Privacy Policy

1. Our Position on Privacy

At 4YA, data sovereignty is not a compliance checkbox — it is a core architectural principle embedded in every system we design, operate, and deliver. The same commitment we apply to client infrastructure governs how we handle data on our own platform: minimum collection, maximum residency control, zero dependency on foreign inference pipelines for sensitive workloads.

This policy applies to all personal data processed through https://4ya.ma.

2. Legal Framework

4YA SARL AU operates under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, and complies with the regulatory requirements of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

This site does not rely on GDPR or any foreign data-protection statute as its compliance baseline. Our legal obligations and your rights as a data subject are defined exclusively by Moroccan law.

3. Data Controller

4YA SARL AU
Apt 15, IM 12, Lot Sine, Avenue Allal El Fassi
Marrakech, Kingdom of Morocco
[email protected]

4. Data Collected & Legal Basis

4.1 Technical Brief Submission (Contact Form)

When you submit a project inquiry through our site, we collect the following data:

Legal basis: Legitimate interest of 4YA SARL AU in evaluating project fit, and pre-contractual steps taken at the request of the data subject (Law 09-08, Art. 4).

4.2 Edge & Security Logs

Cloudflare's edge infrastructure processes network-level metadata (source IP, request timestamps, user-agent strings) strictly for security, anti-abuse, and performance purposes. This processing is technical in nature and does not feed into any application-level profiling or CRM.

5. How We Use Your Data

Data submitted through the contact form is used solely for:

1. Technical qualification — assessing whether your project aligns with 4YA's current capacity and domain expertise
2. Direct architect response — enabling our principal architect to provide a relevant, personalised reply within 48 hours
3. Pre-contractual engagement — structuring an initial architecture proposal if the fit is confirmed

What we do not do with your data:

• We do not sell, lease, or share it with third parties for commercial purposes
• We do not use it for unsolicited marketing or automated profiling
• We do not feed it into any external AI inference pipeline
• We do not transfer it outside Moroccan jurisdiction without explicit consent

6. Sovereign AI Engine

4YA operates private AI runtimes on secured local infrastructure within Morocco. These runtimes include open-weight model families (DeepSeek, Qwen, Phi-class and equivalent stacks) deployed on-premise or on AWS Wavelength Zone Casablanca.

For all workloads processed within this sovereign perimeter:

• Inference is executed locally — no data is sent to OpenAI, Anthropic, Google, or any foreign inference SaaS
• Model weights, fine-tuning artefacts, and output logs remain within Moroccan territory
• There is no operational dependency on US or EU inference providers within the chain we architect and control

This applies equally to internal tooling (Workspacy runtime) and to client-facing deployments built on our infrastructure.

7. Data Residency

All personal data submitted through https://4ya.ma is stored and processed on infrastructure physically located within the Kingdom of Morocco:

Primary: AWS Wavelength Zone — Casablanca (Amazon Web Services facilities on Moroccan soil)
Secondary / equivalent: On-premise servers or contractually controlled environments within Moroccan territory

The Cloudflare edge layer — while global — processes only network-level metadata required for secure site delivery. Application data and form submissions are not persistently stored outside Morocco.

8. Data Retention

9. Data Security

4YA SARL AU applies the following security measures to personal data under its control:

• Encryption in transit: TLS 1.3 across all client-server communication
• Encryption at rest: AES-256-GCM for stored application data
• Key management: HSM-backed key handling within Moroccan infrastructure
• Access control: Zero Trust architecture — no standing access, mTLS between internal services
• Audit logging: Cryptographically signed, immutable audit trail for all data access events

10. Your Rights Under Law 09-08

As a data subject under Moroccan law, you are entitled to exercise the following rights with respect to your personal data held by 4YA SARL AU:

• Right of access — obtain a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to object — oppose processing based on legitimate interests, subject to 4YA SARL AU's overriding operational grounds
• Right to erasure — request deletion of your data, where no legal retention obligation applies

To exercise your rights: send a written request to [email protected], clearly identifying yourself and specifying the right you wish to exercise. We will respond within the timeframes prescribed by Moroccan regulatory requirements.

11. Complaints & Regulatory Authority

If you believe 4YA SARL AU has not adequately respected your rights under Law 09-08, you may lodge a formal complaint with:

Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)
Kingdom of Morocco
www.cndp.ma

We encourage you to contact us directly at [email protected] before escalating to the CNDP — most concerns can be resolved promptly at source.

12. Policy Updates

This privacy policy may be updated periodically to reflect changes in our infrastructure, services, or applicable regulations. The date at the top of this document reflects the most recent revision. Continued use of https://4ya.ma following a policy update constitutes acceptance of the revised terms.

---

4YA SARL AU — Marrakech, Kingdom of Morocco — [email protected]

Architected for Law 09-08 & CNDP compliance — Data residency: 🇲🇦 Morocco