Last updated: April 2025
Law 09-08 Compliant. Bedaki's data processing activities are declared to the Commission Nationale de contrôle de la Protection des Données à caractère personnel (CNDP) in accordance with Moroccan Law No. 09-08.
Bedaki ("we, " "our, " or "us") operates the website bedaki.com and the Bedaki SaaS platform (collectively, the "Service"). Bedaki is a company registered in Casablanca, Morocco, and provides an AI-powered chatbot platform that enables businesses to build, deploy, and manage intelligent conversational agents.
As a data controller, Bedaki processes personal data in strict compliance with Law No. 09-08 of February 18, 2009, on the Protection of Individuals with Regard to the Processing of Personal Data (hereinafter "Law 09-08") and its implementing Decree No. 2-09-165 of May 21, 2009. Our data processing activities are declared to and overseen by the Commission Nationale de contrôle de la Protection des Données à caractère personnel (CNDP), the Moroccan data protection authority.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Service. By accessing or using the Service and accepting our Terms of Service, you consent to the data processing practices described in this Privacy Policy, as required under Article 4 of Law 09-08.
We may collect personally identifiable information that you voluntarily provide to us when you register for an account, subscribe to a plan, or contact us. This information may include:
We automatically collect certain information when you access or use the Service, including:
As part of the Service, we process data related to the chatbots you create and the conversations your chatbots have with end users. This may include:
We use the information we collect for the following purposes:
Bedaki processes your personal data on the following legal bases as defined by Law No. 09-08:
| Processing Activity | Legal Basis | Law 09-08 Reference |
|---|---|---|
| Account creation and service delivery | Consent | Art. 4, explicit consent at registration |
| Billing and invoicing | Contract | Art. 4, performance of a contract |
| Security, fraud prevention, audit logs | Legitimate interest | Art. 4, legitimate interests of the controller |
| Tax and accounting record retention | Legal obligation | Art. 4, compliance with legal obligations |
We take the security of your data seriously and implement industry-standard technical and organizational measures to protect it.
All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption. API keys and sensitive credentials are stored using strong hashing algorithms and are never logged or exposed in plaintext.
Our platform employs strict multi-tenant data isolation to ensure that your data is logically separated from other customers' data. Access controls, role-based permissions, and audit logging are enforced at every layer of the application.
Our Service is hosted on reputable cloud infrastructure providers with data centers that maintain SOC 2 Type II compliance, ISO 27001 certification, and physical security controls including 24/7 monitoring, biometric access, and redundant power systems. We regularly perform security audits, vulnerability assessments, and penetration testing.
We may share your information with third-party service providers that assist us in operating the Service. These providers are contractually obligated to protect your data and use it only for the purposes we specify.
| Provider | Purpose | Location |
|---|---|---|
| Vantage Payment Systems SA (Payzone) | Card payment processing for MAD subscriptions | Morocco |
| OpenAI | AI language model inference | United States (EU region available) |
| WhatsApp Ireland Limited | WhatsApp Business Cloud API hosting and message delivery | Ireland (EU) |
| Meta Platforms Ireland Limited | Messenger & Instagram messaging APIs (EEA users) | Ireland (EU) |
| Meta Platforms, Inc. | Messenger & Instagram messaging APIs (non-EEA users) | United States |
| Amazon Web Services EMEA SARL (AWS) | Cloud infrastructure, application hosting, managed PostgreSQL database, object storage (S3), transactional email (SES) | European Union regions |
When you enable WhatsApp Business, Messenger, or Instagram on a Bedaki chatbot, the platform accesses and processes data through Meta APIs ("Platform Data"). This section discloses how that data flows, in line with the Meta Platform Terms and the WhatsApp Business Solution Terms.
We do not use Facebook Login at this time.
We do not use Meta Platform Data for advertising, profiling, sale to data brokers, or AI model training of any kind. Aggregated, non-content metrics derived from Bedaki dashboard usage may be used for internal product improvement only.
Meta processes Platform Data on servers in Ireland (EEA) and the United States. Transfers from Morocco are made under CNDP cross-border authorization and Meta's own GDPR safeguards (Standard Contractual Clauses; EU-US Data Privacy Framework where applicable). End users in the EEA benefit from Meta Platforms Ireland Limited as the EEA-controller for Messenger and Instagram flows, and WhatsApp Ireland Limited for WhatsApp flows.
When you pay for a Bedaki subscription, card payment is handled by Vantage Payment Systems SA ("Payzone"), a payment institution licensed by Bank Al-Maghrib (Wali decision dated 9 February 2024). This section explains what payment data flows where.
Bedaki never receives or stores your full card number (PAN), card expiry date, CVV/CVC, or any sensitive authentication data. Card data is captured directly by Payzone's secure payment page; Bedaki receives only a transaction reference, the amount, the masked card brand, and the result (success / decline / pending).
Cardholder data is processed by Payzone and shared with Visa or Mastercard for authorization, with the acquiring bank, with the Moroccan national interbank Switch for clearing, and with competent authorities where the law requires.
Payzone's processing is declared to the CNDP under reference D-732/2023; cross-border transfer of cardholder data to Visa / Mastercard is authorized under CNDP reference T-PO-426/2023; Payzone's client management activity is authorized under reference A-GC-1521/2024.
Bedaki retains the electronic record of each transaction (reference, amount, currency, timestamp, masked card brand, status, associated invoice) for 24 months, as required by Payzone Article 5.7 and Moroccan accounting / VAT regulations. The masked record contains no sensitive cardholder data.
For access, rectification, or objection regarding the card data Payzone holds about you, contact Payzone's data team at support@payzone.ma or write to Vantage Payment Systems SA, 200 Boulevard Ghandi, Casablanca. For access, rectification, or erasure regarding the masked transaction records Bedaki holds (invoices, billing records), contact us at privacy@bedaki.com.
We retain personal data only for as long as necessary for the stated purpose, and no longer than permitted by law.
| Data Category | Retention Period | Legal / Business Reason |
|---|---|---|
| Account & profile data | Subscription duration + 5 years | Legal and tax compliance |
| Billing records & invoices | 10 years | Moroccan accounting regulations |
| Chatbot conversation logs | 12 months | Service analytics; earlier deletion on request |
| Usage & technical data | 13 months | Platform security and performance |
| Consent record (terms acceptance) | 5 years | Law 09-08, proof of consent |
| Support communications | 3 years | Dispute resolution |
| Payment transaction records (reference, amount, masked card brand, status) | 24 months | Payzone contract Art. 5.7 and Moroccan accounting / VAT obligations |
As a data subject, you have the following rights under Articles 7 to 10 of Law No. 09-08. To exercise any of these rights, submit a written request to privacy@bedaki.com or by post to our Casablanca office. We will respond within the timeframes specified below.
You have the right to obtain confirmation of whether we process personal data about you, and to receive a copy of that data along with information on the purposes of processing, the categories of data, and any recipients. We will respond within 30 days.
You have the right to request correction of any inaccurate, incomplete, or outdated personal data. We will rectify the data within 10 days of receiving your valid request, as required by Law 09-08. You can also update most information directly through your account settings.
You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent and no other legal basis applies. Upon a valid request, we will delete your data from active systems within 30 days. Certain data may be retained where required by law (e.g., billing records).
You have the right to receive your data in a structured, machine-readable format. You can export your chatbot configurations, knowledge base content, and conversation logs at any time through the Service's export features.
You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to other processing activities where the processing is based on our legitimate interests. To exercise any right, contact us at privacy@bedaki.com. If you are not satisfied with our response, you may lodge a complaint with the CNDP: www.cndp.ma | Tel: 3020.
If you are an end user who has interacted with a Bedaki-powered chatbot, for instance via WhatsApp, Messenger, Instagram, or a website widget, and you want your data accessed, corrected, or erased, you do not need to contact the customer running the bot. You may submit a request directly to us.
Data Deletion page, Visit our Data Deletion page for the request form and process.
We acknowledge requests within 7 days and complete erasure within 30 days, in line with Law 09-08 Article 8 and Meta Platform Terms §3.b. If your request has not been resolved within 30 days, you may complain to the CNDP at www.cndp.ma.
We use cookies and similar tracking technologies to enhance your experience on our Service. For detailed information about the cookies we use and how to manage your preferences, please visit our Cookie Policy.
Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take immediate steps to delete that information from our servers. If you believe we may have collected information from a child under 16, please contact us at privacy@bedaki.com. privacy@bedaki.com.
Certain data processing activities require transferring your personal data outside Morocco. Specifically, our AI processing relies on OpenAI whose infrastructure is located in the United States, and our channel integrations rely on Meta (United States). In accordance with Article 43 of Law 09-08, we have obtained the necessary authorization from the CNDP for these international transfers. Safeguards in place include:
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date at the top. For significant changes, we may also send you a notification via email or through the Service.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated terms.
For any questions, concerns, or requests regarding this Privacy Policy or to exercise your rights under Law 09-08, please contact us:
We will respond to all privacy-related inquiries within 30 days of receipt, or within 10 days for rectification requests as required by Law 09-08.
If you are not satisfied with our response, you have the right to lodge a complaint with the CNDP (Commission Nationale de contrôle de la Protection des Données à caractère personnel): www.cndp.ma | Tel: 3020 | Address: Angle Rues Brihi & Ghafsi, Hay Riad, 10100 Rabat, Morocco.