Privacy Policy

1. Who is the data controller

The publisher of the Yuna platform (hereinafter "Yuna", "we") is the controller of your personal data.

2. What Yuna is, and what it is not

Yuna is a financial analysis and information tool. Yuna does not provide personalised investment advice and holds no authorisation from the AMMC (Moroccan Capital Markets Authority). The content produced is provided for informational purposes, may contain errors, and does not replace your own decision. All investment carries a risk of capital loss.

3. What data we collect

• Account and identity: email address, name (if you log in via Google), login credentials, registration date.
• Investor profile (retail, self-declared and optional): tone preference, investment objective, management style, risk profile and risk tolerance, horizon, amount bracket (which you may leave blank), areas of interest. This information is used to adapt the level of detail, the pedagogy and the tone of Yuna's explanations; it is not used to provide you with a personalised investment recommendation.
• Usage content: your questions and the assistant's responses, the files you upload in the chat, the portfolios you track (relevant offerings).
• Subscription and billing: plan subscribed to, usage history, billing data.
• Payment: a secure token ("saved card") provided by our payment provider, the last 4 digits and the expiry date of your card. We never store your full card number.
• Technical data: IP address, logs, error information, audience measurement data.

4. Why we use it (purposes)

• Provide and operate the financial analysis service.
• Personalise the level and tone of responses according to your profile.
• Manage your account, your subscription and billing.
• Ensure security, prevent fraud and fix anomalies.
• Send you service-related emails (confirmation, sharing of a response, important information).

5. To whom your data is disclosed (processors)

To operate the service, we use technical providers who process data on our behalf, solely on our instructions and under a contract compliant with Law 09-08. These are the following categories of provider:

• hosting, cloud infrastructure, authentication and file storage;
• artificial intelligence model providers, who generate the analyses from your requests;
• sending of service emails and technical monitoring (error detection);
• payment providers (in Morocco and internationally, as well as the app stores for in-app purchases), for subscription management.

We may also disclose your data to legally authorised authorities where the law requires it. We do not sell your personal data.

AI models. Before transmitting your questions to an AI model, we remove direct identifiers (name, email address, account identifier), so that the models do not receive data identifying you directly. The files you upload (documents, images, statements) are transmitted to the model provider in their original form, as their content is required for the analysis you request. We invite you not to disclose in the chat any sensitive information or information that could identify you.

6. Transfers outside Morocco

Some of our providers (hosting, AI model providers, email sending) are located outside Morocco. In accordance with articles 43 and 44 of Law 09-08, any transfer of data to a foreign country is carried out only to a country ensuring an adequate level of protection, or after completion of the formalities required with the CNDP, and where applicable on the basis of your consent collected at the time of your registration.

7. How long we keep it

We keep your data for periods proportionate to their purpose:

You may request the deletion of your data before these periods (see article 9), subject to legal retention obligations.

8. How we protect it

Encryption of communications (HTTPS), access control, partitioning of data by user, and storage of payment in token form without ever keeping the full card number.

9. Your rights

In accordance with Law 09-08, you have a right of access, rectification, objection and deletion of your data. You may exercise these rights directly from your personal area (where account deletion is available on a self-service basis) or by writing to contact@yuna.ma. You may also refer the matter to the CNDP (Commission Nationale de controle de la protection des Donnees a caractere Personnel, the Moroccan data protection authority, www.cndp.ma).

The detailed account deletion procedure, the data erased and the data we are required to keep are described on the dedicated page: Delete your account

10. Cookies

We use cookies strictly necessary for the operation of the service (login, security) and audience measurement cookies, which help us understand how the site is used and improve it. They are never used for advertising and are never sold. In the European Economic Area and the United Kingdom, audience measurement cookies are set only after you agree, through a dedicated mechanism. Elsewhere they are active by default and you can refuse them at any time, using the "Cookies" link at the bottom of every page or from your settings. Your refusal is kept and any identifiers already set are deleted.

11. Changes

We may update this policy. The applicable version is the one published on yuna.ma, dated at the top of the document.