Privacy policy

QUANTYL MAROC, N° 28, rue Matrane Khalil Matrane, avenue Allal Ben Abdellah, Fès, Maroc.

Contact: support@quantylcloud.com.

QuantylCloud determines why and how the data described below is processed in order to provide its cloud infrastructure service.

Account and identity data. We receive directly from you your email address, your hashed password, your name, your phone number and, depending on your situation, the company name, your company identifier (ICE, SIRET or VAT number) and your billing details. We do not ask for any identity document. If you use Google, Google sends us the stable identifier and the email address needed for that sign-in; we do not receive your Google password.

Service data. We record the plans and resources ordered, their labels and settings, public SSH keys, the network addresses assigned, the actions requested, usage and consumption measurements, and your exchanges with support.

Financial data. We process the wallet balance, the amounts, references and statuses of top-ups, the usage entries and the invoices. The information entered on the secure payment page is received by CMI or the bank; QuantylCloud neither asks for nor keeps the full number or the security code of your card.

Technical data. The service generates the IP addresses, user agents, timestamps, hashed tokens, and the sign-in, security, administration and email-sending logs needed for operation and traceability.

Network security data. To detect abuse (attacks, mass sending, mining) and protect the infrastructure, we automatically analyze the network metadata of the traffic leaving each VPS: destination addresses and ports, volumes, throughput and timestamps, as well as processor usage. We never examine the content of the exchanges or of your files. Detected abusive activity results in a record linked to the server and to your account.

Acquisition data. If you accept audience measurement, we keep the origin of your first visit coming from a campaign (UTM parameters and landing page) and, if you also accept advertising, the Google Ads click identifier (gclid). This information is linked to your account at sign-up.

An email address and a means of authentication are required for the account. Before an order in the name of a company, that company's identifier is mandatory; an individual has nothing more to provide. Without a required item of data, we cannot create or secure the account, perform the order, collect the payment or issue the invoice.

Performance of the contract and pre-contractual measures: creating and authenticating the account, replying to requests, providing and administering VPS or GPUs, managing SSH keys, measuring usage, debiting the wallet, and handling orders, payments, refunds and support requests.

Legal obligations: identifying the customer where regulations require it, drawing up and keeping accounting and tax records, replying to authorized authorities and handling requests to exercise rights.

Legitimate interest of QuantylCloud: securing accounts and the infrastructure, preventing fraud and abuse, diagnosing incidents, keeping proof of operations and improving the reliability of the service. This processing is limited to what is necessary and may be objected to under the conditions described below.

Your consent: measuring the audience of the site and the origin of sign-ups (audience measurement), measuring the effectiveness of our ads and, later, showing them to you again on other sites (advertising). Each purpose is accepted or refused separately, and the choice can be withdrawn at any time through the “Manage cookies” link at the bottom of the page, without effect on processing already carried out.

The data is neither sold nor rented. Without your consent, it is used for no audience measurement and no advertising.

The data is accessible only to authorized people at QuantylCloud and, depending on the functions used, to hosting and cloud resource providers, to the email provider, to Google for the sign-in you choose, and to CMI and the banks for payments. With your consent only, Google (Google Analytics for audience measurement, Google Ads for advertising) and, when we enable it, Meta (Facebook, Instagram) for advertising receive the browsing and conversion data described in the “Cookies” section. Each receives only the data needed for its task, under its contractual, legal and security obligations.

The site and the API are hosted by OVH SAS, at the following address: 2 rue Kellermann, 59100 Roubaix, France. This location is distinct from that of the resources rented by the customer. The data may also be disclosed to a legally authorized authority.

Depending on the service, the data is hosted in Morocco, on our own servers, or abroad with a hosting provider. Any transfer outside Morocco is governed in accordance with articles 43 and 44 of Law 09-08.

Google and Meta, recipients of the measurement and advertising data when you accept them, process this data in particular in the United States.

A transfer to a country recognized by the CNDP as offering an adequate level of protection takes place without prior authorization from the CNDP. To any other country, it takes place only with the authorization referred to above.

Declaration of the processing: reference published here as soon as the CNDP issues it.

Account, resource and support data is kept for the life of the account or of the resource concerned, then for the time needed to close the service and settle any dispute. Data that no longer meets an obligation or a justified need is deleted or anonymized.

Accounting and tax records are kept for ten years. Sign-in logs are kept for twelve months. Technical tokens expire according to their function; their fingerprint may be kept for as long as needed for session security.

A quote request for a Dedicated server (standard or GPU) is kept for twelve months so that it can be followed up; after that period, only a request that led to a sale is kept, the others are deleted.

Records of abuse detections, and the network measurements they contain, are kept for 12 months, then deleted automatically.

Acquisition data linked to the account follows the life of the account. Cookie lifetimes are given in the next section.

We apply access controls, encryption of communications, hashing of passwords and sensitive tokens, as well as backup, logging and access-limitation measures. As no transmission or storage can be guaranteed to be risk-free, the measures are adapted to the nature of the data and reassessed along with the service.

Always used, because they are essential: the session cookie, which keeps you signed in, and the one that remembers your choice about cookies (six months).

Audience measurement, with your consent: the Google Analytics cookies (thirteen months) and our origin cookie, which remembers the campaign of your first visit (ninety days, erased on sign-up).

Advertising, with your consent: the Google Ads cookies (thirteen months at most) and, later, those of Meta, which link a sign-up or a first top-up to the click on an ad.

Until you have answered, no measurement or advertising cookie is set and no third-party tool is loaded. You can change your choice at any time with the “Manage cookies” link at the bottom of every page; withdrawal erases the cookies concerned.

You can ask for access to your data, for its rectification, object to processing on legitimate grounds, or ask for erasure where no obligation requires it to be kept. You can exercise these rights from the contact page. We may ask for the items strictly necessary to verify your identity and to reply to the request.

If the reply does not satisfy you, you can refer the matter to the National Commission for the Control of Personal Data Protection (CNDP). Exercising a right is free of charge, except for a manifestly abusive request, and does not affect processing that was already lawful.

This page is updated when the data, purposes or providers change. The version date at the top of the page identifies the applicable text. An important change is announced by a suitable means before it takes effect where the law requires it.