Data Protection Policy

1. Data Controller

CiteFlow
Website: citeflow.ma
Email: contact@citeflow.ma

CiteFlow is a Moroccan company in its development phase. No active commerce is currently conducted.

2. Data Collected

We collect the following data only for the purpose of the free audit service:

• Email — to send you your audit results
• Company name — included in the audit report
• Audit results — scores, analysis, and recommendations generated
• Usage data — pages visited, actions performed (for service improvement purposes)

No browsing data is shared with third parties. No third-party analytics cookies are installed.

3. Purposes and Legal Basis

3.1 Contract performance (Art. 6-b GDPR / Art. 5 LDA)

Data collected is processed for the free audit service, for which your explicit consent was obtained when submitting the form.

3.2 Legitimate interest (Art. 6-f GDPR)

Usage data may be processed to improve the service and detect abusive use or automated attacks.

3.3 Consent (Art. 6-a GDPR)

You may withdraw your consent at any time by contacting us at contact@citeflow.ma.

4. Cookies

CiteFlow only uses technical cookies necessary for the site to function:

• Session — client portal authentication (expires after 7 days)
• Preferred language — to remember your language choice (duration: 1 year)

No advertising, third-party analytics, or social media cookies are installed. You may disable cookies in your browser settings.

5. Data Retention Period

• Audit data — retained for 24 months after last access, then deleted
• Client portal data — retained for the duration of the subscription + 12 months
• Login logs — retained for 90 days for security purposes

6. Your Rights (Art. 8 Law 09-08)

Pursuant to Law 09-08 on personal data protection, you have the following rights:

• Right of access — obtain a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to portability — receive your data in a structured format
• Right to object — object to the processing of your data
• Right not to be subject to automated decision-making — in certain cases

To exercise your rights, contact us at: contact@citeflow.ma

7. CNDP Notification in Case of Breach

Pursuant to Law 09-08, in the event of a data breach likely to result in a risk to the rights and freedoms of individuals, we will notify the Commission Nationale de Contrôle des Données à Caractère Personnel (CNDP) within 72 hours of becoming aware of the breach.

If the risk is high, affected individuals will also be informed directly.

CNDP — Commission Nationale de Contrôle des Données à Caractère Personnel
Bd. Prince My Abdellah, Ryad, Rabat, Morocco
www.cndp.ma

8. Recipients and Sub-processors

We share your data only with:

• OpenAI — for audit result analysis (processed on our behalf, data not used to train models)
• Postmark / AWS SES — for sending transactional emails (audit results, notifications)
• Stripe — for future payment processing (if applicable)

No data is transferred to third parties outside the European Union. Any transfers to third countries are subject to appropriate safeguards (standard contractual clauses).

9. Complaint to the CNDP

If you believe that the processing of your personal data constitutes a violation of Law 09-08, you have the right to lodge a complaint with the CNDP:

Commission Nationale de Contrôle des Données à Caractère Personnel (CNDP)
Bd. Prince My Abdellah, Ryad, Rabat, Morocco
Email: contact@cndp.ma
www.cndp.ma

10. Contact

For any questions regarding the protection of your data:

Email: contact@citeflow.ma
Website: citeflow.ma