Privacy

At Solya, protecting your financial and personal information is part of how we build the product.

Solya Technologies SAS (“Solya”, “we”, “us” or “our”) operates the Solya mobile application, website and related services.

This Privacy Policy explains what information we process, why we process it, how we protect it, when it may be disclosed, and the choices and rights available to you.

Your privacy at Solya

We have designed Solya around a few simple principles:

• We never sell your personal or financial data.
• Your data is protected using encryption and strict access controls.
• We minimise the amount of information used for each purpose.
• When your identity is not required, direct identifiers are removed, tokenised, pseudonymised or anonymised before analytical or AI processing.
• Sol does not ordinarily need to know your identity to analyse your finances.
• Identity and KYC information are used only where necessary to provide regulated services, protect your account or comply with legal obligations.
• You can request deletion of your account and personal data, subject to information we are legally required to retain.

1. Who we are

The entity responsible for the Solya application is:

Solya Technologies SAS
Commercial Register: RC 683151
Casablanca, Morocco

Privacy contact:
hello@solya.io

Solya provides a digital financial experience and works with regulated financial institutions, payment institutions and specialised technology providers where necessary to deliver certain services.

Some regulated services available through Solya may therefore also be subject to the privacy policies and regulatory obligations of the relevant regulated provider.

2. Information we process

The information we process depends on the Solya services you use.

Identity and KYC information

Where required to create or operate an account and comply with financial regulations, we may process information such as:

• your name;
• date of birth;
• nationality;
• address;
• telephone number and email address;
• identity document information;
• photographs or selfies;
• information required for identity verification;
• information required for Know Your Customer (KYC), anti-money laundering and counter-terrorist financing obligations.

Where enhanced verification is required, this may also include a video or audio verification session.

Identity and KYC information is not used for advertising or ordinary AI-powered financial recommendations.

Account and financial information

To provide Solya’s services, we may process:

• account identifiers and status;
• balances;
• transaction history;
• transaction amounts and dates;
• merchants and transaction descriptions;
• transaction categories;
• transfers, beneficiaries and recipients;
• card-related information;
• recurring income and expenses;
• other information necessary to provide or secure financial services.

Certain payment or card information may be processed directly by regulated financial partners or specialised payment providers rather than stored by Solya.

Information you provide to Sol

When you interact with Sol, our AI-powered financial assistant, we may process:

• your questions and messages;
• financial objectives;
• preferences you choose to share;
• contextual financial information required to answer your request.

We encourage users never to provide passwords, authentication codes or identity document numbers in free-text conversations unless a specific Solya feature expressly requires them.

Device, security and technical information

We may process limited technical information required to operate and secure the App, such as:

• device and operating system information;
• App version;
• IP address;
• session and authentication information;
• technical logs;
• crash and diagnostic information;
• security events;
• push notification tokens.

This information helps us operate the App, protect accounts, prevent fraud and resolve technical issues.

Camera, microphone and documents

Solya may request access to your camera, microphone or selected files when required for functionality you choose to use, for example:

• identity document capture;
• selfie verification;
• video KYC;
• live identity verification;
• uploading supporting documents.

Solya does not intentionally activate your camera or microphone in the background for unrelated purposes.

You can manage these permissions through your device settings.

3. How we use your information

We process information only where necessary for legitimate and disclosed purposes, including to:

• create and manage your Solya account;
• authenticate you and protect your account;
• provide financial and payment functionality;
• process and display transactions;
• provide card and transfer functionality;
• verify your identity;
• satisfy KYC, AML/CFT and other regulatory requirements;
• prevent fraud and financial crime;
• provide Sol and personalised financial insights;
• categorise and understand transactions;
• identify recurring financial activity;
• generate financial projections, reminders and insights;
• provide customer support;
• send security, transactional and service notifications;
• diagnose technical issues;
• maintain and improve Solya;
• comply with applicable legal and regulatory obligations.

Where possible, aggregated, pseudonymised or anonymised information is used for analytics and product improvement instead of directly identifiable information.

4. Sol and artificial intelligence

Sol is designed to help you better understand and anticipate your finances.

Depending on the feature you use, Sol may analyse information such as:

• balances;
• transaction amounts;
• transaction dates and categories;
• recurring income and expenses;
• spending patterns;
• financial objectives;
• information you voluntarily provide.

Sol does not ordinarily need your identity

Solya is designed to separate your direct identity from AI and analytical processing whenever possible.

Before information is submitted for AI-powered analysis, personalisation or similar processing, Solya applies safeguards designed to remove unnecessary direct identifiers.

Depending on the processing operation, this may include:

• removing identifiers;
• masking information;
• tokenisation;
• pseudonymisation;
• anonymisation where possible;
• encryption and secure transmission.

For example, Sol may need to understand that a user receives recurring income and has certain recurring expenses.

It does not ordinarily need that user’s name, telephone number, email address or identity document number to provide that analysis.

Solya therefore seeks to provide AI processing systems only with the minimum information necessary to perform the relevant function.

KYC documents and identity information are not used to generate ordinary financial recommendations from Sol.

Where specialised AI technology providers are used, information is minimised and protected before transmission, and those providers are required to apply appropriate confidentiality, security and data-protection safeguards.

Solya does not sell your conversations with Sol or your financial information.

Unless expressly stated otherwise for a particular regulated service, information generated by Sol is intended to assist you and does not by itself constitute a legally binding financial, credit or regulatory decision.

5. Privacy by design and security

Solya uses a privacy-by-design and data-minimisation approach.

Where your direct identity is not necessary, we seek to separate identifiable information from the information required for processing.

This may include replacing direct identifiers with technical identifiers or tokens.

Personal and financial information is protected using technical and organisational security measures appropriate to its sensitivity, including where applicable:

• encryption;
• secure communications;
• authentication controls;
• restricted access;
• role-based permissions;
• pseudonymisation;
• tokenisation;
• data minimisation;
• monitoring and logging;
• security testing;
• infrastructure protection.

Data is protected during transmission using secure encryption mechanisms and protected by appropriate encryption and security controls while stored.

Access to identifiable personal information is limited to authorised systems, personnel and partners that require it for legitimate operational, security, legal or regulatory purposes.

Where information has been irreversibly anonymised so that it can no longer reasonably identify an individual, it may be used for statistical analysis, security, product improvement and research.

No electronic system can guarantee absolute security, but Solya maintains safeguards appropriate to the sensitivity of the financial and personal information it processes.

6. When information may be disclosed

Solya does not sell your personal data.

We disclose information only where reasonably necessary to provide our services, operate Solya securely, protect users or comply with legal and regulatory obligations.

This may include:

Regulated financial partners

Payment institutions, banks, card issuers, payment processors and other regulated providers required to provide financial services.

Identity verification and compliance providers

Providers assisting with identity verification, KYC, AML/CFT, sanctions screening or other regulatory requirements.

Security and fraud-prevention providers

Providers helping us protect accounts, identify suspicious activity and prevent financial crime.

Technology and infrastructure providers

Providers supporting functions such as cloud infrastructure, authentication, communications, monitoring and application operation.

Artificial intelligence providers

Specialised technology providers used to support Sol and related AI functionality.

Where such providers are used, Solya seeks to minimise and protect information before it is transmitted.

Analytics and technical performance providers

Providers used to detect crashes, diagnose technical issues, monitor performance and improve reliability.

Authorities and professional advisers

Information may also be disclosed when required by applicable law or to competent regulators, courts, law-enforcement authorities, auditors, lawyers or other authorised professional advisers.

Any service provider processing personal data on Solya’s behalf is required to maintain appropriate confidentiality, security and data-protection safeguards providing protection consistent with this Privacy Policy and applicable requirements.

7. Third-party technology and SDKs

Solya may use third-party technology or software development kits (“SDKs”) to provide functions such as:

• authentication;
• application security;
• fraud prevention;
• crash reporting;
• communications;
• payment functionality;
• identity verification;
• artificial intelligence;
• technical infrastructure.

We remain responsible for assessing the information these technologies process through the App.

We seek to limit information made available to third parties to what is reasonably necessary for the relevant service and require providers processing information on our behalf to apply appropriate privacy, confidentiality and security protections.

8. International processing

Some technology or service providers supporting Solya may operate outside Morocco.

Where personal data is transferred or made accessible internationally, Solya takes measures designed to comply with applicable Moroccan data-protection requirements, including Law No. 09-08, and applicable requirements of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

Where required, appropriate contractual, technical and regulatory safeguards are implemented.

These may include:

• encryption;
• pseudonymisation;
• data minimisation;
• access restrictions;
• confidentiality obligations;
• contractual protections.

For processing that does not require knowledge of your identity, Solya seeks to prevent unnecessary direct identifiers from being transmitted to external processing environments.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected or as required by law.

Retention periods therefore depend on the type of information and applicable legal or regulatory requirements.

Certain identity, KYC, transaction and financial records may need to be retained after an account is closed to comply with:

• financial regulations;
• AML/CFT obligations;
• accounting or tax requirements;
• fraud-prevention requirements;
• legal or regulatory obligations;
• the establishment, exercise or defence of legal claims.

Technical and security information is retained only for the period reasonably necessary for security, fraud prevention, troubleshooting and service reliability.

When personal information is no longer required and no legal or regulatory obligation requires its retention, it is deleted or irreversibly anonymised.

Irreversibly anonymised information that can no longer reasonably identify an individual may be retained for statistical, security, research and product-improvement purposes.

10. Account and data deletion

You can request deletion of your Solya account and associated personal information.

Account deletion may be initiated directly through the account settings available in the Solya App.

You may also request account deletion through Solya’s account-deletion page on our website or by contacting:

hello@solya.io

Following a valid deletion request, personal data associated with your account will be deleted or irreversibly anonymised unless Solya or a regulated partner is legally required to retain specific records.

Information may therefore continue to be retained where required for:

• KYC or AML/CFT obligations;
• financial regulations;
• accounting or tax requirements;
• fraud prevention;
• security investigations;
• ongoing disputes or legal proceedings;
• other applicable legal obligations.

Information retained following account deletion remains protected and is restricted to the purpose for which its retention is required.

Account deletion means deletion of the account, not merely temporary suspension or deactivation.

11. Your rights

In accordance with applicable law, you may have rights concerning your personal information, including rights to:

• obtain information about how your data is processed;
• access your personal information;
• request correction of inaccurate information;
• object to certain processing where applicable;
• request deletion where applicable;
• withdraw consent where processing relies on consent.

Under Moroccan Law No. 09-08, individuals benefit in particular from rights of access, rectification and opposition, subject to the conditions provided by law.

To exercise your privacy rights, contact:

hello@solya.io

Because Solya handles financial information, we may need to verify your identity before completing a request to protect your account and information from unauthorised access.

You may also contact the:

Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)

where applicable.

12. Consent and permissions

Where consent is required for a specific processing activity, Solya will request it through an appropriate affirmative action.

You can manage device permissions such as camera, microphone and notifications through your device settings.

Withdrawing a permission may prevent functionality that depends on it from working.

For example, identity verification may not be possible without camera access where such verification is required to provide a regulated financial service.

Withdrawal of consent does not affect processing lawfully carried out before consent was withdrawn.

13. Communications and marketing

Solya may send communications necessary for:

• account security;
• transactions;
• authentication;
• regulatory information;
• important service updates;
• customer support;
• financial insights and Sol functionality.

Essential security, transactional and regulatory communications may continue where necessary to operate your account.

Where Solya sends promotional communications, you may opt out using the mechanism provided in the communication or by contacting us.

Solya does not sell personal data to advertisers and does not use KYC documents or sensitive financial information for third-party advertising.

14. Children’s privacy

Unless expressly stated otherwise for a specific service permitted by applicable law, Solya’s financial services are intended for persons who are at least 18 years old.

We do not knowingly provide standard Solya financial services to children who are not legally eligible to use them.

If we discover that personal information has been collected in circumstances that are not permitted, we will take appropriate steps in accordance with applicable law.

15. Website and cookies

The Solya website may use cookies and similar technologies necessary to:

• operate and secure the website;
• remember user preferences;
• diagnose technical problems;
• understand website performance;
• improve the service.

Where required by applicable law, non-essential cookies are used only after appropriate consent.

16. Changes to this Privacy Policy

We may update this Privacy Policy when Solya’s services, technology, providers or regulatory obligations change.

The current version will remain accessible through the Solya website and within the Solya App.

The date displayed at the beginning of this Privacy Policy indicates when it was last updated.

Where required, we will provide additional notice of material changes.

17. Contact us

If you have questions about this Privacy Policy, your personal information or your privacy rights, please contact:

Solya Technologies SAS
Commercial Register: RC 683151
Casablanca, Morocco

Privacy contact
hello@solya.io

You may also contact the competent data-protection authority in Morocco:

Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)