Privacy Policy

ALC Connect is a communication app operated by the American Language Center Rabat ("ALC," "we," "our," or "us"), located at 4, Rue Tanger, Hassan, Rabat, Morocco. ALC is the data controller (responsable du traitement) for personal data processed through the App.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the ALC Connect mobile application ("the App"), in accordance with Moroccan Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data and applicable international privacy regulations.

ALC Connect is designed for a mixed audience — it is used by adults and minors, including children under 13, in a supervised educational environment.

By using ALC Connect, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

2.1 Information You Provide Directly

• Full name (first and last name)
• Email address (required for staff; optional for students)
• Phone number (optional)
• Date of birth
• Student ID (assigned by ALC)
• Profile photo / avatar (optional)
• Password (securely encrypted — never stored in plain text)
• Messages (text messages, images, and documents shared within the App)
• Announcements (content created by instructors, coordinators, and administrators)

2.2 Information Collected Automatically

• Device token for push notification delivery
• Device platform (iOS or Android)
• Authentication session data (stored on-device only)

2.3 Information We Do NOT Collect

• Precise geolocation or GPS data
• Device advertising identifiers (IDFA, GAID)
• Browsing history or web tracking data
• Contacts or address book
• Health, fitness, or biometric data
• Financial or payment information
• Cookies or third-party tracking on the App

We use the information we collect to:

• Authenticate users and manage accounts
• Enable messaging between authorized users (coordinators, instructors, students, parents) per role-based rules
• Deliver announcements from staff to targeted audiences
• Send push notifications for new messages and announcements
• Display user profiles within the App (name, role, avatar)
• Manage academic records (enrollment, groups, levels, schedules)
• Link parent accounts to student accounts for communication
• Administer user accounts (activation, deactivation, password resets)

We do not use your information for advertising, behavioral profiling, or any purpose unrelated to the educational communication services described above.

ALC Connect is used by students who may be under 13 years of age. We take the privacy of children seriously and comply with applicable children's privacy laws.

• Student accounts are created by ALC administrators through bulk import — students do not self-register.
• Parent accounts may be linked to student accounts; parents register through a verified process using their child's credentials.
• We collect only information necessary for educational communication (name, student ID, birthday, messages).
• Children cannot publicly share personal information — messaging is restricted to instructors and coordinators only. Students cannot message other students.
• We do not serve behavioral advertising or interest-based profiling to children.
• We do not include social features beyond role-restricted messaging.
• Parental consent is obtained through the enrollment process at ALC — account creation is performed by ALC staff with parental knowledge.
• Parents can review their child's information by contacting ALC administration.
• Parents can request deletion of their child's data (see Section 11).

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Your data is only accessible to:

• ALC staff and administrators — within their authorized scope and role-based access
• Users you communicate with — directly through the App's messaging features
• Service providers (limited, necessary for App operation):
  • Cloud hosting providers — secure server infrastructure and database hosting
  • Push notification services — message and announcement delivery to your device
  • Cloud storage providers — file storage for message attachments and profile photos
  • Email delivery services — transactional emails for password reset codes only

All service providers process data only as needed to provide their services and are bound by their own privacy policies.

We may disclose information if required by law, legal process, or to protect the safety of users.

• Data is stored on secure, encrypted servers with industry-standard protections
• Database connections are encrypted (SSL/TLS)
• Passwords are securely hashed — never stored in plain text
• All communication uses HTTPS/TLS encryption in transit
• Authentication sessions expire automatically and require periodic re-authentication
• Files are stored in private cloud storage with access-controlled URLs
• Access controls: role-based permissions enforced at the server level

6.1 International Data Transfers

Your data may be processed and stored on servers located outside of Morocco, including in countries within the European Union and the United States. These transfers are necessary for the operation of the App and are conducted with appropriate security measures in place, including encryption in transit and at rest.

By using ALC Connect, you consent to the transfer of your data to these locations for the purposes described in this policy.

While we take reasonable measures to protect your data from unauthorized access, no method of transmission or storage is 100% secure. We continuously review and improve our security practices.

• Active accounts: Data is retained as long as the account is active and the user is enrolled at ALC.
• Deactivated accounts: Data is retained for up to 12 months after deactivation, then eligible for deletion.
• Messages: Retained for the duration of the active academic session; may be purged at ALC's discretion.
• Device tokens: Automatically cleaned up when invalid or when a user logs out.
• Password reset codes: Expire shortly after issuance and are not stored after use.

Users may request earlier deletion of their data (see Section 11).

Under Moroccan Law No. 09-08 and applicable privacy regulations, you have the right to:

• Access (droit d'accès) — Request a copy of personal data we hold about you
• Correction (droit de rectification) — Request correction of inaccurate information
• Deletion — Request deletion of your account and associated data
• Opposition (droit d'opposition) — Object to the processing of your personal data on legitimate grounds
• Portability — Request your data in a portable format
• Withdraw consent — Disable push notifications in device settings; request account deactivation

For parents of minors: All of the above rights apply to your child's data. Contact ALC administration to exercise these rights on behalf of your child.

To exercise any of these rights, contact us at the details provided in Section 12. We will respond within 30 days.

You also have the right to file a complaint with the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) if you believe your data protection rights have been violated.

• We use platform-standard push notification services provided by Google (Android) and Apple (iOS).
• Notifications are sent for new messages and new announcements.
• You can disable notifications at any time in your device settings or in the App settings.
• We store only the minimum device identifier necessary for delivery. No notification content is stored by third-party services.
• Disabling notifications does not affect other App functionality.

ALC Connect may contain links to external websites (e.g., alcrabat.org). We are not responsible for the privacy practices of external sites. We encourage users to read the privacy policies of any external sites they visit.

You may delete your account directly from the App:

1. Open Settings in the App and tap Delete Account.
2. Review the information about what happens to your data.
3. Select a reason for leaving (this helps us improve).
4. Confirm with your password to submit the deletion.

11.1 What Happens After You Confirm Deletion

• Your account enters a 14-day grace period. During this time, you can continue using the App normally.
• After the 14-day grace period, your account is automatically and permanently deleted. No staff approval is needed — the process is fully automated.
• You can cancel the deletion at any time during the 14-day grace period from the App's Settings screen.

11.2 What Data Is Affected

When the deletion is processed (automatically after 14 days):

• Permanently erased: name, email, phone number, profile photo, date of birth, student ID, password data, login sessions, and device tokens.
• Anonymized (retained): messages remain in conversations with the sender shown as "Deleted User." Announcements stay visible with an anonymized author. Enrollment records are retained in anonymized form for ALC's academic record-keeping.

Once processed, deletion is permanent and cannot be undone. Your account will be locked and you will no longer be able to log in.

11.3 Alternative Methods

If you cannot access the App, you may request deletion by contacting ALC administration directly (see Section 12). Include your full name and the email or Student ID associated with your account.

11.4 Minors

Parents or guardians may delete their own account from the App. To request deletion of a child's account, contact ALC administration with the child's name and Student ID. ALC will verify the relationship before processing.

For full details, see our Account Deletion page.

For privacy inquiries or to exercise your data protection rights:

• Organization: American Language Center Rabat
• Address: 4, Rue Tanger, Hassan, Rabat, Morocco
• Phone: +212-537-761-269
• Email: rabat.inquiry@acamorocco.org
• Website: alcrabat.org
• App support: alc.bensaid.dev/support

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. Material changes will be communicated via in-app announcement.

Continued use of ALC Connect after changes are posted constitutes your acceptance of the updated Privacy Policy.