Privacy policy

1. Who we are

Tresoria is a treasury management platform for businesses. It comprises the tresoria.ma website, the app.tresoria.ma application, the payment portal made available to our customers' customers, and the notifications sent by e-mail and by WhatsApp.

The service is published by Tresoria, a company being registered in Morocco, based in Casablanca (hereinafter "Tresoria", "we"). Its registration details (company name, legal form, share capital, registered office, RC, ICE, IF) will be published in our legal notice as soon as it is registered.

For any question about your data: contact@tresoria.ma.

2. Our role depending on the data

We are the controller of the data that concerns us directly: website visitors, demonstration requests, application user accounts, subscription billing, security and support.

For the data that our customers record in Tresoria for their own business (their bank statements and bank transactions, their suppliers, their customers and their contacts, their beneficiaries, their invoices and documents), we act on behalf of our customer and in accordance with its instructions. It is our customer who decides on this data and who is answerable for its lawfulness to the data subjects; we help it comply with its obligations.

3. The data we process

• Application users: e-mail address, first name, last name, telephone number (optional), role and permissions, display preferences. The password is never stored in plain text: only a hash (BCrypt) is stored.
• Customer company: company name, legal identifiers (ICE, IF, RC), address, city, telephone, contact and billing details.
• Bank data: accounts (including IBAN / RIB), imported statements, transactions, balances and, if the customer activates them, the data received through its connectors (SFTP or API) from its own servers or those of its bank.
• Third parties recorded by the customer: suppliers (name, address, ICE, notes), payment beneficiaries (name, address, account, bank, BIC), the customer's customers and their contacts (name, e-mail, telephone, position), cheques, bills of exchange and payment orders (name of the beneficiary), exchanges and documents uploaded to the payment portal.
• Documents: invoices, statements, contracts, proofs of payment, cheques, bills of exchange, remittances, exports, as well as invoice e-mails received at the company's dedicated address.
• Demonstration requests sent from the website: name, company, structure, e-mail, telephone (optional), headcount and number-of-accounts ranges, message, language, as well as the IP address and browser used.
• Security records: audit log (author, IP address, browser, action, before and after a change), login attempts, open sessions, activity time, and the issue reports you send us (with the screenshots you choose to attach).
• WhatsApp: verified telephone number, notification choices, and the history of messages sent (see section 6).
• Gmail: address of the connected Google account and the sending authorisation (see section 7).

4. Why we process it

• Providing the subscribed service: managing the treasury, importing and reconciling transactions, managing invoices, payments, reminders and notifications (performance of the contract).
• Securing the service: authentication, prevention of abuse, audit log, investigation of an incident (legitimate interest and security obligation).
• Invoicing the subscription and complying with our legal and accounting obligations (legal obligation).
• Assisting the customer: support, handling of issue reports (performance of the contract).
• Responding to a demonstration request and providing its commercial follow-up (pre-contractual measures taken at your request).
• Sending notifications by WhatsApp, only to users who have chosen it (consent).

We do not sell, rent or transfer any data. We do not engage in targeted advertising, we use no audience measurement tool, and we do not assess anyone's creditworthiness.

5. Artificial intelligence

Certain Tresoria functions use an artificial intelligence model provided by Anthropic (Claude models), through its application programming interface (API). Processing by this provider takes place outside Morocco.

Depending on the function used, we send it:

• the complete file of a bank statement (PDF or photo), to read its transactions, together with the company's list of categories;
• the complete file of a supplier or customer invoice, of a document to be split into several invoices, of a payment schedule or of a bank fee schedule, to read its fields;
• the signed subscription contract, to check that the signature is present;
• transaction labels, amounts, dates, references and counterparty names, to suggest categories, rules and reconciliations and to detect recurring payments;
• the name and ICE of a supplier read on an invoice, together with at most three candidate suppliers, to recognise it;
• category names and totals, for other suggestions (cost type, dashboard reports, balance explanations, without IBAN).

Anthropic states that, by default, it does not use the data received through its API to train its models. We keep neither the text sent nor the model's response: for each call, we keep only the company, the user, the function, the model, the number of units processed (tokens), the estimated cost and the result.

What the artificial intelligence proposes remains a suggestion: it is the user who checks and validates it. A customer may also use its own key with the provider; the key is then stored encrypted.

6. WhatsApp

Tresoria may send notifications by WhatsApp, through Meta's WhatsApp Business platform, from a single Tresoria number. These messages are addressed only to application users, never to our customers' customers or suppliers.

WhatsApp is used only if you choose it:

• you verify your number by sending a code yourself from WhatsApp (code valid for 15 minutes);
• you choose, notification by notification, which ones you receive on WhatsApp;
• login and signature codes may also reach you by WhatsApp if you have chosen so; they are never recorded in our logs;
• replying "STOP" immediately turns off all WhatsApp notifications; "Remove" in your profile deletes your verified number; changing your number cancels the verification;
• if a WhatsApp message cannot be delivered, the same notification is sent to you by e-mail.

Meta receives your number and the content of the message: the company name and the facts of the notification (for example a number of invoices to be validated). Meta processes this data outside Morocco, under its own terms and its own privacy policy. We keep the history of the messages sent (recipient, type, message template, status); messages received from Meta are kept for 24 hours. We comply with the WhatsApp Business messaging policy: we write only to people who have accepted, and any request to stop is honoured.

7. Google (sending through Gmail)

A company may choose to send its e-mails (invoices, reminders, statements) from its own Gmail account. To do so, the user connects their Google account and authorises Tresoria with only the "openid", "email" and "gmail.send" permissions.

Tresoria receives the address of the Google account and the right to send e-mails on its behalf. Tresoria never reads, lists, modifies or deletes the messages in the mailbox. This data is used solely to send, from that account, the e-mails that the user triggers or schedules in Tresoria.

It is shared with no one other than Google, and is never used for advertising or to assess creditworthiness. Only the long-lived access token is stored, encrypted (AES-256-GCM), together with the account address, the author and the date of the connection. Tokens never appear in our logs.

Disconnecting Gmail in Tresoria revokes the authorisation with Google and deletes this data. You may also remove access at any time from your Google account (Security › Third-party apps).

Tresoria's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This policy is available at https://developers.google.com/terms/api-services-user-data-policy.

Data received from Google Workspace APIs is never used to develop, improve or train generalised artificial intelligence or machine learning models, nor transmitted to an artificial intelligence provider.

8. E-mails

Tresoria e-mails (login, notifications, invoices, reminders) are sent through our e-mail provider Nindomail (Nindohost), from no-reply@tresoria.ma and contact@tresoria.ma. A company may also choose to send through its own mail server or through Gmail (section 7). Each sending is recorded in the audit log: recipient, subject, name of the attachment and, if a click triggered it, the IP address and browser; the body of the message is not kept.

Invoices sent by your suppliers to your company's receiving address are received by our provider Mailgun (European Union): we keep their recipient, sender, subject, attachments and the result of the authenticity checks.

9. Who receives your data

Your data is accessible to your team according to the permissions your company grants it and, under the conditions of section 12, to Tresoria staff. We use the following service providers, each for that sole purpose:

• Oracle Cloud Infrastructure: hosting of the application, the database, the documents and the backups, in Morocco (Casablanca region).
• Anthropic: artificial intelligence (section 5), outside Morocco.
• Meta (WhatsApp Business): WhatsApp notifications (section 6), outside Morocco.
• Google: sending through Gmail, only for companies that choose it (section 7), outside Morocco.
• Nindohost (Nindomail): sending of e-mails (section 8).
• Mailgun: receipt of invoice e-mails (section 8), European Union.
• Atlassian (Trello): tracking of issue reports (company, name and e-mail of the author, description, technical context and attached screenshots), outside Morocco.
• Cloudflare: management of domain names only; no personal data passes through Cloudflare.

10. Transfers outside Morocco

The application, the database, the documents and the backups are hosted in Morocco. Certain data is nevertheless transmitted outside Morocco to the service providers identified as such in section 9 (Anthropic, Meta, Google, Atlassian, and Mailgun in the European Union), for the sole purpose described.

These transfers rely on the contractual terms of each provider. The formalities that Law No. 09-08 requires with the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) for these transfers will be completed as soon as Tresoria is registered, and their reference will be published on this page.

11. How long we keep it

• Account data and company data: for the entire duration of the subscription, then until the erasure that follows an account closure (section 13).
• Accounting records and subscription billing data: 10 years, the period required by Moroccan law.
• Audit log and log of e-mails sent: kept for evidentiary and security purposes, with no maximum period set to date.
• Activity of Tresoria staff in a customer's workspace: 90 days.
• Users' activity time: 13 months day by day, then grouped by month.
• Deleted bank accounts: 3 months. Transactions deleted by an import: 90 days.
• Documents received and not verified: 30 days. Connector execution data: 30 days. "My day" history: 90 days.
• Export archive of your data: 7 days after its creation.
• Database backups: 14 days.
• Server technical logs: 7 days.
• Messages received from WhatsApp: 24 hours. History of WhatsApp messages sent: no maximum period set to date.
• Demonstration requests: no maximum period set to date.
• Login sessions: deleted no later than 24 hours after their expiry.

12. Security and staff access

Security procedures are in place to protect the confidentiality, integrity and availability of your data.

• All communications are encrypted with TLS (versions 1.2 and 1.3).
• The secrets entrusted to us (connector credentials, artificial intelligence keys, mail passwords, Gmail token) are encrypted with AES-GCM.
• Passwords are stored as a BCrypt hash; login codes and invitation or reset links are stored as a hash. An account is locked after 5 failed login attempts within 15 minutes. Two-factor authentication by code is available.
• Technical logs mask e-mail addresses, tokens, codes, IBAN / RIB and telephone numbers.
• Daily backups are encrypted (AES-256) and stored in Morocco.
• A member of Tresoria staff accesses a customer's workspace only after the agreement of its owner or of an administrator, for a limited period (60 minutes by default); each of their actions is recorded. To handle an incident, Tresoria's founders may access a customer's workspace without prior agreement; each access is recorded in our audit log.

13. Your rights

In accordance with Law No. 09-08 on the protection of individuals with regard to the processing of personal data, you have a right of access, rectification, objection on legitimate grounds and deletion of your data.

To exercise these rights, write to contact@tresoria.ma; we respond within 30 days. If your data was recorded by one of our customers for its own business (section 2), please contact that customer first; we will help it respond to you.

The owner of a subscription may, from the application, request a complete export of their company's data (archive available for 7 days) and request the closure of their account. After acceptance, the data is erased 30 days later: bank transactions and bank accounts are deleted, the company is anonymised, and the data that the law requires us to keep (subscription billing, audit log) is retained. To date, this operation does not erase supplier and beneficiary records or their documents: you may request their erasure at contact@tresoria.ma.

You may at any time stop WhatsApp notifications (section 6) and disconnect Gmail (section 7).

You may also refer the matter to the CNDP, www.cndp.ma. The reference of Tresoria's formalities with the CNDP will be published on this page once they are completed.

14. Cookies and storage in your browser

• tresoria.ma website: a language cookie (NEXT_LOCALE) and a local record that you closed the banner. No audience measurement or advertising cookie.
• Application: your login tokens and your profile are kept in the browser, for the session only, or persistently if you tick "Remember me"; your display settings and the open company; a cookie that remembers the announcements already seen (1 year). No third-party audience measurement or error tracking tool.

15. Issue reporting

When you report a problem from the application, we receive your description, your name and e-mail address, your company, the screen concerned, the language, the application version, the screen size, the last error received from the server and the screenshots you choose to attach. No screenshot is taken automatically. This report is entered into our tracking tool (Trello, section 9).

16. Minors

Tresoria is a service intended for businesses. It is not directed at persons under 18 years of age.

17. Changes

We update this policy as soon as our processing changes, and the date of the last update appears at the top of this page. If a change alters the way we use your data, in particular Google data, we inform you in the application or by e-mail before it takes effect.

18. Contact

For any question, request or complaint about your data: contact@tresoria.ma.