Privacy Policy

Last updated: March 17, 2026

This privacy policy describes how Sabab ("we", "us", "our") collects, uses, shares, and protects the personal data of users ("you") of the sabab.ma platform and its mobile applications, in accordance with Moroccan Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data and the General Data Protection Regulation (GDPR) of the European Union.

1. Data Controller

The data controller for personal data is:

2. Data Collected

We collect the following categories of data:

2.1 Identification data

  • Phone number (required for account creation)
  • Full name
  • Profile picture

2.2 Verification data (Professionals only)

  • Photo of the national identity card (front and back)
  • Selfie photo with the identity card

2.3 Geolocation data

  • Geographical position (with your explicit consent) for connection with nearby professionals

2.4 Technical data

  • IP Address
  • Browser and device type
  • Push notification token (FCM)

2.5 Usage data

  • Service requests submitted
  • History of missions and proposals
  • Reviews and ratings left

3. Purposes of processing

Your data is processed for the following purposes:

  • Creation and management of your user account
  • Connection between clients and professionals
  • Identity verification of professionals to ensure user security
  • Geolocation to suggest nearby professionals
  • Push notifications to inform you of the progress of your requests and missions
  • Improvement of the service and analysis of platform usage
  • Compliance with our legal obligations and fraud prevention

4. Legal basis of processing

Data processing is based on:

  • Your consent (geolocation, push notifications)
  • The execution of the contract (platform operation, connection)
  • Legitimate interest (security, fraud prevention, service improvement)
  • Legal obligations (identity verification)

5. Data sharing

Your personal data may be shared with:

  • Other users: your name, profile picture, reviews, and ratings are visible to other users regarding connection purposes.
  • Our technical service providers:
    • Cloud hosting and file storage
    • SMS and WhatsApp sending services for OTP verification
    • Firebase Cloud Messaging (Google) for push notifications
  • Payment providers: Stripe for secure payment processing (if applicable). Stripe is PCI DSS certified.
  • Competent authorities: in the event of a legal obligation or judicial requisition.

We never sell your personal data to third parties for commercial or advertising purposes.

6. Data transfer outside Morocco

Some of your data may be transferred to and stored on servers located outside Morocco (notably for cloud services and Firebase). These transfers are carried out with appropriate guarantees, in accordance with Article 43 of Law 09-08, and to countries offering an adequate level of protection or based on standard contractual clauses.

7. Retention period

  • Account data: kept for the duration of your registration, then deleted within 12 months after the deletion of your account.
  • Identity documents: kept for the duration of the verification, then for a maximum period of 24 months after the approval or rejection of the dossier.
  • Geolocation data: not stored permanently, used only in real-time for connection.
  • Technical data (logs): kept for a maximum of 12 months.

8. Data security

We implement appropriate technical and organizational measures to protect your data, including:

  • Encryption of communications (HTTPS/TLS)
  • Authentication by JWT tokens
  • Secure storage of files on encrypted servers
  • Limitation of access to data to authorized personnel
  • Rate limiting to prevent abuse

9. Cookies and similar technologies

The sabab.ma website uses session cookies for the operation of the administrator space. No advertising or third-party tracking cookies are used.

The mobile application does not use cookies. An authentication token is stored locally on your device to maintain your session.

10. Your rights

In accordance with Law 09-08 and the GDPR, you have the following rights:

  • Right of access: obtain confirmation that your data is being processed and request a copy of it.
  • Right of rectification: request the correction of inaccurate or incomplete data.
  • Right of erasure: request the deletion of your personal data.
  • Right to object: object to the processing of your data for legitimate reasons.
  • Right to portability: receive your data in a structured and machine-readable format.
  • Right to withdraw consent: withdraw your consent at any time (without affecting the lawfulness of the prior processing).

To exercise these rights, contact us at yousse.yassine@gmail.com specifying your request and providing proof of identity.

You also have the right to file a complaint with the National Commission for the Control of the Protection of Personal Data (CNDP): www.cndp.ma.

11. Protection of minors

The Sabab platform is not intended for people under 18 years of age. We do not knowingly collect data from minors. If you are aware that a minor has provided us with personal data, contact us so that we can proceed with its deletion.

12. Policy modifications

We reserve the right to modify this privacy policy at any time. Any modification will be published on this page with an update date. In the event of a substantial modification, we will inform you via a notification in the application.

13. Contact

For any questions regarding this privacy policy or the processing of your personal data: