Who we are
The sayrivo.ma website and the SAYRIVO software (the app.sayrivo.ma application and the agencies' public booking pages) are published by SAYRIVO (below), the controller of the data described in this policy.
Who this policy is for
- Visitors of the sayrivo.ma website.
- Rental agencies that are our customers, and the people who use their account: owners and staff.
It does not cover the data agencies record about their own customers, the renters. For that data the agency is the controller and SAYRIVO acts as its processor, under the Data processing agreement. If you rented a vehicle from an agency that uses SAYRIVO, send your requests to that agency: we will help it answer.
The data we collect
On the sayrivo.ma website
- Audience measurement: Vercel Web Analytics counts page views and a few clicks (trial request, sign-in, download) without cookies and without identifying visitors. We only see totals.
- Technical logs: like any web server, our host records the IP address, browser and page requested, to run and protect the site.
- The “Your question” form: the name, agency, email, phone, topic and message you enter. They are emailed to us so we can answer.
- Your emails to contact@sayrivo.ma: your address and the content of the message.
In the app, for the agency and its users
- Account: each user's name, email, phone and role. Passwords are never stored in plain text; for a passkey, only the public key is kept.
- Agency: company name, contact details, logo, contract details and the settings of its public booking page.
- Subscription: plan, due dates, bank-transfer payments and receipts. We never receive a card number.
- Security and usage: sign-ins, important actions, technical errors and the number of calls to AI features, for security, support and usage limits.
- Notifications: if you turn them on for a device, the subscription address your browser provides.
- Bot protection: at sign-up, sign-in and on public booking pages, Cloudflare Turnstile checks technical browser signals to confirm a person is there.
- Support: your conversations with our team by email, WhatsApp or phone.
Why, and on what basis
We use your data only for the purposes below. Each rests on a basis set out in Moroccan law 09-08.
Provide the Service and run the account
- Data
- Account, agency, content entered
- Legal basis
- Performance of the contract (terms of service)
Bill the subscription, keep the accounts
- Data
- Subscription, billing
- Legal basis
- Contract; legal obligation
Protect the site and app, prevent fraud
- Data
- Logs, security, Turnstile
- Legal basis
- Legitimate interest: security of the Service
Answer your questions, provide support
- Data
- Form, emails, conversations
- Legal basis
- Legitimate interest; pre-contract steps
Measure the site's audience
- Data
- Page views, cookieless, aggregated
- Legal basis
- Legitimate interest
Tell you about an important change to the Service
- Data
- Account email
- Legal basis
- Contract
We do not sell your data. We do not run targeted advertising and we do not send marketing without your consent.
Artificial intelligence features
Some features send data to an AI provider, only when an agency user starts them:
- Document reading: the photo of an ID card, passport or driving licence is sent to read its fields (name, number, dates). The result pre-fills a form the user checks; uncertain fields are flagged.
- Vehicle inspections: vehicle photos can be compared to flag damage, and the odometer read from a photo.
- Assistant: the question asked and the agency information needed to answer it. The assistant asks for confirmation before changing anything.
- Contracts: the pages of the agency's contract template are analysed to place the fields.
- Summaries and suggestions: summaries (customer, vehicle) and suggestions drawn from the agency's data.
These providers are Anthropic and OpenAI (see the Sub-processor list). Under their commercial API terms, they do not use this data to train their models and keep it only for a limited time. No facial recognition is performed. An AI proposal can be wrong: it is always shown for review.
Who can see your data
- Members of the SAYRIVO team who need it to run the Service or help you. They are bound by confidentiality.
- Our technical providers, each for its own task only. The full list, with what each one sees, is published in the Sub-processor list.
- Authorities, when the law requires it.
Inside an agency, each user sees what their role allows. Each agency's data is kept apart from every other agency's.
Where your data is
The database and files are hosted by Supabase in the European Union (Ireland). The app is served by Vercel; its server code runs in the outside Morocco region. A daily backup copy is kept outside the main host. Some providers, including the AI providers, are based in the United States.
Transfers of data outside Morocco take place within the framework of law 09-08 (CNDP declaration in progress).
How long we keep it
Account and agency data
- Period
- During the subscription, then 30 days after it ends so an export can be made, then deleted
Trial not continued
- Period
- 30 days after the trial ends, then deleted
Backup copies
- Period
- Erased as they rotate, at most 30 days after deletion
Receipts and accounting records
- Period
- 10 years
Security logs
- Period
- 12 months
Form and emails
- Period
- 3 years after the last exchange
Audience measurement
- Period
- Aggregated totals, nothing individual
How we protect it
- Encrypted connections (HTTPS) between your device, the app and our providers.
- Each agency's data is isolated by access rules inside the database, tested against attempts by one agency to reach another's data.
- Files (documents, photos, contracts) in private storage, opened through temporary links.
- Passwords never stored in plain text; sign-in by passkey available.
- Team access limited to what support and operations need; daily backups.
If a data breach puts you at risk, we inform the people concerned and the competent authorities within the time the law requires.
Your rights
You can ask to access, correct or delete your data, and object to processing based on our legitimate interest. You can also withdraw consent at any time.
Write to contact@sayrivo.ma. We answer within one month and may ask you to prove your identity.
You can also complain to Morocco's data protection authority, the CNDP (cndp.ma).
Renters: for data recorded by an agency, contact the agency. If you write to us, we pass your request on to it.
Cookies
The sayrivo.ma website sets no audience-measurement or advertising cookies. The app only uses the cookies needed to keep you signed in and your session secure; they do not require consent.
Changes
We may update this policy. The date at the top of the page shows the version in force. For an important change, customer agencies are told by email before it takes effect.