Privacy Policy

Lagrichi Digital Solutions operates Maweid from the United Kingdom. We are currently a sole trader; this policy will be updated if we incorporate a UK limited company. For account, billing, support, and platform operation data about you (the business user), we act as data controller under UK GDPR and the UK Data Protection Act 2018. For personal data your clients submit through booking forms or that you enter in the CRM, you are the controller for your business and we act as processor under our DPA (/legal/dpa). You must comply with privacy law in every country where you operate and where your clients live.

We may collect: • Account data: name, email, business name, phone, address, timezone, plan, settings. • Appointment data: dates, times, services, notes, status. • Client data you or your clients enter: names, emails, phone numbers. • Technical data: IP address, browser type, device information, and logs needed for security and operation. • Billing data: subscription status, invoices, and payment metadata from Stripe (we do not store full card numbers; Stripe processes card details).

We use data to: • Provide booking, calendar, CRM, and dashboard features. • Send notifications you enable (confirmation, reminder, cancellation emails; WhatsApp when connected). • Operate trials, plan limits, and support. • Maintain security, prevent abuse, and improve the Service. We do not sell your personal data or your clients' data to third parties for their marketing.

We use trusted providers to run the Service. A current list with roles and locations is at /legal/subprocessors. Typical providers include Appwrite (database and authentication), Vercel (hosting and edge delivery), Stripe (subscription payments), and Twilio / SendGrid (transactional email and messaging, when configured). These providers process data only to deliver the Service under contractual safeguards (including UK international transfer tools where data leaves the UK). We may disclose information if required by law or to protect rights, safety, and security.

We retain account and appointment data while your subscription or trial is active. After closure or termination, we aim to delete or anonymize business data within 90 days, except where we must keep limited records longer for legal, tax, accounting, or dispute purposes (including records Stripe or HMRC rules may require us to keep). You may request deletion of your business account by contacting support. Export or delete client data in your account before closure where required by law in your jurisdiction.

We apply reasonable technical and organizational measures (access controls, HTTPS, server-side API keys, role-based dashboard access). No method of transmission or storage is 100% secure. You must protect your passwords and devices.

If we process your personal data as controller, your rights depend on where you live. Examples: • UK — UK GDPR: access, rectification, erasure, restriction, portability, objection; ICO complaints at ico.org.uk. • EEA (e.g. France) — EU GDPR and local supervisory authority (e.g. CNIL). • Morocco — Law 09-08 rights via the controller (usually your service provider) and applicable local procedures. • UAE and other countries — local privacy laws may provide similar rights. Your clients should contact you (their salon, clinic, or business) first. They may email support@lagrichidigital.com and we will assist or forward requests to you where appropriate.

We may update this Privacy Policy. The "Last updated" date will change when we do. Contact: support@lagrichidigital.com For significant changes affecting how we use personal data, we will provide notice through the dashboard or email where practicable.

We rely on: • Contract — to provide the Service you signed up for. • Legitimate interests — security, fraud prevention, and improving reliability (balanced against your rights). • Legal obligation — where we must keep records or respond to lawful requests. • Consent — only where we ask explicitly (for example optional marketing from us, not your client messaging).

We and our subprocessors may process data in the United Kingdom, European Economic Area, United States, UAE, and other countries where providers operate data centres or edge networks. When personal data is transferred from the UK or EEA to countries without an adequacy decision, we use appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or UK Addendum to SCCs with our providers. If you (as controller) use Maweid for clients in Morocco, France, Dubai, or elsewhere, you are responsible for lawful transfer and documentation under your local law (09-08, GDPR, UAE PDPL, etc.). Our DPA and subprocessor list describe where and how we process data as your processor.

We use strictly necessary cookies and local storage for: • Keeping you signed in (session / authentication). • Security and load balancing. • Remembering language preferences where applicable. We do not use non-essential marketing or analytics cookies on the core product today. If we add them later, we will ask for consent where required by UK PECR and similar laws. You can control cookies through your browser settings; blocking necessary cookies may prevent login or booking.