Company
Privacy policy
Which personal data Avalyz processes, why, for how long, with whom, and how to exercise your rights. Version 1, text dated 2026-10-27.
Data controller
The data controller is Framework SARL AU, a single-member limited liability company under Moroccan law, publisher of Avalyz.
| Registered office | Casablanca, Maroc |
|---|---|
| Trade register | RC Casablanca 333221 |
| Common company identifier (ICE) | 000738993000089 |
| Contact | contact@avalyz.com |
Why we process your data
- Create and manage your account, and sign you in with a single-use link sent by e-mail.
- Run the tests you start, produce your reports and keep them for the time stated below.
- Process payments, credit your account and issue invoices (through the merchant of record).
- Secure the service, prevent abuse and prove who started which test (evidence log).
- Measure the site's audience through daily totals, with no IP address and no measurement cookie.
- Reply to your messages and, if you signed up, write to you from the waiting list.
- Run the partner programme: review applications and calculate commissions.
Legal bases
- Performance of the contract: account, tests, reports, payments and support.
- Legitimate interest: security of the service, abuse prevention, evidence log, aggregated statistics, attribution of visits that arrive through a referral link.
- Legal obligation: accounting records and invoices, replies to requests from authorities.
- Consent: the waiting list and any non-essential cookie; you can withdraw it at any time.
The data we process
- Account: your e-mail address, your credits and your purchase history.
- Tests: the web addresses you have tested, screenshots, findings and reports. If you provide a test account, its password stays in memory for the duration of the test and is never written down.
- Payment: it is handled by the merchant of record. Avalyz never sees your card number; it receives your e-mail address, the product bought and the amount paid.
- Evidence log: for write mode and sensitive tests, your account identifier, your e-mail, the date, your IP address, your browser, the target and the attestation accepted.
- Technical data: your IP address is kept for 24 hours in memory only, for the daily limit of free tests.
- Audience: daily counters, with no IP address and no identity.
- Partner programme: if you apply, your name, e-mail, site and audience; for a customer referred by a partner, the partner's code and the amounts paid, used to calculate the commission.
How long we keep it
| Data | Duration |
|---|---|
| Report of a free test without sign-up | 24 hours, then automatic deletion: a free test is not kept. |
| Reports of an account (tested address, screenshots, findings) | 30 days by default, then automatic deletion. This period is a hosting setting; the Security and data page always shows the value in force. |
| Account (e-mail, credits, purchase history) | As long as the account exists. You request its deletion by e-mail; we handle it within one month at most. |
| Evidence log | Five years after the test, then deletion. |
| Invoices and accounting records | The period set by the applicable law, at the merchant of record and at Framework SARL AU. |
| Sign-in link and session | 15 minutes, single use, for the link; 14 days, or until you sign out, for the session. |
| Waiting list (address, date, consent) | Until you unsubscribe; the link in each e-mail deletes your address. |
| Partner programme (applications, attributions) | As long as the partnership or attribution exists; deleted on request by e-mail. |
| Audience counters | 400 days: daily counts, with no IP address and no identity. |
Who receives it
- Framework SARL AU, for the authorised people who run the service.
- The providers listed below, who process data on our behalf.
- The competent judicial or administrative authorities, on request.
- Avalyz neither sells nor rents any data and gives none to advertising networks.
Sub-processors
| Prestataire | Rôle | Registered office |
|---|---|---|
| Scaleway SAS | Hosting of data and reports, and sending of the service's e-mails | France (Paris, European Union) |
| Polar Software Inc. | Payment, invoices and taxes, as merchant of record | United States |
| DeepSeek | Artificial intelligence: analysis of the content of the tested pages to produce the findings | China |
| Anthropic | Artificial intelligence: analysis of the content of the tested pages to produce the findings | United States |
| Cloudflare, Inc. | Domain names (DNS), content delivery network (CDN) and routing of the domain's e-mails | United States (global network) |
Transfers outside Morocco
The service's data is hosted in Paris, in the European Union. Some of the providers listed above are established in other countries (United States, China) and may process data outside Morocco and outside the European Union.
These transfers are covered by the safeguards provided for by Law No. 09-08 and by the CNDP (a contract with the provider, an authorisation or a declaration where required) and, for people living in the European Union, by the European Commission's standard contractual clauses or another mechanism provided for by the GDPR. You can ask us for a copy of the applicable safeguards.
Your rights
- Access: know what data we hold about you and receive a copy.
- Rectification: correct inaccurate data.
- Erasure: ask for your account and your reports to be deleted.
- Objection: object to processing based on legitimate interest, or to marketing.
- Portability: receive your data in a common format.
- Restriction (for people living in the European Union): ask for processing to be suspended.
To exercise a right, write to us from your account's e-mail address: contact@avalyz.com. We reply within one month at most. To protect you, we may ask for proof of your identity.
Applicable law and authorities
Processing is subject to Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data. You can contact the National Commission for the Control of Personal Data Protection (CNDP).
If you are in the European Union, the General Data Protection Regulation (GDPR) also applies to you, and you can contact the data protection authority of your country.
Cookies
Avalyz sets no advertising cookie and no audience-measurement cookie. These are the only cookies set by the site.
| Cookie | Rôle | Duration | Nature |
|---|---|---|---|
| av_session | Keep you signed in | 14 days, or until you sign out | Essential |
| av_csrf | Protect forms against forged submissions | 24 hours | Essential |
| av_essais | Find the reports of your free trials again on this device (report tokens) | 7 days | Essential |
| av_lang | Remember the language you chose | 1 year | Preference |
| av_theme | Remember the light or dark theme you chose | 1 year | Preference |
| av_via | Count a visit that came through a referral link, without saying anything about you | 60 days | Referral |
| av_compter | Remember that you do not want to be counted in the statistics (set only if you ask) | 6 months | Preference |
Contact
For any question: contact@avalyz.com · Security and data · Legal notice · Terms