Privacy policy
This policy explains what personal data Namaa processes when you use the namaa-erp.com website and the app.namaa-erp.com application, why, with which providers and for how long. It describes what the platform actually does today.
1. Who is responsible
Namaa is published by [To complete: name or company name of the publisher, legal form, tax identifier, address]. For any question about your data: [To complete: contact address, for example contact@namaa-erp.com].
Namaa acts in two capacities:
- Controller for the data of your user account (your name, your email address, your password…) and for billing your subscription.
- Processor for the data you enter in the application for your business: your customers and suppliers, their contacts, your commercial documents, your stock, your treasury and your files. This data belongs to you; we process it only to provide the service and on your instructions.
2. The data we process
| Category | Data |
|---|---|
| User account | First name, last name, email address, phone number (optional), language, time zone and display formats, date of last sign-in. The password is never stored in clear: only a hash (Argon2id) is. |
| Two-factor authentication | If you turn it on, the key of your authenticator app, encrypted, and your backup codes. |
| Your business data | Companies, customers, suppliers and their contact persons, products, documents (quotes, invoices, delivery notes…), stock, bank accounts and cash boxes, settings. |
| Files | Logos, attachments to documents, and the supplier invoices you scan. |
| Activity log | For each significant action in your account: who did it, when, on what, and the originating IP address. It serves security and traceability, and the authorised users of your account can see it. |
| Messages sent | For each email or text message the platform sends: the recipient, the type of message and its delivery status (sent, delivered, bounced). The content of messages is not kept. |
| Subscription | Your plan, its dates, your payment requests and their reference. Payment is by bank transfer: we receive and keep no card data. |
We sell no data, use none of it for advertising, and do not use it to train artificial intelligence models.
3. Why we process it
- To provide the service set out in the terms of use: create and secure your account, store your data, produce your documents, send the emails and text messages the platform sends (address verification, password reset, verification code, documents you send to your customers, stock alerts, billing notices).
- Security: preventing abusive access (limits on sign-in attempts), keeping the activity log, backing up data.
- Billing your subscription.
- Legal obligations that apply to us.
4. Our providers
Data is shared only with the providers the service needs, each for a specific purpose:
| Provider | Role | Data received | Location |
|---|---|---|---|
| Contabo GmbH | Hosting of the servers and backups | All the platform’s data, on our servers | Germany (EU) |
| Cloudflare (R2) | Storage of uploaded files | Your files | Cloudflare data centres |
| Brevo | Sending emails | Recipient address, message content, attachments | France (EU) |
| Resend | Sending emails, as Brevo’s fallback | Recipient address, message content, attachments | United States |
| Twilio | Sending text messages | Phone number and verification code | United States |
| Anthropic | Reading scanned supplier invoices (section 5) | The scanned file only | United States |
5. Reading invoices with artificial intelligence
When you choose to scan a supplier invoice, the file is sent to Anthropic, which reads it with its Claude model and returns the extracted information (supplier, date, lines, amounts) to prefill a document you check before saving it.
- What is sent: the file alone, with a fixed reading instruction. No other data from your account (your companies, suppliers or products) is sent.
- Optional: nothing is sent if you do not scan an invoice. The feature is not available on the free plan.
- Anthropic’s commitments for its commercial API: the data is not used to train its models; it is deleted from its systems within 30 days, unless content is flagged by its safety checks (kept up to 2 years); it is stored in the United States; a data processing addendum including the European Union’s standard contractual clauses is part of its commercial terms.
6. Your own artificial intelligence assistant
On the paid plans, you can authorise your own AI assistant to read your account’s data. This access exists only if you grant it. It is read-only, limited to what your role allows, and you can revoke it at any time. The data the assistant reads is then processed by the provider of that assistant, whom you chose, under their own terms.
7. Transfers outside Tunisia
Our servers are in Germany, and some providers are in France or the United States (section 4). These transfers are limited to what each provider needs to receive and are governed by their contractual commitments. [To complete after legal advice: formalities required by Organic Law No. 2004-63 and, where applicable, INPDP authorisation.]
8. Retention periods
| Data | Period |
|---|---|
| User account | As long as the account exists. A user removed from every account is deleted with their credentials; only their first and last name remain attached to the history of the documents they created. |
| Sign-up never completed | Deleted after 7 days without activity. |
| Your business data and files | As long as your account exists, or until you delete them. |
| Activity log | 30 days (trial and free), 1 year (Premium), 3 years (Ultimate). |
| Messages sent and their statuses | 90 days. |
| List exports | 1 day. |
| Imports | 7 days. |
| Invitations | 7 days to be accepted, deleted 90 days later. |
| Backups | 35 days. Database backups are encrypted. |
9. Cookies and browser storage
- The namaa-erp.com website sets no cookie, uses no audience measurement tool and loads nothing from third parties: its fonts are hosted by us.
- The application sets no cookie. It keeps in your browser’s local storage your session token (valid for 24 hours), your language, your theme and the selected company. These stay on your device and are removed when you sign out or clear the site’s data.
10. Security
Encrypted connections (TLS), passwords stored as hashes, two-factor authentication available, limits on sign-in attempts, strict separation of each account’s data, backups on a separate server: the database is copied there continuously and encrypted, the files once a day.
If a data breach concerns you, we will inform you without undue delay, and the INPDP where the law requires it.
11. Your rights
You can ask to access your data, correct it, delete it or object to its processing by writing to [To complete: contact address]. Most of your account information can be changed directly in the application. To close your account and delete its data, write to us: closure is not yet available in the application and we handle it on request.
For your business data concerning your own customers or suppliers, you are responsible for it: we help you answer their requests.
We answer within 30 days. You can also refer the matter to the Instance nationale de protection des données personnelles (INPDP), the supervisory authority set up by Organic Law No. 2004-63 of 27 July 2004.
12. Changes
We will update this policy when the platform or its providers change. The date at the top of the page shows the latest version; a significant change will be announced in the application or by email.