Privacy Policy
Last updated: 9 September 2026 · Version 1.0
How PRUVILO uses account information, Google sign-in data and security records, and how to contact us about your privacy.
Who this notice covers
This notice explains processing for pruvilo.com and the PRUVILO mobile app. The project operator determines how account and service data is used. The unregistered name baforge2 is a project name, not a separate legal entity. Questions and requests can be sent to [email protected].
Information we process
We process the email address and phone number you verify, your first and last name, profile preferences and address details you submit. We also process verification challenges, account identifiers, session records, IP addresses, approximate browser/device information, security events and support correspondence. Where a deal feature is available, we process the descriptions, agreed terms and evidence you submit for that feature. Do not include other people’s sensitive information unless necessary and lawful.
Continue with Google
If you choose Google, we verify a Google ID token and use its account identifier, verified email and available first and last names to identify your account and prefill onboarding. The account identifier is stored to recognise future sign-ins. Phone verification is still required. This integration requests basic sign-in identity only (openid, email and profile); it does not request access to Gmail messages, contacts or Drive files. Google sign-in data is used for account access and account administration, not sold or used for advertising. You may remove PRUVILO’s connection in your Google Account; that does not itself delete your PRUVILO account or previously stored records. Contact us to request deletion.
Why we use information
We use information to provide the account and features you request, verify contact details, deliver codes and service notices, manage agreements, answer support requests and protect accounts against abuse. Depending on the processing and applicable law, the grounds are providing a requested service, legal obligations, legitimate security interests where permitted, or specific consent where required. Accepting terms is not blanket consent to unrelated processing or marketing.
Service providers and disclosures
The service uses Railway for backend hosting, Neon for PostgreSQL storage and Cloudflare for domain/network services. Brevo delivers verification emails. SMSGate routes verification SMS through the configured sending phone and its mobile carrier; the carrier necessarily handles the destination number and SMS contents. Google handles Google authentication under its own policy. These providers receive the information needed for their function; access is also limited to authorised operators assisting with support or security. Deal information is disclosed to relevant participants only where the feature requires it. Information may be disclosed for a valid legal obligation or to investigate abuse, subject to applicable law. We do not sell personal data.
Processing locations
Hosting, messaging and authentication providers may process information outside your country, including outside Morocco. This notice does not claim that data stays in Morocco or that any regulatory transfer approval has been obtained. Provider locations, contracts and any required safeguards or authorisations must be confirmed for the relevant deployment; contact us for current information.
Cookies, PIN and biometrics
The website uses authentication/session mechanisms when you sign in. The mobile app stores protected session information on your device so you can unlock it with your PIN or optional biometrics. Your app PIN is not sent to the backend. Fingerprint and face matching for device unlock are performed by the operating system; PRUVILO does not receive your fingerprint or face template. This is not identity verification. No advertising or analytics tracker is added by these legal pages.
Identity checks and planned services
Where enabled, Didit identity verification requires a separate explicit confirmation. Read the Identity verification notice linked on this page for document, facial biometric, Device/IP and AML checks, provider processing and current limitations. Publishing a notice does not enable verification. A preview of payments, protection or delivery does not mean those services are active or their providers receive your information.
Retention and protection
Verification codes and proofs have limited validity; expiry does not necessarily mean immediate database deletion. Account data is kept while needed for the account and requested services. Security, dispute and legally required records may need to be retained after closure, with access restricted to their purpose. Backups and provider copies may take additional time to expire. The retention schedule and applicable legal periods are still being finalised; no fixed deletion deadline is promised here. We use server-side verification, access controls and protected sessions, but no online service can guarantee absolute security.
Your choices and requests
Write to [email protected] to request access, correction, deletion, account closure, information about recipients or retention, or to object to processing or withdraw consent where applicable. Additional rights depend on the law that applies to you. We may need proportionate proof of identity; never email your PIN, OTP or full identity documents without a secure procedure agreed with support. We will explain any lawful reason a request cannot be fulfilled in full. You may complain to the competent data-protection authority, including Morocco’s CNDP where applicable.
Children and changes
PRUVILO accounts are intended for adults aged 18 or over with legal capacity. Contact us if a child has supplied personal information. We will update this notice as the service changes and identify the revision date. Material changes will be communicated through an appropriate service channel, with separate consent sought where required.
Privacy requests, support and complaints
[email protected]