Privacy Policy

NEUROVEX TECHNOLOGIES SARL, an information technology services company headquartered in Marrakesh, operates the Orka platform (orka.ma and its mobile applications) and determines the purposes and means of processing your personal data. It therefore acts as the data controller. Contact: contact@orka.ma We process your data in accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, decisions of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), and applicable international best practices.

This policy applies to anyone using Orka through the website, iOS application, or Android application. It describes the data we collect, why we process it, the third parties that may access it, how long we retain it, and your rights. It does not apply to third-party websites or services that the Platform may link to, which have their own privacy policies.

Account creation data: • first name, last name, email address, and phone number; • password, stored as a hash and never in plain text; • for email registrations, email-verification status. Educational profile data: • level and academic track; • study goals, grades, and averages that you choose to enter. Usage and learning data: • history of your conversations with the assistant, tutor, and orientation modules; • generated exercises, quizzes, summaries, revision sheets, flashcards, illustrations, podcasts, and your results; • knowledge model data, including estimated mastery by chapter, progress, XP points, badges, streaks, study time, and activity statistics; • messages posted in study groups and multiplayer quiz scores; • files and images attached to your questions; • reports you submit to us, including the content concerned and the reason; • video viewing progress and personal video notes. Subscription data: • status, plan, and expiry date of your Pro Subscription; • transaction identifier provided by our payment provider. We do not receive or store your bank card number. Technical data: • IP address, masked and then anonymized after 30 days; • browser type, device type, and operating system; • on mobile, device model, application and OS versions, language, time zone, and where applicable a push-notification token; • pages and screens viewed, actions performed, and session duration; • anonymized screen recordings (see “Cookies, audience measurement, and product improvement”); • crash and performance reports. We do not intentionally collect sensitive data such as health information, opinions, or biometric data, and we ask you not to submit such information through the Platform.

Orka supports sign-in with email and password, Google, and Sign in with Apple. Google: we receive your name, email address, and profile picture solely to create and identify your account and display your name and avatar. Google Privacy Policy: https://policies.google.com/privacy Apple: we receive your name, which you can edit, and an email address. If you choose Hide My Email, Apple provides an anonymous relay address, which is then stored. We request no other data from Apple. In the iOS application, the associated Apple authentication token is revoked when the account is deleted. Apple Privacy Policy: https://www.apple.com/legal/privacy/ This data is neither sold nor used for advertising purposes.

• Provide, personalize, and secure the study Services, and manage your Account and subscription — performance of the contract. • Improve educational quality, recommendations, and Platform usability — legitimate interest. • Send transactional emails such as verification, password reset, confirmations, security alerts, and billing alerts — performance of the contract and legitimate interest. • Measure product usage and record anonymized screen sessions — consent. • Send progress notifications and study reminders — consent. • Prevent fraud, abuse, and security incidents — legitimate interest. • Comply with legal and accounting obligations and enforce our rights — legal obligation and legitimate interest. We do not make decisions that produce legal effects concerning you solely on the basis of automated processing. Your data is never sold or used for third-party advertising.

Orka uses service providers that process data on its behalf under contract and according to its instructions. The following categories are involved: • Authentication and database services — account creation and management, history, progress, and real-time features; primary hosting in the European Union. • Web application hosting and delivery — website availability and technical logs; hosting in the European Union. • Cloud infrastructure — file storage, secure video delivery, and gateway access to AI models. • Artificial-intelligence model providers — generation of responses and content from your requests. Submitted content is not used to train third-party models. • Payment processing — web payments and in-app purchases through application stores. These providers act as separate data controllers for payment operations. • Product analytics — usage statistics and anonymized screen recording, subject to your consent. • Crash and performance reporting — application stability and diagnostics. • Transactional email delivery — address verification, password reset, confirmations, and alerts. These providers are selected for their security and confidentiality safeguards. None is authorized to use your data for its own commercial or advertising purposes. Some may be located outside Morocco (see “International data transfers”). This list of categories may change; material changes are communicated in accordance with the “Changes to this policy” section.

When you use an AI feature, the content needed to generate the response, such as your question, imported text or document, conversation context, and relevant profile information, is sent to our model provider through a secure gateway. This content is used to produce your result and is not used to train third-party models. Some responses that are not derived from a personal upload may be cached in a shared cache to reduce costs and speed up the service; content derived from your uploads is never placed in this shared cache.

We prioritize hosting in the European Union. Some providers, particularly AI model, payment, and error-monitoring providers, may process data outside Morocco and the European Union, especially in the United States. These transfers are subject to appropriate safeguards, including contractual confidentiality and security commitments comparable to standard contractual clauses, and are limited to what is necessary to provide the Services.

Strictly necessary cookies (no consent required): • authentication session — keeps you signed in; • language, theme, and display preferences. Product analytics (with your consent): We use an analytics tool hosted in the European Union to understand how Orka is used and improve it. This includes: • screens viewed, features used, and your progress, associated with your account identifier, so this data is not anonymous; • session screen recordings in which text you enter and displayed images are masked and password fields are always hidden, for usability diagnostics and bug fixing. In the mobile application, this analytics collection is disabled by default: nothing is collected until you respond to the consent request shown on first launch. You can change your choice at any time in Settings → Security → “Help improve Orka”. On the web, you manage this choice through the consent banner. Refusing does not affect how Orka works. Crash reports: independently of the choice above, we collect technical crash and performance reports to maintain application stability (legal basis: legitimate interest). They do not contain the content of your conversations. We use no advertising cookies, no cross-site or cross-app tracking, and we do not provide data to data brokers.

We implement appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure, or alteration: • encryption in transit (HTTPS/TLS) and database encryption at rest; • hashed passwords, never stored in plain text; • strict access controls limited to people who need access; • per-device session management and revocation, and IP-address masking; • time-limited playback tokens for Premium Content; • logging, monitoring, and regular security reviews. No system is infallible. If a data breach is likely to create a high risk to your rights, you will be informed and the CNDP will be notified as soon as possible in accordance with applicable regulations.

• Active Account: for the duration of use, then for up to 24 months after the last activity unless deleted earlier. • AI conversation history: rolling 12-month period, then automatic deletion. • Progress, exercises, and generated content: for the duration of the active Account. • Billing data: 10 years, as required by accounting law. • Screen recordings and analytics events: up to 12 months. • Crash reports: 90 days. • Technical logs: up to 90 days. • IP addresses: masked, then anonymized after 30 days. If the Account is deleted from the application, personal data is removed immediately from our active servers; when deletion is requested through the web form, it is completed within 30 days. Residual backups are purged within a maximum of 90 days. Data that must be retained by law is excluded from these deletion periods.

Under Law No. 09-08, you have the following rights concerning your personal data: • right of access: obtain a copy of your data; • right to rectification: correct inaccurate or incomplete data; • right to object: object, on legitimate grounds, to certain processing; • right to withdraw consent: at any time for processing based on consent, without retroactive effect; • right to erasure: request deletion of your data, or the “right to be forgotten”, within legal limits; • right to data portability: receive your data in a structured, machine-readable format. To exercise these rights, write to contact@orka.ma. We respond within 30 days; proof of identity may be requested. If you believe your rights have not been respected, you may contact the CNDP (www.cndp.ma). To request deletion of your account, visit orka.ma/suppression-compte.

You can choose either method: 1. From the application (immediate): Settings → Security → “Delete my account”. After re-authentication, your Account and associated data are immediately removed from our active servers, including profile, conversation history, exercises and quizzes, progress and XP points, knowledge model, video notes, study-group memberships, sessions, notification tokens, and analytics identifier. 2. From the web (within 30 days): visit orka.ma/suppression-compte without needing to be signed in or to install the application. This is useful if you no longer have access to the app. In both cases, deletion permanently removes access and all history, progress, flashcards, and exercises, and ends any active subscription without a prorated refund. A subscription purchased through the App Store must also be cancelled in your Apple account settings. This action is irreversible: export your data beforehand if you want to keep it. Certain data may be retained where required by law, including billing records for 10 years and already anonymized technical logs for 90 days.

Orka is intended for students at Baccalaureate level and is not intended for children under 13. Users under 18 use the Services under the responsibility of a parent or legal guardian. If we learn that an Account was created by a child under 13 without a valid legal basis, we delete it. A parent or legal guardian may contact us at contact@orka.ma with any question concerning a minor’s data.

The Platform may link to third-party websites or services, such as documentation or external resources, that have their own privacy policies. Orka is not responsible for their practices; we encourage you to review their policies before providing them with data.

We send transactional emails needed to operate the service, including address verification, password resets, confirmations, and security and billing alerts. They cannot be disabled while your Account is active. Progress notifications and study reminders are optional and controlled by a single setting that you can change at any time. At present, Orka does not send purely promotional communications.

We may change this policy to reflect changes to the Services or applicable regulations. The current version is published at orka.ma/privacy with its update date. If a material change reduces your rights or expands our processing, you will be informed by email and/or through a visible notice on the Platform at least 30 days before it takes effect. Continuing to use Orka after that date constitutes acceptance of the new policy. Effective date of this version: September 3, 2026.

For any question or request concerning your personal data: NEUROVEX TECHNOLOGIES SARL — Orka Marrakesh, Morocco contact@orka.ma Supervisory authority: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) — www.cndp.ma