معلومات قانونية

Privacy Policy

آخر تحديث: 21/10/2026

This policy explains what personal data Receivly processes, why, and your rights. Rchid Salah Eddine Architecte is the controller for account data; for the data you enter about your own customers, you are the controller and we act as your processor.

Data we process

Account data: name, email, password hash (never the password itself), two-factor settings, language, sign-in sessions (IP address and browser, for security).

Workspace data you enter: your customers’ names, contacts, invoices, payments, promises, notes and reminder history.

Customer-portal data: when your customer uses a portal link you shared, the promise date, message and proof-of-payment file they submit (PDF or image, up to 3 MB), with the time of submission.

Sending data: for messages sent through Receivly (e-mail, WhatsApp), the recipient, channel, time and delivery status. Connection tokens for WhatsApp and accounting software are stored encrypted.

Support data: tickets, messages and contact-form requests. Bank-transfer payments: the payer name, bank reference and date you declare. Referral data: which account invited which, when you sign up through a referral link. Technical logs (request time, path, status, error references) kept for a short period.

Why (legal bases)

To provide the service under our contract with you; to secure it and prevent abuse (legitimate interest); to meet legal obligations such as tax records for payments; and, for optional features (AI assistant, social sign-in), on your choice to use them.

What we never do

We do not sell personal data, do not use your workspace data for advertising, and do not use it to train AI models. We never contact your customers on our own initiative: messages are sent only on your instruction (see the Terms).

Service providers and transfers

Hosting: Vercel (application, Frankfurt region) and Neon (database, Amazon Web Services in Frankfurt, Germany): your data is stored in the European Union. Payments: Stripe, PayPal or Lemon Squeezy (whichever you choose at checkout), when paid plans are enabled; card details go directly to them and never to Receivly. E-mail delivery: Resend, when sending is enabled. Optional: Meta (WhatsApp Business Platform, only if your workspace connects it), Intuit QuickBooks or Xero (only if you connect them), Anthropic (AI assistant, only if enabled, receiving a summary of the current workspace), Google, Microsoft or Meta (only if you choose to sign in with them). Data may be processed outside your country, including in the United States, under the providers’ contractual safeguards such as standard contractual clauses.

Retention

Workspace data is kept while your workspace exists and is deleted when you delete it. Account data is deleted when you delete your account. Sessions expire after 30 days of inactivity. Portal submissions are kept with the workspace and deleted with it; proof-of-payment files are removed 24 months after upload. Sending logs are kept for 12 months. Payment records are kept as long as tax law requires.

Your rights

Depending on your country (for example the EU and UK GDPR, the California CCPA/CPRA, Morocco’s Law 09-08, South Africa’s POPIA, Nigeria’s NDPA, Kenya’s Data Protection Act), you may have rights to access, correct, delete, export or object to the processing of your data, and to complain to your data-protection authority (in Morocco, the CNDP). Use the export and deletion tools in the app, or contact us through نموذج الاتصال. People whose data was entered by one of our customers should first contact that business.

Security

Encrypted connections (HTTPS with HSTS), row-level isolation of each company’s data in the database, strong password hashing, optional two-factor authentication, CSRF protection and strict content security policy. See the Security page for details.

Contact and changes

Controller: Rchid Salah Eddine Architecte, Av. Sebou, Imm. 4/8, Hamria, Meknès, Maroc (ICE 002359079000014). CNDP reference: [يكمله المشغل]. Contact: نموذج الاتصال. We will announce material changes to this policy in the app.