Last updated: October 2026
Privacy policy
At React Box, we take the protection of your personal data very seriously. This policy explains which data is processed, in what capacity, how it is used, where it is hosted and what your rights are under Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data.
Data controller and DPO
The data controller is React Consulting SARL AU, publisher of React Box, ICE 003399449000060, with registered office at Boulevard My Hassan 1er, Imm Siam Block A, 3ème N10, Marrakech, Morocco. You can contact our data protection officer (DPO) at dpo@react-box.com.
Our role: controller and processor
React Box acts in two distinct capacities. (1) Data controller for the data needed to provide and sell the service: user accounts, organizations, subscriptions and their invoicing, security and logs, notifications, audience measurement, support and data-subject requests. (2) Processor, within the meaning of Law 09-08, for the management data and documents that a customer organization (business or accounting firm) processes in React Box: that organization is the controller, and we process this data only on its instructions, never for our own purposes. This data is hosted with strictly private access; our teams do not access the content of your documents, except for a documented technical necessity or a legal obligation. Automated analysis by artificial intelligence only happens in three cases, all decided by the organization: when a user requests the digitization (OCR) of a document, when they address the Atlas assistant, and when the organization uses its drop-off email address — each email received there is then sorted automatically and its accounting attachments are digitized. The result is always returned to the user for validation. The customer organization is solely responsible for the content and data it uploads or processes in React Box, and for its users' use of them, under the conditions set out in the terms of use.
Data processed
(A) Data for which React Consulting SARL AU is the controller: user identity and account (name, email address, profile picture, language, hashed password, two-factor settings, social login accounts); sessions and devices (IP address, user agent, push notification token, platform, device name and app version); organizations (company name, ICE, IF, RC, TP, address, logo, members and roles); subscriptions, add-ons, Atlas credit and subscription invoices; security and activity logs; notifications and preferences; usage of artificial intelligence features; audience measurement; support and data-subject requests; API keys and OAuth authorizations granted to third-party applications (metadata, never the key in clear). (B) Data processed on behalf of customer organizations, which remain its controllers: vault documents and their metadata; third parties — customers and suppliers — with their identity, ICE, IF, RC, TP, CNSS, bank details (IBAN/RIB), contacts and addresses, and, for natural persons only and optionally, the national identity card number (CIN), masked on display, restricted to authorized roles and with every consultation logged; bank accounts, statements and cash receipts; sales invoices, credit notes, reminders and purchase invoices; chart of accounts and postings; emails received at the organization's drop-off address (sender, recipients, subject, body and attachments); conversations, messages and document requests; conversations with the Atlas assistant; public share links and their access logs.
Purposes and legal bases
Category (A) data is used to provide the service and manage your subscription (performance of the contract), ensure security and traceability (legal obligation and legitimate interest), keep our accounts (legal obligation), send you transactional notifications by email and push notification (performance of the contract), and improve the product through audience measurement (consent). Audience measurement is operated by PostHog: it records pages viewed, interface interactions and errors encountered, and — on signed-in surfaces only (dashboard, account, authentication) — a recording of your browsing session. Without your consent, only an anonymous count of visits to the public site is made: it relies on a hash computed server-side, renewed daily, with no cookie, no storage on your device and no personal identifier. The other measurement processing is only enabled after your consent, collected in the cookie banner on the web and in the app settings on mobile, and can be withdrawn at any time. Regardless of this consent, a few business events — account creation, organization creation, invoice issuance, document upload, subscription cancellation, an agent calling a tool — are recorded from our servers with PostHog, with the account and organization identifier but no content, to monitor the service's commercial activity (legitimate interest); you can object by writing to our DPO. Category (B) data is processed for the purposes decided by the customer organization, which determines its legal basis.
Hosting and transfers
Data is stored in the European Union: Neon database in Frankfurt, Germany (eu-central-1, AWS), files on Cloudflare R2 and real-time channels on Cloudflare Durable Objects, both restricted to the European Union jurisdiction, audience measurement on PostHog's European infrastructure. The application itself runs on Cloudflare Workers' global network: each request is processed in a data center close to the user, without being stored there. Some operations nevertheless leave the European Union. (1) Global cache: session-validity information about your sign-in sessions (session and account identifier, account status, kept for 60 seconds) and one-time verification codes are kept in a cache distributed worldwide by Cloudflare (Workers KV), with no jurisdiction restriction; the full content of your sessions stays in the European database. The same cache keeps, for at most 10 minutes, the aggregates shown by an organization's dashboards and analytics (amounts, names of customers, suppliers and senders of pending documents). (2) Push notifications: they go through Expo's delivery service (650 Industries, Inc., United States) and then Apple's (APNs) and Google's (FCM) gateways, which receive your device token and a generic text — for example “New message” — that contains no person name, organization name or document title; the details are shown when you open the app. (3) Social login: if you choose to sign in with Google, Apple or Microsoft (United States), these companies receive the authentication request and send us your identity (email address, name, profile picture). (4) Cloudflare, Inc. and Neon, Inc. are US companies and, as such, may receive access requests from their authorities, even though the data remains hosted in the European Union. Document digitization, sorting of emails received at the drop-off address and the Atlas assistant are entrusted to sference, a service of Neural Compute Ltd (United Kingdom), with compute in the European Economic Area and no data retention: only the file, email or message concerned is sent; it is deleted as soon as the response is returned and is never used to train a model. Transfers to countries on the list of countries providing adequate protection established by the CNDP (deliberation No. 236-2015), including those related to artificial intelligence, are declared to the CNDP. Transfers to the United States rely on your consent or on the performance of the contract, in accordance with Article 43 of Law 09-08, and are subject to CNDP authorization; each sub-processor's contractual data protection commitments complement them. You are informed of these transfers at sign-up and when creating your organization; you can avoid the push notification transfer by turning notifications off in the app settings, the social login transfer by creating your account with an email address and password, and the artificial intelligence transfers by not submitting any document for digitization, not using the Atlas assistant and not enabling the drop-off address.
Technical sub-processors
We use the following sub-processors, all bound by contractual data protection commitments. (1) Cloudflare, Inc. — United States: running the application on its global network (Workers), real-time channels (Durable Objects, EU jurisdiction), file storage (R2, EU jurisdiction), global cache of session-validity information, verification codes and dashboard aggregates (Workers KV), sending transactional emails and receiving emails addressed to drop-off addresses, bot verification on public forms (Turnstile). Receives all service data, including file content. (2) Neon, Inc. — United States, database hosted in Frankfurt (eu-central-1, AWS): accounts, organizations, management data, document metadata, logs. Does not receive file content. (3) sference, a service of Neural Compute Ltd — United Kingdom, with compute in the European Economic Area: document digitization (OCR), sorting of received emails, the Atlas assistant and help drafting our support team's replies. Only receives the files, emails and messages submitted to these features (for support: the sender's address and excerpts of the conversation), with no data retention: they are deleted as soon as the response is returned and are never used to train a model. (4) PostHog — audience measurement, session recording and error tracking on the publisher's European infrastructure. Without consent: a simple anonymous visit count, with no cookie or identifier. After consent: pages viewed, interactions, errors, account and organization identifier. Does not receive the content of your files. (5) 650 Industries, Inc. (Expo) — United States: delivery of push notifications. Receives your device token and a generic text, with no identifying data. (6) Apple Inc. and Google LLC — United States: push notification delivery gateways (APNs and FCM), recipients of the same items. (7) Google LLC, Apple Inc. and Microsoft Corporation — United States: social login, only if you choose this authentication method. (8) Have I Been Pwned (Pwned Passwords service): when you choose a password, we check that it does not appear in a known breach using the so-called k-anonymity method — only the first five characters of a SHA-1 hash of the password are sent; neither the password nor your email address leaves our servers. Email and password authentication is handled in-house by React Box. This list is kept up to date; any change is published on this page and, for customer organizations, announced in accordance with the data processing agreement.
Retention periods
Account data is kept as long as your account is active; an account whose deletion is requested is erased after a 30-day period during which the request can be cancelled. Documents and management data are kept under the organization's responsibility, which decides when to delete them; a deleted document or third party stays 30 days in the trash, then is permanently erased. Other periods are as follows: read notifications, 6 months; unread notifications, 12 months; conversations with the Atlas assistant, 30 days after the last message; document and organization activity logs, 2 years; platform audit log, 5 years, where the IP address only appears as a non-reversible fingerprint; proof of invoice emails sent, 5 years; usage data of artificial intelligence features, 2 years; expired sessions, 30 days after expiry; document export archives, 30 days; download link for the export of your personal data, 7 days; IP address and browser attached to a request to exercise your rights, 6 months after it is filed; correspondence with our contact addresses (contact@, billing@, dpo@, security@), 3 years after the last message. When your account is erased, the messages you wrote in the messaging feature are replaced with a deletion notice, their attachments are erased, and your comments on documents are deleted. The data of a suspended organization is kept for at least 30 days after the suspension and may be permanently deleted from that deadline; its administrators can export it until it is deleted. Subscription invoices issued by React Consulting SARL AU are kept for 10 years, in accordance with our accounting and tax obligations.
Your rights
Under Law 09-08, you have a right of access, rectification and objection, on legitimate grounds, to the processing of your personal data; we also act, as far as possible, on requests for erasure, restriction and portability. To exercise them, write to dpo@react-box.com or use our online form (“Exercise my rights”, in the footer). For data processed on behalf of an organization — documents, third parties, invoices, messages —, your direct contact is the business or accounting firm concerned, which is the controller; we assist it in answering you. You also have the right to lodge a complaint with the National Commission for the Control of Personal Data Protection (CNDP, www.cndp.ma).
Cookies
Our site uses cookies essential to its operation (session, language, consent preferences, display preferences) and, subject to your explicit consent, audience measurement cookies. You can adjust your preferences at any time via the “Cookie preferences” link in the footer. See our cookie policy for details.
Security
We implement appropriate technical and organizational measures: TLS encryption of exchanges, encryption at rest (AES-256) on Cloudflare R2, role- and permission-based access control, available two-factor authentication (2FA), password checks against known breaches, short-lived signed URLs (5 minutes for downloads, 15 minutes for uploads), logging of actions performed on your documents and of consultations of sensitive data, masking of third parties' CIN numbers, least-privilege principle — our teams do not access the content of your documents, except for a documented technical necessity or a legal obligation.
Programmatic access: API keys, OAuth and MCP server
An organization can open its data to applications and automated agents in two ways: by creating an API key from its settings, or by authorizing a third-party application through the OAuth flow, which gives access to our MCP server. Both mechanisms are reserved for the organization's administrators. A key or authorization can only cover the data of the organization that issued it, within a list of allowed operations, and its use is logged like a user's. An agent authorized this way can read the organization's management data and the metadata of its vault. A key can be revoked at any time from the organization's settings; an authorization granted to a third-party application is withdrawn the same way. It is up to the organization issuing the key to check the recipient's trustworthiness.
Sharing a document via a public link
A user with the necessary rights can create a public link to a document in their vault, to pass it on to a recipient without a React Box account. Until it expires or is revoked, the link makes the document accessible to anyone who has it: it is a disclosure of data decided by the organization, under its sole responsibility. Each link can carry an expiry date and a password, and the public page requires a bot check. For each opening, we keep the date, a non-reversible hash of the IP address, the country and the visitor's user agent, so the organization can trace access and detect unwanted sharing. A link can be revoked at any time, with immediate effect.
Emails sent on behalf of organizations
At an organization's request, React Box sends emails on its behalf to its own customers: invoices, credit notes and payment reminders. The organization remains responsible for this processing, in particular for the choice of recipients and for informing them. Each payment reminder includes a link allowing its recipient to stop receiving them; the organization can also pause reminders for a customer or for an invoice.
Declaration to the CNDP
The processing described in this policy will be declared to the CNDP before the service's commercial launch; the receipt and authorization numbers will be published here.