Privacy Policy

The collection and processing of personal data is carried out by Yellow Ant Services SARL (SIREN: 983 349 176), publisher of the Billora invoicing SaaS platform, whose head office is at 21 SQ Edison, 94000 Créteil, France.

Billora acts, depending on the case, as:

• Controller for the Clients' account data (email, company information, billing);
• Processor for the business data entered by the Client in the platform (their own clients' data, invoices, contacts).

We collect only the data strictly necessary to provide the Services:

Billora never collects sensitive banking data (card number, CVV). No online payment transaction is processed directly by the platform in the MVP. On the mobile app, data you have already viewed is kept in a private cache on the device for offline mode: it is erased when you sign out. Any biometric lock of the app stays local to your phone: Billora has no access to it.

Your data is processed for the following purposes:

• Provision of the Services — creation and management of your workspace, generation of PDF documents, sending of transactional emails;
• Account management — authentication, role and invitation management, security;
• Technical support — responding to assistance requests, resolving incidents;
• Notifications — sending push notifications (payment received, quotes, reminders) through Expo, then Google FCM (Android) or Apple APNs. The title and text of the notification, which may mention an amount or a document number, pass through these services;
• Platform improvement — aggregated audience measurement of the public website (Google Analytics, with your consent, no targeted advertising) to improve the experience;
• Internal usage statistics — in your workspace and the mobile app, Billora itself counts, per company and per day, the screens viewed (in generic form, for example “invoice page”) and the use of the main features, distinguishing only between the mobile app, a computer or tablet browser and a phone browser (based on screen width, never its exact value); without cookies, device identifiers or third-party tools, without any name, amount or document number, and without being tied to a user; solely to improve the product;
• Legal compliance — compliance with Moroccan tax and regulatory obligations.

Billora never sells, rents or shares your personal data with third parties for commercial purposes. To provide the Services, Billora relies on technical providers that process data on its behalf and under its instructions: Hostinger (hosting of the API, the database and uploaded files on a server located in France, backups in Lithuania, and email delivery), Cloudflare R2 for the archiving of signed e-invoices (Western Europe region) and, for mobile app notifications, Expo, Google and Apple. Public and sign-in forms are protected against bots by Cloudflare Turnstile, which analyzes your browser and IP address to tell a human from a program. Audience measurement of the public website is provided by Google Analytics, with your consent. Your data is hosted outside Morocco, in France (Hostinger), and some providers (Cloudflare, Google, Apple, Expo) are established outside Morocco or process data there: transfers to the latter are limited to the data needed for the service (for example the device token and the text of a notification).

The processing carried out by Billora is based on the following legal bases, in accordance with law no. 09-08:

• Performance of the contract — processing necessary to provide the Services (account, billing, email sending);
• Legitimate interest — platform security, audit log, fraud prevention (including Cloudflare Turnstile bot protection) and cookie-free internal usage statistics;
• Consent — analytics cookies on the public website (with the option to refuse);
• Legal obligation — keeping, in Billora's own accounting, the subscription invoices issued to its customers (10 years);

In accordance with Moroccan law no. 09-08 on the protection of personal data, you have the following rights:

• Right of access — obtain a copy of your personal data processed by Billora;
• Right of rectification — correct inaccurate or incomplete data;
• Right to erasure — ask for your account and data to be deleted, from the website or the app (Account → Delete my account): your data is kept for 60 days in read-only mode, then permanently deleted (see the “Account deletion” page);
• Right to portability — export all your data in a structured format (“Export all my data” button: CSV, PDFs, files and supporting documents);
• Right to object — object to processing based on our legitimate interest.

To exercise these rights, contact us at contact@billora.ma. We undertake to respond within 30 days.

Billora uses two types of cookies:

• Essential cookies — necessary for functioning (authentication session, UI preferences). These cookies cannot be refused without preventing access to the Services.
• Analytics cookies — Google Analytics audience measurement on the public website, enabled only after your explicit consent (cookie banner); you can withdraw it at any time. No third-party audience measurement tool is loaded in the signed-in area.
• Internal statistics — the signed-in area and the app measure their own use without any cookie or storage on your device; counting is done on Billora's servers, which is why no consent is requested.

No targeted advertising or cross-site tracking cookie is used. For the detail of cookies and local storage, see our cookie policy.

Billora implements the following technical and organizational measures to protect your data:

• Encryption in transit — HTTPS/TLS on all communications;
• Password encryption — salted hashing (irreversible);
• Multi-tenant isolation — each company is strictly isolated at the application layer (systematic tenant filter);
• Role-based access control — owner, accountant, viewer with distinct permissions;
• Audit log — traceability of sensitive actions (creation, modification, deletion);
• Secure hosting — cloud infrastructure with regular backups.

Data is kept for the following periods:

• Account data — for the whole duration of the subscription, then 60 days (by default) after a deletion request is validated, in read-only mode, before final deletion;
• Billing data — your invoices and documents belong to your business, which must keep them for 10 years under Moroccan accounting rules: Billora keeps them for as long as you are subscribed and lets you export them; the subscription invoices Billora issues are kept for 10 years in its own accounting;
• Activity and security log — 12 months (365 days) from each event, then automatically deleted (scheduled, batched purge); never applies to documents (invoices, quotes…) or to records with a legal retention requirement;
• Usage statistics — 13 months, then automatically deleted; erased with the account.
• Offline cache of the app — on your phone, erased when you sign out or when the session expires (30 days at most);
• Test data (sandbox) — deleted when the account is activated in production mode.

For any question about this policy or to exercise your rights:

• Email : contact@billora.ma

In the event of an unresolved complaint, you have the right to refer the matter to Morocco's National Commission for the Control of Personal Data Protection (CNDP).

This policy may be modified. Any substantial change will be notified to you by email with 15 days' notice.