Privacy Policy

This Privacy Policy explains what personal data NR Links collects, why we collect it, how we use and protect it, and the rights you have under Moroccan Law 09-08 on the protection of personal data and — where applicable — the European General Data Protection Regulation (GDPR).

1. Who we are (Data Controller)

The data controller is NR Links SARL, registered in Morocco at Fès 30000. You can reach our data protection contact at privacy@nrlinks.ma. For technical requests about an existing account, use the WhatsApp number shown in your dashboard.

2. What personal data we collect

a) Business owners and team members

When you sign up for an NR Links account, we collect:

• Identity: display name, email address, optional WhatsApp number, optional avatar image.
• Authentication: Argon2id-hashed password (we never store the plaintext), session tokens.
• Preferences: dashboard language, notification choices.
• Business data you upload: the menu, items, prices, photos, business profile, QR codes.

b) Customers placing orders

When a customer scans a QR code and places an order, we collect — only what is strictly needed to deliver that order:

• For dine-in: table label (from the QR or picked by the customer). No name or phone unless the business asks for it.
• For takeaway: customer name and phone number so the restaurant can call when the order is ready.
• For delivery: customer name, phone number and delivery address.

c) Public page visitors (anonymous)

When anyone visits a public business page or scans a QR code, we log, in a privacy-preserving form:

• A one-way hash of the visitor's IP + user-agent — used only to deduplicate scans within a short window.
• Device class (phone / tablet / desktop) and preferred locale.
• Which QR code or page was scanned and when.

3. Legal basis for processing

We process personal data on the following bases:

• Contract performance: to operate your account and let you use the paid or free plan you signed up for.
• Legal obligation: to comply with Moroccan accounting and tax law (invoices, receipts).
• Legitimate interest: to secure the service against fraud and abuse, improve features, and send essential service emails.
• Consent: for optional marketing emails (if we introduce any) and for non-essential analytics. You can withdraw consent at any time.

4. How we use data

We use personal data to: run your account; display your public menu and process orders; send transactional emails (verification, password reset, subscription changes, approval); secure the service; comply with legal obligations; and improve the product in aggregate. We never use order data from one business to help a competing business.

5. Who we share data with

We share personal data only with carefully selected processors who help us run the service, under written data-processing agreements:

• Hosting and database providers who store the data on our behalf.
• Email delivery providers that send our transactional emails.
• Payment and WhatsApp providers used for subscription payment and notifications.
• Legal and regulatory authorities when required by law or valid legal process.

6. Data retention

We keep account data for as long as the account is open. On closure, personal data is retained for 30 days (to allow export and account recovery) and then permanently deleted — except where Moroccan law requires longer retention (for example, invoicing records are kept for 10 years). Order data is kept for 5 years to meet accounting obligations, then anonymized.

7. Your rights

Under Law 09-08 — and under the GDPR when it applies — you have the following rights:

1. Access: to know what personal data we hold about you and to receive a copy.
2. Rectification: to correct inaccurate or incomplete data.
3. Deletion: to request erasure of your personal data, subject to legal retention obligations.
4. Objection: to object to processing based on legitimate interest, where no overriding grounds exist.
5. Portability: to receive your data in a structured, machine-readable format.
6. Withdrawal of consent: to withdraw consent at any time for processing based on consent.

To exercise any right, write to privacy@nrlinks.ma. We respond within 30 days. If you believe we have mishandled your data, you can lodge a complaint with the CNDP (www.cndp.ma) or your local supervisory authority.

8. How we protect your data

We apply layered security: passwords are hashed with Argon2id, sessions use opaque tokens with CSRF double-submit, data is isolated per business with Postgres row-level security on a restricted database role, images are stripped of EXIF metadata on upload, and all traffic is served over HTTPS. We rate-limit sensitive endpoints and keep audit logs of administrative actions.

9. Cookies

We use strictly necessary cookies to keep you signed in (session cookie), to protect against CSRF (double-submit cookie), and to remember your language choice. We do not use advertising or cross-site tracking cookies. Essential cookies do not require consent under Moroccan and EU law.

10. International data transfers

Our primary infrastructure is located in Morocco or in a jurisdiction that provides an equivalent level of protection. Where personal data is transferred outside Morocco (for example, to a European email provider), we rely on standard contractual clauses or equivalent legal mechanisms to safeguard your data.

11. Children's data

NR Links is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes are announced by email at least 15 days before they take effect. The current version is always available at /privacy with its effective date.

13. Contact for data requests

For any data-protection request, write to privacy@nrlinks.ma or by post to NR Links SARL, Fès 30000, Morocco. For urgent security concerns, add security@nrlinks.ma to your message.