2.0 — effective 20 September 2026

This policy explains what personal data Weezog processes, why, who it is shared with, how long it is kept and how to exercise your rights. It applies to the Weezog mobile application and the www.weezog.com website.

1. DATA CONTROLLER

The data controller is the publisher of the Weezog application, based in Agadir, Morocco ("Weezog", "we", "us"). For any question about your data: legal@weezog.com

2. LEGAL FRAMEWORK AND CNDP DECLARATIONS

We process your data in accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data and its implementing Decree No. 2-09-165. Weezog's processing operations have been declared to the Moroccan National Commission for the Control of Personal Data Protection (CNDP): - customer management and operation of the Weezog application: receipt No. D-GC-907/2021; - online sales: receipt No. D-CE-908/2021; - transfer of data abroad (hosting): receipt No. T-HB-444/2021; receipts issued on 25 January 2022. Where the EU General Data Protection Regulation 2016/679 ("GDPR") applies, in particular to Users located in the European Union, we also comply with it.

3. DATA WE PROCESS

3.1. Account: email address and password (stored securely by our authentication provider, never in plain text), or your Google account data if you use it to sign in (name, email, photo); name, phone number, address and profile photo if you provide them; chosen language. 3.2. Business profiles: shop name, type of business, address, phone number and optional descriptive information. 3.3. Credit tracking: linked Customers and suppliers, Transactions (amounts, dates, descriptions, statuses), balances, store credit, disputes, comments exchanged on Transactions, link codes. 3.4. Data entered by a Merchant about their Customers: name, phone number and Transactions (see section 10). 3.5. Settings: privacy settings (phone number visibility, comments on or off), notification preferences, list of blocked Users. 3.6. Notifications and statements: in-app notifications, your device's push notification token, monthly statements (PDF and, where applicable, CSV) sent by email. 3.7. Security: two-factor authentication settings, technical sign-in history and logs needed for security and error diagnosis. 3.8. Subscriptions: plan chosen, subscription status and dates, purchase identifier provided by Google Play or the App Store. We never receive your bank details. 3.9. Communications with us: messages sent to support, account deletion requests (optional reason and message). 3.10. Proof of consent: version of the Terms and policy accepted, date and time of acceptance. What we do not collect: your GPS location, your contacts, your bank details or any sensitive data. Do not enter sensitive data (health, religion, political opinions, origin, etc.) in descriptions or comments.

4. WHY WE USE YOUR DATA

- To provide the Service: creating and managing your account, keeping the credit ledger, linking Merchants and Customers, showing balances, sending notifications and statements. Legal basis: performance of the contract. - To secure the Service: authentication, two-factor authentication, preventing fraud, abuse and automated accounts, handling reports. Legal basis: our legitimate interest and performance of the contract. - To manage subscriptions and answer your requests. Legal basis: performance of the contract. - To comply with our legal obligations: keeping proof of consent, accounting and tax obligations relating to subscriptions, responding to requests from competent authorities. Legal basis: legal obligation. - To improve the Service using aggregated statistics and technical logs that are not used to profile you. Legal basis: our legitimate interest. - To send you marketing information about Weezog, only with your consent, which you can withdraw at any time (Article 10 of Law No. 09-08). We do not use your data for advertising, we do not sell it, and we do not make any decision producing legal effects concerning you based solely on automated processing.

5. WHO CAN SEE YOUR DATA

- Your Counterparties: a Merchant and a linked Customer see the Transactions, balances and comments that concern them. Your phone number is visible to other Users only if you allow it in your privacy settings. - Our technical service providers, who act on our instructions and are bound by confidentiality and security obligations: Google (Firebase and Google Cloud: hosting, database, authentication, photo storage, server functions, push notifications; Google Workspace: sending emails and statements); Google Play and Apple (app distribution and subscription payments). - Administrative or judicial authorities, only where required by law. - A potential acquirer of the business, after informing Users in advance. We do not share your data with any other third party.

6. TRANSFERS OUTSIDE MOROCCO

Weezog data is hosted by Google Cloud on servers located in the European Union. This transfer has been declared to the CNDP (receipt No. T-HB-444/2021), in accordance with Articles 43 and 44 of Law No. 09-08, to a country ensuring an adequate level of protection. Some providers may access data from other countries, in particular the United States, to operate their services (push notifications, Google Play, App Store, Google Analytics for the website's audience measurement). These transfers are covered by the contractual safeguards of those providers, such as the standard contractual clauses adopted by the European Commission.

7. RETENTION PERIODS

- Account and profile data: for as long as the account is in use, then deleted within 30 days of the deletion request. - Transactions and comments: for as long as the account is active. After your account is deleted, shared Transactions remain in the Counterparty's history, under the name they recorded, for as long as they keep them; they are no longer linked to your account. - Notification tokens: until you sign out, uninstall the application or the token is replaced. - Technical and security logs: 12 months at most. - Proof of consent: for the life of the account, then 5 years after its deletion, to defend our rights. - Subscription and billing data: 10 years, to meet accounting and tax obligations. - Support communications: 3 years after the last exchange. - Backups: deleted data disappears from backup copies at the end of their rotation cycle.

8. SECURITY

We implement appropriate technical and organisational measures (Article 23 of Law No. 09-08): encryption of communications (HTTPS/TLS), encryption of data stored by our hosting provider, access rules limiting each User to their own data and to data shared with their Counterparties, two-factor authentication, and internal access restricted to those who need it. As no system is infallible, we cannot guarantee absolute security. In the event of a data breach likely to present a risk to you, we will inform you as soon as possible and notify the competent authorities where the law requires it.

9. YOUR RIGHTS

Under Law No. 09-08, you have: - the right to be informed; - the right to access your data; - the right to rectify, update and erase data that is inaccurate, incomplete or unlawfully processed; - the right to object, on legitimate grounds, to the processing of your data, and the right to object free of charge and without giving reasons to direct marketing. If the GDPR applies to you, you also have the rights to erasure, restriction of processing and data portability, and the right to withdraw your consent at any time, without affecting the lawfulness of prior processing. How to exercise your rights: - in the application: editing your profile, privacy and notification settings, deleting comments, blocking, requesting account deletion; - by email to legal@weezog.com, from the address linked to your account; if in doubt, we may ask you to prove your identity. We respond within 30 days at most. Complaints: if you believe your rights have not been respected, you can contact the CNDP (www.cndp.ma — corner of boulevard Annakhil and avenue Mehdi Ben Barka, Les Patios building, 3rd floor, Hay Riad, Rabat) or, if you live in the European Union, the data protection authority of your country.

10. CUSTOMER DATA RECORDED BY MERCHANTS

A Merchant can record in Weezog Customers who do not have an account. For this data, the Merchant is the data controller and Weezog acts as a processor: we host and process it solely to provide the Service to the Merchant. The Merchant must inform their Customers and respond to their requests; Weezog helps them do so. If you believe you have been recorded without your knowledge, first contact the Merchant concerned or write to us at legal@weezog.com: we will pass on your request and help you exercise your rights. When a Customer creates an account and links with the Merchant, they can see the Transactions that concern them and control the visibility of their own information.

11. MINORS

The Service is reserved for people aged 18 or over. We do not knowingly collect data about minors. If you believe a minor has provided us with data, write to us at legal@weezog.com and we will delete it.

12. DEVICE PERMISSIONS

The application may ask you for: - permission to send notifications, which you can withdraw at any time in your phone or application settings; - access to the camera or your photos, only when you choose to add an image (for example your profile photo). The application does not access your location or your contacts.

13. COOKIES AND WEBSITE

The www.weezog.com website uses cookies that are strictly necessary for its operation and security, which do not require consent. Only with your consent, it also uses Google Analytics (Google Ireland Limited) to measure its audience: pages viewed, visit duration, device type and approximate country. These measurements are statistical; they are not used for advertising or to identify you, and they do not concern the application. A banner asks for your choice on your first visit; until you accept, no measurement cookie is set. You can change your mind at any time with the "Cookies" link at the bottom of every page. Measurement data is kept for 14 months at most.

14. CHANGES TO THIS POLICY

We may update this policy. We will not reduce the level of protection of your data without informing you in advance. For any significant change, we notify you in the application or by email at least 30 days before it takes effect and, where necessary, ask you to accept it again. The date of the last update appears at the top of this policy.

15. LANGUAGES AND CONTACT

This policy is available in French, Moroccan Darija, Tachelhit (written in Tifinagh) and English. In the event of any discrepancy, the French version prevails, unless a mandatory legal provision provides otherwise. For any question: legal@weezog.com — www.weezog.com