Last updated: 6 October 2026
Secureweb SARL (“SecureWeb”, “we”, “us”) provides cybersecurity services through secureweb.ma and a hosted website firewall and security dashboard at app.secureweb.ma (the “Platform”). This policy explains what personal data we collect, why, how long we keep it, who we share it with, and your rights. It is written to meet Moroccan Law No. 09-08 (supervised by the CNDP) and the EU GDPR where it applies.
1. Who is responsible for your data
| Data controller | Secureweb SARL (Société à Responsabilité Limitée) |
| RC / ICE | 30354378 / 003951934000013 |
| Privacy contact | Privacy@secureweb.ma |
| General contact | contact@secureweb.ma |
2. What we collect and why
| Where | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact, quote and service request forms | Name, email, phone, website URL, your message | Answer you, quote and deliver the service | Contract or pre-contract steps; consent (Law 09-08) |
| Free Website Scanner | Email and the scanned URL, stored and added to our Brevo contact list | Run the scan, send the report, follow up | Consent; legitimate interest |
| Source code review | Email and the code you submit | Perform the review | Contract or pre-contract steps |
| Vulnerability reports and writeups | Name, email, optional profile link, report details, attachments | Triage, fix and, if you ask, credit you | Consent; legitimate interest |
| Newsletter | Email, optionally your website | Security updates and offers | Consent only (unsubscribe link in every email) |
| Platform account | Name, email, Google account ID and profile picture (from Google Sign-In; we never see your password); two-factor secret if you enable it; IP and browser of each session; country and device of past sign-ins | Give you access, secure your account, alert you to a sign-in from somewhere new | Contract; legitimate interest |
| Platform service | Your websites and settings, account activity log, plans and subscription status, support messages. Payments are made through Creem (see section 5), and we never see or store card details | Provide the service, bill it, support you | Contract; legal obligation (accounting) |
| Server and CDN logs | IP address, time, page requested, user-agent, referrer | Availability and abuse detection | Legitimate interest |
Source code you submit is confidential: we do not publish it, reuse it, share it, or use it to train any model. The Password Strength Checker runs entirely in your browser, so nothing you type is sent to us. The Website Safety Checker does not store the URLs you submit, but sends them to the reputation services listed in section 5.
When you ask the Platform for help, our staff may open your dashboard to investigate. Only named staff accounts with two-factor authentication can do this. A banner is shown on every page they open, and every page viewed and change made is recorded. The Platform emails you security alerts, outage and certificate warnings, scan results, a weekly summary and subscription notices. You can turn most of them off per website. The alert for a sign-in from a new place cannot be turned off.
3. Visitors to websites protected by SecureWeb
When a customer protects their website with SecureWeb, our agent on their server inspects visitors’ requests. For this data the customer is the controller and SecureWeb is their processor: we use it only to provide the service to that customer. Customers should mention it in their own privacy policy. A data processing agreement is available from Privacy@secureweb.ma.
- Security events: for flagged or blocked requests, the visitor’s IP address, time, address requested, user-agent and the rule triggered. The country is worked out by our own software. IP addresses are never sent to a third-party geolocation service.
- Blocked requests: a copy is kept so the customer can review the block. Passwords, card numbers and similar fields are removed on the customer’s server before anything is sent to us. Cookies are never collected.
- Health checks and scans: we check from outside that the website is up and its certificate is valid. Scans report file paths, software versions and permissions, never file contents or credentials.
4. Cookies
We use no advertising, analytics or tracking cookies, and our public pages set none on page load. Cookies appear only in these cases:
| Cookie | When | Purpose |
|---|---|---|
| Google reCAPTCHA | Once you start using a form | Telling humans from bots |
| Cloudflare | As needed, site-wide | Security and bot mitigation |
| Platform session | While signed in to app.secureweb.ma (up to 14 days) | Keeps you signed in |
| Platform sign-in | A few minutes during Google sign-in | Protects the sign-in against forgery |
The Platform also uses your browser’s local storage to remember which guided tours you have seen. This stays on your device. Because we set no tracking cookies, we show no consent banner. We will add one before ever introducing analytics.
5. Who we share data with
We do not sell personal data. We share it only with these service providers:
| Provider | Role | Location |
|---|---|---|
| Contabo GmbH | Hosting of our servers and backups, including the Platform | France (EU) |
| Cloudflare | CDN, DNS and security proxy | Global |
| Brevo (Sendinblue) | Marketing and transactional email, including Platform alerts | France (EU) |
| Creem (Armitage Labs OÜ) | Merchant of record for Platform plans: checkout, card payments, tax, receipts and subscription management. It shares with us your name, email, country and what you bought, never your card details | Estonia (EU) |
| reCAPTCHA, Safe Browsing lookups, and sign-in to the Platform | United States | |
| PhishTank (Cisco) | Phishing lookups for the Safety Checker | United States |
We may also disclose data when legally required, for example on a valid order from a Moroccan authority. Transfers to US providers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Transfers from Morocco follow Articles 43–44 of Law 09-08.
6. How long we keep data
| Data | Kept for |
|---|---|
| Contact and service requests; vulnerability reports | 24 months |
| Free Website Scanner records; server and CDN logs | 12 months |
| Submitted source code and files | 90 days after the review is delivered |
| Newsletter subscription | Until you unsubscribe, then removed within 30 days |
| Platform account and settings | While the account is open; deleted within 30 days of a closure request |
| Platform security events | 30 days |
| Copies of blocked requests; health checks | 7 days |
| Scan results | 90 days |
| Account activity, staff access records, past sign-in places | 12 months |
| Platform database backups | 14 days |
| Invoices, payments and engagement records | 10 years (Moroccan accounting and tax law) |
Removing a website from the Platform deletes its data immediately. Copies in backups expire within 14 days. Expired data is deleted or irreversibly anonymised.
7. Your rights
You may access, rectify or erase your data, object to or restrict its processing, withdraw consent at any time, and receive your data in a portable format. Email Privacy@secureweb.ma. We reply within 30 days and may ask you to confirm your identity. You can complain to the CNDP in Morocco, or to your local supervisory authority in the EU/EEA.
8. How we protect your data
- All traffic to secureweb.ma and app.secureweb.ma is encrypted with HTTPS.
- Server access is limited to authorised staff using key-based authentication. Staff need two-factor authentication to access a customer’s Platform account.
- Submitted code and files are stored in the EU and seen only by the staff doing the review.
- We apply security updates and monitor for unauthorised access.
If a breach puts your rights at risk, we will notify the CNDP and, where the GDPR applies, the relevant authority within 72 hours. We will also tell you directly if the risk is high.
9. Children and changes
Our services are for businesses and website owners, and we do not knowingly collect data from anyone under 16. We may update this policy as our services or the law change. The date at the top shows the current version, and material changes are announced here before they take effect.