Skip to content
Download the appGet the app
Back to home

Privacy policy — Bladayaa website and apps

Courtesy translation. The French version is the reference: if the two differ, the French text prevails.

This policy describes data processing on the Bladayaa showcase website, in the iOS and Android apps and in exchanges with our team. It distinguishes reservation data, optional functions and usage measurement. The reference framework is Moroccan Law 09-08. Reservations happen in the apps; visiting the showcase does not create an account.

Controller and contact

  • Bladayaa is the service name. The legal identity and professional contact details of its publisher are shown in the legal notice when supplied.
  • For a data request, use Contact or write to contact@bladayaa.ma. The account deletion request page is available without signing in.

Website and forms

  • Browsing requires no account, location or camera. Visual assets and fonts are served by this website. The host receives technical information needed to deliver and secure pages, including IP address, date and browser information.
  • The partner form receives business/contact names, phone, city and category; Contact receives email, subject and message; deletion requests receive the account email. Language and source page accompany the request. Indicated fields are required to process it. Avoid sensitive data and sign-in codes in messages.
  • Forms are stored in the Bladayaa database (Supabase) and notified to the team by email (Resend) for handling. They do not create an account. A submission confirmation does not mean a partnership has been accepted or an account already deleted.

Account and sign-in

  • The apps use an account with a technical ID, email and, depending on the function, first name and phone. Sign-in uses an email code or a provider shown as available in the app.
  • Choosing Apple or Google lets that provider send a token and authorised details to our authentication service: identifier, email and possibly a name. Apple may supply a relay address. Providers apply their own policies. Bladayaa does not receive your Apple or Google password.

Reservations, pickups and referrals

  • The service records shop, bag, amount, pickup window, necessary contact details, pickup code, dates and reservation status. This supports booking, handover, cancellation, complaints and abuse prevention.
  • Referral codes, account relationships and vouchers are processed when you use referrals. The shop receives what it needs for pickup; a reservation does not authorise marketing by the shop.
  • Missed pickups may trigger restrictions under the service rules. You can request human review and contest an error. Bladayaa takes no bank payment; pay cash to the shop.
  • A friend can pick up your bag: if you send the “A friend picks up my bag” link, whoever holds that link sees your first name, the shop, the pickup window and the amount to pay in cash; you see the first name of the friend who accepts. The page may also show the shop address, quantity and pickup status; it does not reveal your phone number or email. Keep this link private and share it only with the intended person. The link only covers that reservation and stops working when the window ends, if you cancel, or if you take the bag back or change friend. The reservation stays in your name.

Reviews and favourites

  • Favourites are linked to your account. Reviews contain ratings and optional comments/suggestions. Aggregate ratings may be public; comments are not published as named testimonials on the showcase. The author, relevant shop and authorised staff can access data under their permissions.

Preferences and personalisation

  • Language, selected city, tastes and settings are stored on the device according to the function. Tastes and confirmed-pickup habits help rank “For you” bags. This ranking guarantees no offer and does not impose an obligation on you.
  • Removing a local preference does not automatically erase previously transmitted usage events. You can reset available app choices or exercise your rights.

App usage measurement

  • The apps send first-party events to Supabase: openings, onboarding steps, screens and duration, taps, searches and result counts, filters, city, favourites, sign-in, reservations and pickups. They help understand journeys and fix problems.
  • Events may contain an account ID where available, random installation ID, session ID, platform and app version. They are not necessarily anonymous. The installation ID is not the phone advertising ID.
  • This is not cross-app advertising tracking. The showcase has no Google Analytics, advertising pixel or third-party audience measurement tool. Host-native statistics follow the host’s conditions.

Errors and diagnostics

  • The apps send technical logs to Supabase: level, source, error message, technical context, version, platform, OS and language, with installation and session IDs. Some messages may contain failed-request details; do not assume all data is anonymous.
  • Logs serve diagnostics and authorised administrators. Android crashes may be transmitted at the next launch. You can request access or erasure of elements concerning you under this policy.

Device permissions

  • Location is optional, for distances and maps. You can refuse it and select a city. The showcase does not request your location.
  • The app camera scans the shop QR. Images are processed on the device and not uploaded by this function. Booking does not require contacts or microphone access.
  • Notifications depend on settings and system permissions. Opening directions in Apple Maps, Google Maps or another service shares the required destination and possibly your position according to its permissions. Revoke permissions in phone settings.

Recipients and providers

  • The team and relevant shop access data permitted for their functions. Authorities may receive data where applicable law requires it.
  • Supabase: accounts, authentication, reservation database, events and diagnostics (documented region: London, UK). Netlify: website hosting. Resend: service emails (sign-in code, reservation confirmation, reminder, cancellation and receipt, missed pickup, review request) and form notifications to the team. Apple/Google: optional sign-in where available.
  • If you test Bladayaa through TestFlight, Apple collects usage and crash data and shares diagnostics with our team. Feedback and screenshots you submit are also shared. This data helps improve the beta; TestFlight has its own privacy policy and retention periods.
  • OpenFreeMap and, depending on client and fallback engine, OpenStreetMap: app map resources. Loading them makes network requests including IP address. WhatsApp, Instagram and store links open by your action and also follow their policies.
  • Bladayaa does not use this data to sell or rent it to advertisers.

Processing outside Morocco

  • Some providers process data outside Morocco, including the UK, US or EU. Actual country depends on the service and contractual arrangements. Listing a provider does not prove CNDP authorisation was obtained.
  • Confirmed administrative references appear in the legal notice. Contact the team for information about your processing.

Purposes and grounds

  • Accounts, reservations, pickups and support serve the requested service. Partnership requests are pre-contractual exchanges. Processing necessary for applicable obligations serves those obligations.
  • Abuse prevention and diagnostics support security and operation; usage measurement supports improvement. Optional functions activate through your choice and, where necessary, a distinct permission or consent. Accepting terms is not blanket authorisation of every purpose.
  • Booking or submitting a form does not subscribe you to marketing. Further marketing requires suitable information and choice.

Retention periods

  • Reservation contact details: 12 months under server purging; remaining operational data may stay without these details. Usage events: 13 months. Error logs: 30 days. Email logs: 12 months. Account notifications: 6 months.
  • Local preferences persist until changed, storage cleared or the app uninstalled, depending on the system. Web requests and follow-up correspondence are retained for up to 12 months after the last useful exchange, unless an obligation or complaint requires limited retention. The team deletes them in the intake tool; this is not an automatic purge.
  • An obligation or complaint may justify limited separate retention. Technical copies potentially held by providers follow their retention arrangements and publisher requests.

Account deletion

  • In the app: Profile → Delete my account. On the website: Delete my account, without sign-in. Web requests require identity verification and team action; they do not instantly delete accounts.
  • The server function deactivates/anonymises the account, removes sign-in identities and sessions, clears profile/order contact details, favourites, notifications, referral codes and account-linked events. Review text is removed; ratings and reservation records may remain under a technical ID.
  • This does not instantly erase every technical log, correspondence, local installation ID or copy potentially held by a provider. Those periods and your request are handled separately. Deleting Bladayaa does not delete your Apple/Google account.

Your rights and complaints

  • You can request access, correction and opposition on applicable grounds, and deletion under this policy.
  • Use Contact or the deletion page. Provide only what is needed to identify your request. Proportionate verification may be requested; do not spontaneously send identity documents or sign-in codes.
  • You may contact the CNDP: https://www.cndp.ma. Current details are on its official website.

Security

  • Service connections use HTTPS and the database applies access rules. Administrator rights differ from client/partner rights. No system offers absolute security.
  • On an incident the team must analyse facts, limit consequences and make required notifications. Security requests can be addressed to the team through Contact.

Minors

  • The service does not specifically target children. Minors must use it within applicable law and under their legal representative’s responsibility. Contact the team if a child’s data has been collected inappropriately.

Policy changes

  • The displayed date/version identify this text. New collection practices, providers or material changes need suitable information and, where required, further choice. Pages are available in French, English and Arabic.