Last updated: October 2026
Terms of service
These terms of use govern access to and use of the React Box service, published by React Consulting SARL AU. The personal data processing agreement (DPA), published on this site, forms an integral part of them; the privacy policy describes the processing for which React Consulting SARL AU is the controller.
Article 1 — Purpose and intended use of the service
React Box is professional software, provided online, intended for storing, organizing, managing and securely sharing business data and documents — in particular accounting records — between businesses and their accounting firms. It is available on the web and through iOS and Android mobile apps with feature parity. The service includes a document vault, messaging and document requests, sales invoicing and purchase invoice tracking, third parties, bank accounts and the chart of accounts, cash management and currency conversion, artificial-intelligence-assisted digitization (OCR), a drop-off email address and the Atlas assistant, an analytics module, programmatic access through API keys and an MCP server, a notification system and an activity log. The exact scope open to your organization depends on its type — business or accounting firm — and on the add-ons subscribed; it may change, the application being authoritative. The service is reserved for professionals: businesses and accounting firms acting in the course of their business. Law No. 31-08 on consumer protection does not apply to it.
Article 2 — Acceptance, version and evidence
The terms and the data processing agreement are accepted by ticking an unticked box when the account is created, or at first sign-in when the account is created through social login; use of the service is conditional on this acceptance. The accepted version and its date are recorded. The user who accepts them represents that they have authority to bind the organization on whose behalf they act; the accepted terms are binding on the user and on that organization. In accordance with the Dahir forming the Code of Obligations and Contracts, as supplemented by Law No. 53-05 on the electronic exchange of legal data, the parties agree that the logs, timestamps and electronic records kept by React Box are authoritative between them, unless proven otherwise.
Article 3 — Account, users and security
Access to the service requires creating an account and providing accurate, up-to-date information. You are solely responsible for keeping your credentials confidential and for all actions taken under your account; enabling two-factor authentication is strongly recommended. The organization appoints its administrators, who assign roles and permissions to its members; it makes sure to remove them when a member leaves. The organization is accountable for the acts of its users, administrators and members as for its own. React Box is not liable for the consequences of a third party using your credentials, nor for any granting of rights decided by the organization. Any unauthorized use must be reported to us without delay.
Article 4 — Trial period
A business organization gets a free, no-commitment 30-day trial, which starts when its file is activated. Reminders are sent 7 days, 2 days and 1 day before it ends. When the trial expires without a subscription, the organization is suspended: access to the service is blocked, and its data is kept for at least 30 days, after which it may be permanently deleted under the conditions of Article 20. It regains access as soon as it subscribes before that deadline. During the trial, the service is provided free of charge, as is.
Article 5 — Subscription, prices and add-ons
Use of the service by a business is subject to an annual subscription of MAD 3,000 excl. tax (i.e. MAD 250 excl. tax per month), plus VAT at 20%. The subscription is payable in advance, for a one-year term. It renews automatically for successive one-year terms, a renewal invoice being issued before the due date and reminders sent 30 days, 7 days and 1 day before it. Sales invoicing is included in the subscription. Add-ons, reserved for businesses, can be subscribed at the price shown in the application, the quote or the activation invoice: Extra storage (MAD 1,000 excl. tax per year per 10 GB block) and Analytics (MAD 600 excl. tax per year). An add-on added or increased during a term is charged pro rata for the remaining period until the next renewal; a reduction or removal takes effect immediately and gives rise to no refund. The subscription includes each month a usage credit for the artificial intelligence features (digitization, sorting of received emails, Atlas assistant); unused credit carries over while the subscription is running. When the credit is used up, these features are suspended until the following month or until a top-up: a top-up gives rise to an invoice, and the corresponding credit is added to the balance once it is paid. The subscription can be cancelled at any time from the application, effective at the end of the current annual term, with no refund of the term already started. If payment is not made by the due date, access is maintained for 15 days, after which the organization is suspended; Article 20 sets out what happens to its data. React Box may also suspend or terminate the subscription under the conditions of Article 19; the amounts paid then remain due to it.
Article 6 — Free access for accounting firms
Access for accounting firms is free, with no limit on client files or users: an accounting firm organization takes out no subscription and cannot be charged for any add-on. The Analytics module is open to it at no extra cost. This access is provided free of charge, as is, and may change; React Box informs accounting firms at least 30 days before any change to its financial conditions.
Article 7 — License and intellectual property
React Consulting SARL AU holds all intellectual property rights in the service — software, interfaces, databases, trademarks, texts and graphics —, except for the organization's content. For the duration of the subscription or free access, the organization and its users are granted a non-exclusive, non-assignable and non-transferable right of use, limited to using the service for the needs of the organization's business and in accordance with these terms. Except where expressly permitted by Law No. 2-00 on copyright and related rights, it is forbidden to copy, modify, decompile or disassemble the service, to extract its source code, to circumvent its technical protection measures or usage limits, to systematically extract its content, to resell or sublicense it, to make it available to third parties or to use it to develop a competing service. Suggestions for improvement sent to React Box may be used freely by it, without consideration.
Article 8 — Data processing and ownership of content
The organization remains the owner of the documents and management data it processes in React Box. It grants React Box, solely for the duration and purposes of providing the service, the right to host, reproduce, transmit, convert, optimize — in particular through visually lossless compression — and display this content. React Box acts as a processor for it within the meaning of Law 09-08, under the data processing agreement (DPA) published on this site: we process this data only on the organization's instructions, for the sole purposes described below, never for our own purposes, and disclose it to no third party other than the recipients designated by the organization, the sub-processors listed in our privacy policy and the authorities empowered to request it. In practice: (a) files are stored encrypted at rest with our host, Cloudflare (European Union jurisdiction), which does not access them for its own purposes; (b) when a user triggers a digitization (OCR), addresses the Atlas assistant, or when the organization uses its drop-off email address, the files, messages or emails concerned are sent to our artificial intelligence inference provider, sference, a service of Neural Compute Ltd (United Kingdom), with compute in the European Economic Area and no data retention: they are deleted as soon as the response is returned and are not used to train any model; (c) when a user creates a public share link, the document becomes accessible, within the limits set, to anyone who has the link; (d) our teams do not access the content of your documents, except for a documented technical necessity or a legal obligation.
Article 9 — Hosted content: role and liability of React Box
React Box provides a technical storage and processing infrastructure. It is neither the author, nor the publisher, nor the custodian of the content and data that organizations and their users upload, enter, receive, generate or share in the service (the “organization's content”), and exercises no prior control over it. It has no general obligation to monitor this content or to seek facts or circumstances indicating unlawful activity. The organization and its users are solely responsible for: (a) the accuracy, completeness, lawfulness and compliance of the organization's content, and for the rights and authorizations needed to upload and process it; (b) their use of the service and the decisions — in particular accounting, tax, financial, employment or legal — they make on the basis of this content and of the service's results; (c) the actions taken by their users, their administrators, the accounting firm they are linked to, the recipients of their share links and the applications or agents they authorize; (d) the communications and sendings they make through the service. React Box can in no event be held liable for the organization's content, for its unlawful, inaccurate or harmful nature, or for the conduct of users on or through the platform. When manifestly unlawful content is reported to it, or when a competent authority so requires, React Box may, without incurring liability, restrict access to it, remove it or suspend the account concerned, and provide the authorities with the information they request under the conditions provided by law. This article does not release React Box from its own security and confidentiality obligations, described in Article 8 and in the data processing agreement.
Article 10 — Obligations of the organization as controller
For the data it processes in React Box, the organization is the controller. In particular, it is responsible for: having a legal basis for each processing operation; completing its own formalities with the CNDP (declarations and, where applicable, authorization requests, including for the transfers abroad carried out by our sub-processors and described in the data processing agreement); informing the data subjects — its customers, suppliers, employees and contacts — and answering their requests; collecting only adequate, relevant and non-excessive data; ensuring that the emails sent on its behalf (invoices, reminders) are lawful, and complying with statutory accounting retention periods and professional secrecy; the statutory retention of its records and invoices is its own responsibility, including in the event of a suspension, under the conditions of Article 20. In particular, a third party's national identity card number (CIN), an optional field reserved for natural persons, is data processed on behalf of the organization, which remains solely responsible for it: collecting it requires prior authorization from the CNDP, which the organization must obtain before filling in this field. React Box masks it on display, restricts its consultation to the roles the organization authorizes and logs every consultation. The same applies to any sensitive data within the meaning of Law 09-08 contained in the documents the organization uploads.
Article 11 — Relationship between a business and its accounting firm
When a business links its organization to an accounting firm, it authorizes that firm and the members it empowers to access its data and act on it within the limits of the permissions provided by the service. The relationship between the business and its firm — engagement, fees, professional secrecy, quality and timing of accounting, tax or payroll work — is governed exclusively by the contract between them, to which React Box is not a party. React Box provides no accounting services and is not accountable for the firm's work, for the actions it takes in the service, or for its failures towards the business. The firm is bound, for its clients' data, by the obligations of Articles 10, 12 and 13.
Article 12 — Business use of storage
React Box is software intended for storing and managing the business's data and documents, for the needs of its professional activity. The storage space, the document vault, the drop-off email address and the other features of the service may only be used for that purpose. Any misuse of storage is contrary to these terms, in particular: (a) uploading or keeping files for personal or private purposes, unrelated to the organization's business, such as photos, videos, music, family documents or backups of personal devices; (b) a user's use of the service against the organization's own interests, in particular to divert, copy, exfiltrate or conceal its data or documents, or to keep content unrelated to its business there; (c) using the storage as a service for hosting, distributing or sharing files for the benefit of third parties. As React Box has no monitoring obligation, it acts upon a report or when an anomaly, in particular in volume, comes to its attention: it may then, after informing the organization's administrators, require the content concerned to be removed and, failing remedy within the time indicated, take the measures provided for in Article 19. The organization is accountable for its users' use of storage and ensures that its members comply with this rule. React Box is not liable for content uploaded in breach of this article, nor for its loss.
Article 13 — Acceptable use
You agree to use the service in accordance with applicable laws and regulations and with these terms. In particular, it is forbidden: to upload, store or distribute unlawful, infringing, defamatory or offensive content or content infringing the rights of third parties, or malicious software; to use the service for fraudulent purposes, in particular to issue false invoices or conceal transactions, or in breach of tax and accounting legislation, anti-money-laundering rules or personal data protection; to attempt to gain unauthorized access to the service or to other organizations' accounts or data, or to compromise its security, integrity or availability, in particular through unauthorized penetration testing, massive automated requests or circumvention of usage limits; to impersonate a person or an organization. Any breach may lead to the measures provided for in Article 19.
Article 14 — Artificial intelligence
Results produced by artificial intelligence — data extracted from a document, classification of an email, third parties and bank details created from a document, suggested accounting postings, proposals and answers from the Atlas assistant — are generated automatically and may be inaccurate or incomplete; this limitation is pointed out in the service. Items created automatically are flagged as such. The user must check each result before relying on it; no entry is finalized without their validation, and a result validated or used is so at their sole responsibility. Atlas provides no accounting, tax, legal or financial advice and does not replace a professional. React Box does not guarantee the accuracy, completeness or relevance of these results and accepts no liability for their content or for the consequences of their use.
Article 15 — React Box is not accounting software
React Box is a management, invoicing and collaboration tool; it is not accounting software. It does not keep the organization's accounts, produces neither its financial statements nor its tax and payroll filings, and does not replace the accounting software of the firm or the organization. The postings, reconciliations and validations made in React Box prepare the accounts: it is for the accounting firm — or, failing that, the organization — to check, validate and record each document, expense, receipt and invoice in its own accounting software, and to correct any errors. Before issuing an invoice, a credit note or a reminder, the user checks its content — mandatory mentions, numbering, quantities, prices, tax rates and amounts, totals, currencies; issuing it constitutes validation by the organization. The organization remains solely responsible for its invoices and documents, their compliance, its filings and meeting its tax, accounting and employment obligations, including with regard to electronic invoicing. The exchange rates, analyses, indicators and forecasts displayed by the service are provided for information purposes. The document vault is a storage space: it is neither an electronic archiving service with evidential value, nor a trust service within the meaning of Law No. 43-20 on trust services for electronic transactions, and it creates no presumption of reliability or integrity of the documents it contains. The organization must keep its own copies of its records, in particular through the export provided for in Article 20.
Article 16 — Programmatic access and authorized third parties
API keys and OAuth authorizations giving access to the MCP server are issued by the organization's administrators, under its responsibility. The organization is accountable for their use, for the trustworthiness of the applications, providers and agents it entrusts them to, and for revoking them in good time. Operations carried out with a valid key or authorization are deemed to be carried out by the organization. React Box is not liable for any access to, extraction, modification, deletion or disclosure of data carried out by a third party — provider, application publisher or automated agent — to whom the organization has entrusted a key, an authorization or credentials, nor for the security of that third party's systems.
Article 17 — Public share links
A public share link makes a document accessible to anyone who has it, within the date and password limits set by the user who creates it. Creating, distributing and revoking these links is the sole responsibility of the organization; React Box is not liable for a third party's access to a document through a valid link, nor for the use they make of it.
Article 18 — Availability, maintenance and changes to the service
React Box is bound by an obligation of means. The service is provided without any service level agreement (SLA): no availability rate, recovery time or response time is guaranteed. We use reasonable means to ensure the availability and integrity of the service and the data, without guaranteeing that the service will be available without interruption, error-free or suited to a particular need of the organization. The service may be interrupted, slowed down or degraded, in particular for maintenance, announced whenever possible, or because of a failure of a network or a third-party provider — hosting, database, email sending, notifications, artificial intelligence — whose operation React Box does not control. Unavailability, interruption, slowdown or degradation of the service, whatever its duration, gives rise to no compensation, refund or credit. However, if the service is completely unavailable for more than 15 consecutive days, excluding announced maintenance and force majeure, a subscribed organization may terminate its subscription in writing with immediate effect; this termination, without compensation, is its sole remedy for that unavailability. Any backups made by React Box or its providers serve the continuity of the service and are not a backup or restore service offered to the organization: the organization must keep copies of its data. React Box may change the service and add, modify or remove features; the removal of an essential feature included in the subscription is announced at least 30 days in advance.
Article 19 — Suspension and termination for breach
React Box may suspend without notice all or part of a user's or an organization's access: (a) in the event of a risk to the security, integrity or availability of the service or of other organizations' data; (b) upon a request or decision of an administrative or judicial authority; (c) in the event of a serious breach of these terms, in particular of Articles 12 and 13. For other breaches, suspension takes place after a formal notice that has remained unheeded for 15 days. Suspension for non-payment follows Article 5. If the breach is not remedied, React Box may terminate the organization's subscription or access, the amounts paid remaining due to it; what happens to the data follows Article 20. A suspension or termination carried out in accordance with this article gives rise to no compensation.
Article 20 — Reversibility and return of data
At any time, including during a suspension, the organization's administrators can export all of its data — vault documents and management data — as a downloadable archive, and each user can export their personal data. When the organization is suspended, whatever the cause — non-payment after the grace period, end of the trial without a subscription, cancellation reaching its effective date or breach of these terms —, its data is kept for at least 30 days from the suspension. Its administrators are informed by email on the day of the suspension, then 7 days and 1 day before the deadline, with the date from which it may be deleted and the means to export it. Settling the situation before the deadline lifts the suspension and cancels the deletion. From the deadline, the organization's data may be permanently deleted by React Box, at any time and without further notice; once deleted, it can no longer be recovered. The organization is solely responsible for the statutory retention of its accounting records, invoices and documents, in particular for ten years under Law No. 9-88 on the accounting obligations of traders and the General Tax Code: it must export them before the deadline, and React Box cannot be held liable for the loss of data deleted in accordance with this article. React Box keeps its own subscription invoices for the statutory period.
Article 21 — Liability
To the extent permitted by law, and save for its own fraud or gross negligence: (a) React Box's liability, for all causes and on all grounds combined, is limited, for a subscribed organization, to the amount excluding tax actually paid by the organization for its subscription and add-ons over the twelve months preceding the event giving rise to the damage, and, for an organization that pays nothing — accounting firm or business on trial —, to MAD 1,000; this cap applies to all claims combined; (b) React Box is in no event liable for indirect damage, such as loss of revenue, profit, customers or opportunity, damage to reputation, commercial loss, tax penalties, surcharges or reassessments; (c) React Box owes no compensation for any unavailability, interruption, slowdown or degradation of the service, the organization's sole remedy being the right of termination provided for in Article 18, for results produced by artificial intelligence (Article 14), or for the content of invoices, documents and calculations issued or validated by the organization and the accounting entries derived from them (Article 15); (d) in the event of unauthorized access, disclosure or leak of data, React Box can only be held liable if the organization establishes that the incident results directly from a breach by React Box of its own security obligations; its liability is excluded where the incident originates from the credentials, devices or actions of a user, administrator or member of the organization, the linked accounting firm, an API key, an OAuth or MCP authorization, a share link, or any third party to whom the organization has given access to its data or to the service; (e) React Box is not liable for loss or alteration of data attributable to the organization, its users or a third party, or that an export or copy of its data would have avoided; (f) React Box is not liable for damage resulting from the organization's content, from its users' use of the service, from a breach by the organization of its obligations, in particular as controller, or from the acts of a third party, the linked accounting firm or a share link recipient. The price of the service reflects this allocation of risk, which is a decisive condition of React Box's commitment.
Article 22 — Indemnity from the organization
The organization indemnifies React Box against any claim, action or demand by a third party — data subject, customer, supplier, employee, accounting firm or authority, in particular the CNDP or the tax administration — based on the organization's content, on its users' use of the service, on a breach of these terms or of its obligations as controller, or on a violation of the law or of a third party's rights. It compensates React Box for the resulting judgments, fines, costs and reasonable fees, provided it has been informed of the claim without delay and has been able to take part in its defense.
Article 23 — Force majeure
Neither party is liable for a failure caused by an event of force majeure within the meaning of the Dahir forming the Code of Obligations and Contracts, in particular a widespread failure of networks or of an infrastructure provider, a large-scale cyberattack not resulting from a breach by React Box of its security obligations, a natural disaster or a decision of a public authority. The affected obligations are suspended for the duration of the event; if it lasts more than 60 days, either party may terminate the subscription without compensation.
Article 24 — Changes to the terms
React Box may change these terms. Changes unfavorable to the organization are brought to users' attention, by email or in the application, at least 30 days before they take effect; this period does not apply to changes required by law, by an authority or by a security imperative, nor to those relating to a new feature. The new version must be accepted to keep using the service. An organization that refuses it may cancel its subscription; this cancellation is its sole remedy.
Article 25 — General provisions
These terms, the data processing agreement and, where applicable, the quote or activation invoice constitute the entire agreement between the parties on their subject matter and prevail over any general terms of the organization. If a provision is held void or unenforceable, it is deemed unwritten, the other provisions remain in full force and it is replaced by the valid provision closest to the parties' intent. React Box's failure to invoke a breach does not constitute a waiver of its right to invoke it later. React Box may assign or transfer the contract to any company that succeeds it or takes over all or part of its business, after informing the organization; the organization may not assign its rights without React Box's prior written consent. The provisions on intellectual property, liability, indemnity, evidence, what happens to the data and governing law survive the end of the contract.
Article 26 — Governing law and jurisdiction
These terms are governed by Moroccan law. Before any action, save for urgent measures, the party raising a dispute notifies the other in writing, and the parties seek an amicable solution for 30 days. Failing that, any dispute relating to their formation, interpretation or performance will be subject to the exclusive jurisdiction of the Commercial Court of Marrakech.