Privacy Policy

Ghayma (ghayma.cloud) is a cloud platform operated by SARL Throct, 5 rue Mediani Abdallah, Tlemcen, Algeria, registered under RC —, NIF — ("THROCT", "we"). THROCT is the controller of the personal data described in this policy and processes it in accordance with Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended.

Ghayma is still in its preparation stage. Features may change, be paused or be withdrawn, and this policy will be updated as the service develops (see section 13). Everything you do on Ghayma during the beta is covered by this policy. We may write to you to ask for feedback; you can ignore those messages.

• Account: your name, email address and password, which we store only as a secure hash. If you sign in with GitHub or Google, we receive your account identifier, your email address, your GitHub username and your profile picture. We also keep your API and CLI tokens. If you connect a GitHub repository to deploy from it, we also receive the name of the GitHub account where Ghayma is installed and, for each push, the name of the person who pushed.
• Teams and collaboration: the email addresses of the people you invite.
• Billing: your balance, your top-ups and payments, your invoices and your billing account details. You enter card details on Chargily's payment page; we never see or store them.
• Technical data: your IP address, browser and device information, the requests you make to the console, the API and the CLI, and a security log of the actions taken on your account.
• Your services' operation: build and deployment logs, the logs your applications write, and usage measurements of your resources (CPU, memory, storage, bandwidth).
• Messages: what you send us when you contact us.
• Cookies and browser storage: a login cookie (7 days), and your theme, language and sidebar preferences (1 year). The console also remembers your last project and the notices you dismissed in your browser. We use no analytics, advertising or tracking cookies, and no third-party tracking scripts.

The code you deploy, your environment variables and secrets, your databases, your stored files, your applications' logs, and the users of your applications (including accounts created through Ghayma Auth) are your data. We process it only to run, secure and back up your services, on your instructions, and never for our own purposes. Our staff access it only when needed to operate or secure the platform, or to help you at your request.

For your own users, you are the controller. It is up to you to inform them, obtain their consent where required and meet your own obligations under Law 18-07.

We use your data to:

• create and secure your account;
• run, monitor and back up the services you deploy;
• bill you;
• answer you;
• prevent abuse and fraud;
• meet our legal obligations.

We send only the emails the service needs: account verification and password reset, notices when your password or email address changes, invitations to teams, projects and billing accounts, transfers of project and billing-account ownership, balance and quota alerts, and important changes to Ghayma or to this policy.

The legal bases are:

• your consent, given when you create your account;
• what is necessary to provide the service you asked for;
• our legal obligations.

• Main servers: Scaleway's data centre in Paris, France.
• Backup copies: Hetzner, in Finland.

Storing your data in these countries is a transfer of personal data outside Algeria. It rests on the express consent you give when you create your account.

We share personal data only with the providers that run Ghayma, and only for that purpose:

• Scaleway (France): hosting.
• Hetzner (Finland): backup storage.
• Cloudflare: network protection and delivery. All traffic to Ghayma passes through it.
• Google and GitHub: sign-in, only if you choose to use them. GitHub also deploys from the repositories you connect.
• Resend: sending emails.
• Chargily (Algeria): payments.

We disclose data to public authorities only when Algerian law requires it and on a valid legal request. If THROCT's business were transferred to another company, your data would pass to it under the same commitments. We never sell personal data.

• Account data: until you delete your account. Deletion is immediate. Copies remain in our encrypted platform backups for about 13 months.
• Kept after you delete your account: invoices and payment records; the security log of actions on your account, with IP addresses; the record of the invitation code you used; any unfinished email-change request; your collaborator invitations on other people's projects. These have no fixed end date today.
• Logs, including IP addresses: 14 days.
• Metrics: 15 days.
• Usage records: 13 months. Monthly summaries are kept longer.
• Build logs: until you delete the site or project.
• Database backups: 7 to 28 days depending on your plan. Manual backups stay until you delete them. Backup files of databases you have deleted may remain in our backup storage.
• Stored files: until you delete them. A copy is kept in Finland and removed 30 days after you delete the file.
• The users of your apps (Ghayma Auth): their login events, with IP addresses, are kept until you delete your Ghayma account.

• In transit: connections are encrypted.
• Isolation: each project runs isolated from the others.
• Passwords: stored only as hashes.
• Backups: the platform's own database backups are encrypted.
• Staff access: limited to what is needed to run the service.

No system is perfectly secure, and data sent over the internet can travel without guarantees and be read by unauthorized people. If a breach affects your data, we will tell you and the ANPDP without delay, as the law requires.

Under Law 18-07 you can:

• ask what data we hold about you and how we use it (information and access);
• have it corrected, completed, erased or locked; we act within 10 days, free of charge;
• object to its processing on legitimate grounds;
• withdraw your consent. Since the service depends on it, this means deleting your account, which you can do in the console.

Write to [email protected]. If you are not satisfied with our answer, you can complain to the ANPDP (Autorité Nationale de Protection des Données à caractère Personnel) at https://plaintes.anpdp.dz.

Ghayma is for people aged 18 or older. Do not create an account if you are younger.

Our data protection officer is Reda Bouziani:

• by email: [email protected];
• by post: SARL Throct, 5 rue Mediani Abdallah, Tlemcen, Algeria.

Each version of this policy carries a number and an effective date. Before an important change takes effect, we tell you at least 30 days in advance by email and in the console.

This policy is available in English, French and Arabic. If the versions differ, the French version prevails.