Before you have an account
Reading this site is anonymous. The only personal data it handles is what you choose to type into a form - and that goes to a human who replies.
0.1Cookies and storageNo advertising or analytics cookies, here or anywhere on the site. The short list of what this site does store in your browser, and why, is the cookie policy - it is the authority on that, so this page won't repeat it.
0.2Forms you submitIf you sign up for the newsletter or send a contact message, we receive what you typed plus your IP address and the time. Used only to reply to you. See 4 for retention.
0.3Logs at the edgeOur hosting provider keeps standard web-server logs (IP, user-agent, request path) for 30 days for abuse prevention. We never join those to your account.
What we collect · the app
1.1Account dataName, email, phone, payment method, government ID for verification.
1.2Ride dataRoutes, timestamps, speeds, telemetry from sensors. Used for safety, billing, and improving the service.
1.3PhotosEnd-ride photos for parking verification. We delete after 30 days unless flagged for dispute.
Why · purpose limitation
2.1To run the serviceVerify identity, process payments, dispatch help, prevent fraud.
2.2To improveAggregate, anonymized data informs our AI models and operational decisions.
2.3What we never doSell your data. Share it with advertisers. Use it to profile you for non-Elyra purposes.
Who sees it
3.1Internal teamEngineers and ops on a need-to-know basis. Access is logged.
3.2Service providersCMI (payments and voucher processing), AWS (hosting), Twilio (SMS), Google Fonts (font CSS only; no profile or account data shared). All under data processing agreements.
3.3AuthoritiesOnly on valid legal request, with formal documentation. We notify you unless legally prohibited.
How long we keep it
4.1Active accountsIndefinitely while you use the service.
4.2Closed accounts30 daysto full deletionAnonymized ride statistics retained for analytics.
4.3Photos30 days, unless flagged.
4.4Payment recordsRetained for 7 years per Moroccan tax law.
4.5Marketing inboxNewsletter + contact submissions deleted 24 months after the last interaction.
Your rights · Law 09-08
Your data is yours: see it, fix it, delete it, take it with you, or object - one email to the DPO does it.
5.1AccessRequest a copy of your data anytime. Email dpo@elyraride.com; we reply within 30 days.
5.2RectificationInaccurate data? Tell us; we fix within 7 days.
5.3ErasureThe right to be forgotten. We comply within 30 days unless legally required= to retain (e.g. tax records).
5.4PortabilityWe export your data in
JSON or CSV on request.5.5ObjectionYou can object to processing for marketing or non-essential purposes at any time. Email the DPO; we stop within 7 days.
5.6ComplaintIf we can't resolve your concern, you can file a complaint with the Commission Nationale de contrôle de la Protection des Données à caractère Personnel (CNDP) at www.cndp.ma.
Regulatory
6.1CNDP declarationElyra Mobility SARL has declared its data-processing activities to the CNDP under Law 09-08. Reference number: pending issuance. Will be published here once received.
6.2Lawful basisFor account and ride data: performance of the rider contract (Art. 4 of Law 09-08). For marketing emails: explicit opt-in consent. For server logs: legitimate interest in abuse prevention.
6.3International transfersSome processors (AWS) operate outside Morocco. Transfers covered by standard contractual clauses and CNDP-approved guarantees.
6.4Data Protection OfficerReachable at dpo@elyraride.com. Postal: The International University of Rabat, Technopolis, Rabat Salé El Jadida, Morocco.