Privacy policy

Privacy Policy

Version of 14 November 2026

1. Controller

[to be completed], [to be completed] incorporated under Moroccan law, whose registered office is located at [to be completed], registered with the trade register under number [to be completed], publishes the Vextrado service. For any question about your data: dpo@vextrado.com.

Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data applies, under the supervision of the National Commission for the Control of Personal Data Protection (CNDP); declaration: [to be completed]. As the service is also aimed at companies in the European Union, Regulation (EU) 2016/679 (the “GDPR”) applies to this processing. Representative in the European Union (GDPR article 27): [to be completed].

2. Data subjects

This policy concerns visitors to the website, people who request a free sample or ask a question from the Contact page, and users of the platform. If a generic address of your company appears in our company database, the “Data and sources” page explains what we record, and the “Remove a company” page allows you to remove it immediately.

3. Data, purposes and legal bases

| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing your account, delivering leads | Name, business email, company, language, search profile, history of leads and tracking | Performance of the contract; legitimate interest for users who are not themselves parties to the contract |
| Managing your subscription | Plan, billing cycle, billing country, subscription status. Payment, invoices and taxes are handled by Paddle, our reseller, which acts as a separate, independent controller: we never receive your card details | Performance of the contract; legal obligation |
| Reserving a subscription before online payment opens | Email, company, billing country, plan chosen | Pre-contractual measures taken at your request; consent to be notified when payment opens |
| Sending the free sample requested | Company, name and position, email, sector, target countries, description of the offering | Pre-contractual measures taken at your request; consent to be contacted again |
| Answering your questions | Email, company, question, answer | Legitimate interest; performance of the contract for clients |
| Informing you about our service | Identity and business contact details | Legitimate interest (business-to-business prospecting related to your activity), with the right to object at any time |
| Security and abuse prevention | Technical logs, non-reversible hash of the IP address | Legitimate interest |

No decision producing legal effects concerning you is taken solely on the basis of automated processing.

4. Artificial intelligence

The service is operated by artificial intelligence agents: searching for and checking leads, drafting, support answers. For this purpose, the content of your search profile or of your question may be transmitted to our AI provider (Anthropic, United States), which acts as a processor. You are informed, on each page concerned, when you are interacting with an AI assistant.

5. Recipients

Our technical processors, within the limits of their tasks: Supabase (database and authentication, EU region), Vercel (hosting), Brevo (sending emails, France), ImprovMX and Google (receiving and forwarding emails sent to contact@vextrado.com), Anthropic (artificial intelligence). Paddle.com Market Limited (United Kingdom), our reseller, receives the data needed for payment and invoicing as a separate, independent controller, in accordance with its own privacy policy. The authorities, where required by law. We do not sell your data.

6. International transfers

Data is hosted mainly in the European Union. The service is published from Morocco, and some processors are established in the United States or the United Kingdom. These transfers are governed by the adequacy decisions of the European Commission where they exist (United Kingdom; EU–US Data Privacy Framework for certified recipients), failing which by the standard contractual clauses of the European Commission, and in accordance with law no. 09-08.

7. Retention periods

| Data | Period |
|---|---|
| Account, delivered leads and tracking | Duration of the subscription, then 30 days |
| Billing data (retained by Paddle, reseller) | According to Paddle's legal obligations |
| Sample requests | 3 years after the last exchange |
| Subscription reservations | 3 years after the last update |
| Questions asked from the Contact page | 1 year |
| Technical logs | 12 months |

8. Cookies

We only use strictly necessary cookies: session, security, language and display preferences. No advertising or audience measurement cookies are placed. Website traffic is measured without cookies and without identifiers: only totals of page views per day, per language and per country are recorded. The Paddle payment window, which opens only when you choose to subscribe, may place the cookies needed to secure the payment.

9. Security

Encryption of data in transit and at rest, role-based access control, isolation of each client's data, backups and access logging.

10. Your rights

You may request access to your data, its rectification, its erasure, the restriction of processing and its portability, and you may object to processing based on legitimate interest. Clients exercise these rights directly from “Settings”; any other person may write to dpo@vextrado.com. We respond within 30 days. You may lodge a complaint with the CNDP (www.cndp.ma) or, if you reside in the European Union, with the data protection authority of your country (in France, the CNIL, www.cnil.fr).

11. Changes

The date of the latest version appears at the top of the page. In the event of a significant change, users are notified by email.