Privacy Policy

1. Who we are and what this covers

Siya9a Maroc ("Siya9a Maroc", "we", "us") is operated by Youkla. This Privacy Policy explains what personal data we collect when you use siya9amaroc.com and the Siya9a Maroc apps and services (together, the "Service"), why we collect it, who we share it with, how long we keep it, and the rights you have over it.

Siya9a Maroc helps candidates prepare for the Moroccan driving theory test with practice series, mock exams, and audio explanations in Darija, Arabic and French. Driving schools can link their students to follow their progress. Siya9a Maroc is independent and is not run by or affiliated with NARSA or any government body.

We are the data controller for the personal data described here. If you have any question about this policy, write to [email protected].

2. The data we collect

We collect only what the Service needs to work. Here is the full list.

Category	What it includes	Why we need it
Account	Name, email address, profile picture from your sign-in provider, sign-in method	To create and secure your account and to contact you about it
Driving school	School name, phone number, and city	To review and approve the school, and to call its owner
Students	Full name, phone number, notes, and licence type entered by the school, and the student's access code	To let the school follow the students it registered
Results	For students linked to a school: each series and exam taken, the score, the time spent, and every answer	To show the student's progress and readiness to their school
Device	For linked students: device id, push token, platform, app version, and language	To link the app to the student's code and send the reminders the school requests
Usage and device	Pages visited, actions taken, browser type, approximate location from IP address, error reports	To keep the service working, find bugs, and prevent abuse
Messages	Anything you write to support, including screenshots you attach	To answer you

We do not collect government identifiers, precise location, biometric templates, or health data, and we do not build profiles of you from third-party sources.

3. Photos and other files you upload

Siya9a Maroc has no uploads. The app sends us nothing about a learner unless they enter a school code. From then on, it sends their results to our servers so the school can see them.

A school sees only its own students: their name, phone number, notes, whether they are online, their results by category, and every answer they gave. Siya9a Maroc admins see a school's name, owner, email, and phone number so they can approve it.

Our team prepares the questions, pictures, and audio explanations, some with the help of AI models. No learner or school data is sent to an AI model.

A school can delete a student at any time, which deletes that student's results. Deleting a school deletes all of its students. To have your data deleted, write to us and we remove it, whether you are a school or a student.

4. Children

Candidates for some licences can be under 18. A school that registers a student under 18 confirms it has permission from that student's parent or guardian.

Anyone under 18 may not create an account. If you believe a child has given us personal data directly, or that a photo of a child was uploaded without a parent's or guardian's permission, write to [email protected] and we will delete it.

5. Why we process your data, and the legal basis

Where the GDPR, UK GDPR, or a similar law applies, we rely on the following legal bases:

Performing our contract with you. Creating your account, generating what you asked for, storing it in your library, billing you, and answering your support requests.
Consent. Handling photos of other people, including your children, which you confirm you have permission to upload. Marketing emails, where you opted in. Analytics and advertising cookies on marketing pages, where the law requires consent. You can withdraw consent at any time; withdrawing it does not affect processing that already happened.
Legitimate interests. Keeping the Service secure, preventing abuse and fraud, measuring which features fail, and improving the Service. We balance these interests against your rights and do not rely on them for anything you would not reasonably expect.
Legal obligations. Keeping billing records for tax and accounting law, and answering lawful requests from authorities.

We do not use your personal data for automated decisions that have legal or similarly significant effects on you.

We never sell personal data. We never share it with data brokers or advertisers for their own use. We share it only with the service providers below, who process it on our instructions, under contracts that limit what they may do with it.

Provider	What they do for us	Where
Mailgun	Transactional email: sign-in codes, receipts, ready notifications	United States / EU
Apple Push Notification service, Firebase Cloud Messaging	Delivering the reminders a school sends to its students' phones	United States
Google Analytics	Aggregate traffic measurement on the website	United States

We may also disclose data if the law requires it, to protect the rights and safety of you, us, or others, or as part of a merger or sale of Youkla, in which case this policy continues to apply to your data.

7. Cookies, analytics and advertising

The Service uses a small number of cookies and similar technologies:

Strictly necessary. Signing you in, remembering your session and your preferences. These cannot be switched off without breaking the Service.
Analytics. PostHog and Google Analytics tell us which screens are used, which fail, and where people get stuck. Data is aggregated; we do not use it to identify you.
Advertising measurement. On marketing pages only, Meta Pixel and TikTok Pixel let us see whether an ad led to a sign-up. They do not run inside the app after you sign in.

You can block cookies in your browser settings, opt out of ad measurement through Meta and TikTok's own ad settings, and use browser extensions that block trackers. Blocking necessary cookies will prevent sign-in.

8. International transfers

Our providers operate in the United States and the European Union. When personal data leaves the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework, and we take additional measures where a transfer risk assessment calls for them.

9. How long we keep data

Account data stays for as long as your account exists.
Student records and results stay until the school deletes them, or until we delete them at the student's or the school's request.
Server logs and analytics events are kept for up to 12 months.
Support conversations are kept for up to 24 months so we can follow up on earlier issues.

When data is no longer needed we delete it or anonymise it so it can no longer be linked to you.

10. How we protect data

Every connection to the Service is encrypted with TLS.
Files are stored encrypted at rest, in per-account folders, under random file names that cannot be guessed or enumerated.
Our database is encrypted in transit and access to it is limited to the systems that need it.
Payment card details are entered directly into Stripe and never pass through our servers.
Access to production systems is restricted to the people who operate the Service, protected by multi-factor authentication, and logged.

No system is perfectly secure. If we discover a breach that affects your personal data we will tell you and the relevant authority without undue delay, as the law requires.

11. Your rights

Depending on where you live you have some or all of the following rights, and we honour them for everyone, wherever you are:

Access. Ask for a copy of the personal data we hold about you.
Correction. Ask us to fix data that is wrong.
Deletion. Ask us to delete your data. Most content you can delete yourself inside the Service; for the whole account, write to us.
Portability. Receive the data you gave us in a machine-readable format.
Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause it while we check a request.
Withdraw consent. For anything we do on the basis of consent.
Complain. Lodge a complaint with your data protection authority. In the EU that is the authority of the country where you live; in the UK it is the Information Commissioner's Office.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use and share it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. We have not sold personal information in the preceding 12 months.

Other US states. Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising and profiling. We do not engage in profiling that produces legal or similarly significant effects.

To exercise any right, write to [email protected] from the email address on your account, or use the contact page. We verify requests by confirming control of that email. We answer within 30 days, or within the shorter period your local law requires, and we never charge for a request unless it is clearly unfounded or repetitive. You may authorise someone else to make a request on your behalf; we will ask for proof of that authorisation.

12. Marketing emails

We send transactional emails you cannot opt out of while you have an account: sign-in codes, receipts, and notices that something you made is ready. We send marketing emails only if you asked for them, and every one has an unsubscribe link.

13. Links to other sites

The Service may link to sites we do not control, such as Stripe's checkout or a payment receipt. Their privacy policies apply there, not this one.

14. Changes to this policy

When we change this policy we update the date at the top. If a change reduces your rights or changes how we use existing data in a way you would not expect, we email account holders before it takes effect.

15. Contact

Youkla, operator of Siya9a Maroc
Privacy requests: [email protected]
Everything else: [email protected]

These Terms and any dispute arising from the Service are governed by the laws of the country in which Youkla is established, without regard to conflict-of-law rules, and subject to the mandatory consumer protection rules of the country where you live.