Privacy Policy

Scope

This policy covers all processing of personal data carried out by Betterfly Solutions in connection with:

• the public website www.betterfly.ma, including the blog, the contact, quote, partnership and resource-download forms, and the online diagnostic;

• the Betterfly platform, a QHSE and ISO management SaaS application available on subscription to users at our client organisations;

• Betterfly Connect, the optional service that links a Betterfly workspace to third-party applications — including Google Workspace — at a user's explicit request.

Allocation of roles: when you use the Betterfly platform as part of your organisation, that organisation is the data controller for the business data it stores there and for the accounts it creates; Betterfly Solutions then acts as a processor, within the limits of our contract with it. For the public website, the commercial relationship and the technical operation of the service, Betterfly Solutions is the data controller.

Data controller & contact

Controller: Betterfly Solutions SARL

Address: 2 Rue Abou Hassan Alachaari, 4th floor – Bd Anfa, Casablanca, Morocco

Privacy e-mail: contact@betterfly.ma

Phone: +212 6 75 02 18 09

Any question or request about your personal data can be sent to contact@betterfly.ma with “Privacy” in the subject line.

Data we collect

a) Data you provide on the public website:

• Contact, quote, partnership or demo-request forms: last name, first name, e-mail, phone (optional), organisation, job title, message.

• Resource downloads and newsletter sign-up: e-mail address and preferences.

• Online diagnostic and conversational assistant: the answers and messages you choose to enter.

b) Data linked to your account on the Betterfly platform:

• Professional identity: last name, first name, work e-mail, job title, organisation, role and permissions.

• Usage and audit-trail data: sign-in logs, timestamp and author of the actions performed in the modules — a traceability requirement of the ISO standards the platform supports.

• Content uploaded by your organisation: documents, actions, non-conformities, audits, indicators. This content remains the property of your organisation.

c) Data collected automatically:

• Technical logs: IP address, date and time, URL requested, user agent, response code — for security and diagnostics.

• Cookies and trackers: see the “Cookies & trackers” section.

We do not collect data classed as sensitive by law (health, opinions, trade-union membership) through the public website.

Google user data (Betterfly Connect)

Betterfly Connect lets a user link their own Google account to their Betterfly workspace, on their own initiative, in order to feed a dashboard or a module with data they designate. This connection is entirely optional: the platform works without it, and no Google data is read until the user has given consent on Google's own authorisation screen.

Exact scope of the permissions requested, connector by connector:

• .../auth/userinfo.email — reads the Google account's e-mail address, solely to identify and label the connection in the Betterfly interface.

• .../auth/spreadsheets.readonly — read-only access to the contents of the Google Sheets spreadsheets the user designates, to populate a Betterfly table, chart or indicator.

• .../auth/drive.metadata.readonly — read-only access to Google Drive file metadata: id, name, MIME type, size, creation and modification dates, view link, parent folder, owner, trashed status. File contents are never read, downloaded or stored.

• .../auth/gmail.readonly — read-only access to Gmail message metadata: message id, thread id, sender, recipient, subject, date, the short snippet returned by the API, and labels. Full message bodies and attachments are never retrieved or stored.

Every permission requested is read-only. Betterfly never writes, modifies, sends or deletes anything in your Google account.

Security and storage: the refresh token issued by Google is encrypted server-side (AES-256-GCM, versioned keys) before being stored. It is never sent to the browser or exposed in an API response, and is decrypted only for the duration of a synchronisation you have requested. Imported data is isolated within the relevant organisation's workspace and accessible only to its authorised users.

Revocation: you can delete the connection at any time from the connectors screen of your Betterfly workspace, or revoke access from your Google account's permissions page (myaccount.google.com/permissions). Deletion destroys the associated tokens immediately and erases the corresponding imported data within 30 days.

Limited Use of Google user data

Betterfly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, data obtained through Google APIs:

• is used only to provide and improve the features that are visible to the user who authorised the connection;

• is never used for advertising purposes, nor transferred to ad networks, data brokers or advertising platforms;

• is never sold or rented;

• is never used to develop, train or improve generalised artificial-intelligence models;

• is not read by a human, except with the user's explicit consent, where necessary for security (investigating abuse or an incident), to comply with a legal obligation, or once it has been aggregated and anonymised for internal statistics.

Purposes & legal bases

• Operating the site and keeping it secure — serving pages, preventing abuse, logging: legitimate interest and legal obligation.

• Answering your requests — contact, quote, demo, partnership, diagnostic: pre-contractual steps taken at your request.

• Providing the Betterfly platform — creating and managing accounts, running the features, support, billing: performance of the contract.

• Betterfly Connect connectors, including Google — importing the data you designate: consent, revocable at any time.

• Newsletter and marketing communications: consent, with unsubscribe available at any time.

• Audience measurement — aggregated statistics and site improvement: consent (non-essential cookies).

• Security, fraud prevention, and compliance with legal and accounting obligations: legitimate interest and legal obligation.

Recipients & processors

Access to data is restricted to the Betterfly teams that need it (support, sales, engineering), on a least-privilege basis and under confidentiality undertakings.

We use technical providers acting as processors, in particular:

• Vercel Inc. — hosting and delivery of the public website;

• Google Ireland Ltd. / Google LLC — Google Tag Manager and audience measurement, loaded only after your consent;

• transactional e-mail providers and the platform's hosting provider.

An up-to-date list of processors is available on request at contact@betterfly.ma. We do not sell or rent your personal data. It may be disclosed to an authority only where the law requires it.

International transfers: where data is hosted or accessed outside Morocco and the European Union, we apply appropriate safeguards — countries recognised as adequate, EU standard contractual clauses, and additional technical measures such as encryption.

Retention periods

• Contact, quote or demo requests: 24 months after the last exchange, unless a commercial relationship is ongoing.

• Platform accounts and data: for the term of the contract, then a 30-day technical retention window before deletion or return to the client organisation, unless the law requires longer.

• Google connections and imported data: until the user deletes the connection or revokes access on Google's side, then erased within 30 days.

• Newsletter: until consent is withdrawn.

• Technical and security logs: 12 months at most, unless a legal obligation or an ongoing security investigation applies.

• Cookies: the duration shown in the consent manager, at most 13 months for cookies subject to consent, after which your choice is collected again.

Cookies & trackers

• Necessary cookies: security, load balancing, remembering your consent choice. These do not require your agreement.

• Preference cookies (optional): language and browsing comfort.

• Audience-measurement cookies (optional): aggregated statistics via Google Tag Manager and Google Analytics.

Until you accept, Google tags load in denied-consent mode (Consent Mode v2): they set no advertising cookie and transmit no identifier.

You can accept or refuse each non-essential category from the banner, and change your mind at any time via “Manage my cookies” in the footer or through your browser settings.

Your rights

Under Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data, and under the GDPR where it applies, you have the rights of access, rectification, erasure, restriction, objection (including to marketing) and portability. You may withdraw your consent at any time for the processing that relies on it, without affecting the lawfulness of processing already carried out.

To exercise these rights: contact@betterfly.ma. We respond within one month; proof of identity may be requested.

If you use the Betterfly platform as part of your organisation, please address your request to that organisation first: it is the controller for this data, and we assist it in responding.

You may also lodge a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP, www.cndp.ma) in Morocco, or with the data protection authority of your country of residence in the European Union.

Security

We apply technical and organisational measures proportionate to the risks:

• all traffic encrypted with TLS, with HSTS enabled across the site;

• encryption at rest of secrets and third-party access tokens (AES-256-GCM), with versioned keys allowing rotation;

• strict data isolation per client organisation;

• role-based access control and least privilege;

• logging, monitoring and regular backups;

• hardening and continuous updating of components;

• confidentiality undertakings from staff and security clauses with processors.

In the event of a data breach likely to create a risk to your rights and freedoms, we notify the affected individuals and the competent authorities within the applicable deadlines.

Deleting your data and revoking access

• General request: write to contact@betterfly.ma with the subject “Delete my data”. We acknowledge receipt and handle the request within 30 days.

• Google connection: delete the connection from the connectors screen of your Betterfly workspace, or revoke access at myaccount.google.com/permissions. Tokens are destroyed immediately and the corresponding imported data is erased within 30 days.

• Platform account: deleting a user account is your organisation's administrator's responsibility; deleting an entire workspace is handled by our teams at the client's request.

Some data may be kept beyond these periods where the law requires it (accounting obligations, ongoing disputes).

Third-party links and content

The site may contain links to, or embedded content from, third parties (social networks, videos, partners). Their processing of your data is governed by their own privacy policies, over which we have no control. We encourage you to read them.

Minors

The site and the platform are aimed at professionals and are not intended for people under 16. We do not knowingly collect their data. A legal guardian may request the deletion of an accidental submission by writing to contact@betterfly.ma.

Changes to this policy

This policy may be updated for legal, technical or organisational reasons. The last-updated date appears at the top of this page. In the event of a significant change — in particular a broadening of the Google data processed or of the permissions requested — a notice will be displayed on the site and, where relevant, sent by e-mail to the users concerned.

This version takes effect on 4 September 2026.

Contact

Betterfly Solutions SARL

2 Rue Abou Hassan Alachaari, 4th floor – Bd Anfa

Casablanca, Morocco

E-mail: contact@betterfly.ma

Phone: +212 6 75 02 18 09