loader
Zaame: Free School Management Software | Sign Up

Privacy Policy

Home Privacy Policy

Last updated: April 16, 2026

This Privacy Policy describes how BAYE Conception, publisher of the Zaame application, collects, uses and protects users’ personal information.

Publisher’s contact details:
BAYE Conception
47 Bd Mohammed Ben Abdellah, Résidence Belle Vue, 6th floor, No. 1 – Casablanca, Morocco
Email: [email protected]

1. Collection of personal data

We collect the following information when you use the Zaame application or website:

  • Identification information: last name, first name, email address, phone number, etc.
  • Login and usage information: IP address, device type, pages viewed, etc.
  • School management information: lists of students and teachers, grades, report cards, attendance, etc.
  • Payment data: payment method chosen (card, Mobile Money, etc.), transaction session ID, amount, status and date of payment. Bank card numbers and Mobile Money identifiers are never stored by Zaame.
  • Mobile phone numbers: collected for Mobile Money payments (PawaPay, CinetPay, Pesapal) to initiate transactions.
  • Files and documents: files uploaded by users (profile pictures, course documents, assignments, files attached in the chat).
  • Messages and conversations: content of messages exchanged through the internal messaging and the class session chat.
  • User preferences: display theme (dark or light), language, settings.
  • Attendance data: students’ attendance status at sessions.
  • Any other information you choose to provide through our forms.

2. Use of data

Your personal data is used to:

  • provide and manage our educational services;
  • personalize the user experience;
  • ensure security and prevent fraud;
  • communicate with you for service-related reasons;
  • answer your requests and provide technical support;
  • comply with our legal obligations;
  • process school payments through the third-party payment providers configured by the institution;
  • make communication between users easier (messaging, session chat);
  • generate documents (PDF report cards, Excel exports, QR codes);
  • send service-related notifications and alerts (payment reminders, report card publication, grade updates, payment confirmations);
  • manage two-factor authentication (2FA) by email.

3. Visibility of and access to data by BAYE Conception

As publisher and technical host of the Zaame platform, BAYE Conception has technical access to all hosted data for maintenance, debugging and support purposes. However, BAYE Conception contractually undertakes not to view, use or disclose institutions’ internal data (accounting, grades, results, message content) except in the following cases:

  • technical support explicitly requested by the institution;
  • corrective maintenance requiring access to the data;
  • legal or judicial obligation.

Any access is logged and limited to what is strictly necessary.

Google services

Zaame integrates some Google services, such as:

  • Google Meet, to let teachers hold virtual classes;
  • Google sign-in (OAuth), to let users sign in easily with their Google account.

Information obtained through these services (such as name, email address or Google ID) is used only to:

  • authenticate the user;
  • make it easier to create Google Meet meetings from Zaame.

No Google data (messages, files, contacts, etc.) is stored, shared or used by BAYE Conception. Access is strictly limited to the data needed for the integrated features to work and requires the user’s explicit consent.

Security and compliance

BAYE Conception applies advanced security measures to ensure the confidentiality and protection of all data hosted on Zaame, in accordance with the General Data Protection Regulation (GDPR) and Google’s privacy policies.

4. Retention period

Data is kept for as long as necessary to use the service, then archived or deleted in accordance with legal requirements.

5. Data sharing

We neither sell nor rent your personal data. We may share your information only with:

  • our hosting providers: o2switch (or other trusted partners) for server hosting;
  • third-party payment providers, solely to process transactions:
  • Google, for OAuth authentication and the Google Meet and Google Calendar integration;
  • legal authorities, if required by law;
  • registered educational institutions, only for the intended use.

Each payment provider is subject to its own privacy terms. Only the data strictly necessary to process the transaction is transmitted (amount, currency, transaction ID, payer’s email and/or phone number).

6. Security

We implement technical and organizational measures to protect your data against unauthorized access, loss, alteration or disclosure:

  • passwords are stored in hashed form (irreversible algorithm);
  • two-factor authentication (2FA) by email is available to strengthen account security;
  • communications between the browser and our servers are encrypted with HTTPS/TLS;
  • uploaded files are stored on secure servers, with access control per institution.

Payment data (card numbers, Mobile Money identifiers) never passes through Zaame’s servers and is processed directly by PCI-DSS certified providers.

6a. Payment data

6a.1 For online payments (Zaame subscriptions and school payments), sensitive banking data (card numbers, CVV codes, Mobile Money identifiers) is collected and processed exclusively by certified payment providers and is never stored on Zaame’s servers.

6a.2 Zaame only keeps the following transaction metadata:

  • payment session ID;
  • amount and currency;
  • transaction status (pending, paid, failed, refunded);
  • date and time of payment;
  • payment method used (card, Mobile Money, etc.).

6a.3 This metadata is kept for a period consistent with applicable accounting and tax obligations (at least 10 years for accounting records in Morocco).

6a.4 Refund requests are processed through the original payment provider. Zaame does not make any direct transfer of funds.

7. User rights

In accordance with the GDPR and applicable laws, you have the following rights:

  • access to your data;
  • rectification of your data;
  • deletion of your data;
  • restriction of or objection to processing;
  • portability of your data.

To exercise your rights, contact us at: [email protected].

7a. Data deletion and portability

a) Account deletion: any user can request the deletion of their account and personal data by writing to [email protected]. Deletion takes effect within 30 days.

b) Deletion by the institution: the institution can delete the data of its students, teachers and parents directly from the administration interface.

c) End of subscription: if a subscription is not renewed, the institution’s data is kept for 6 months after expiry, then permanently deleted. The institution can request an export of its data before that deadline.

d) Messages and files: session chat messages can be deleted by their author within 5 minutes of sending. After that, they remain visible to the session’s participants.

8. Cookies and similar technologies

We use cookies to improve the user experience and analyse traffic. You can manage your preferences in your browser settings. Zaame uses the following technologies:

  • Session cookies: required for the application to work (authentication, user session);
  • browser local storage (LocalStorage): display preferences (dark or light theme, language);
  • Service Worker: installing the application (PWA) and notifications.

9. Transfers outside the European Union

Where data is transferred outside the European Union, we ensure that appropriate safeguards are in place in accordance with applicable law. Some data may be transferred outside the European Union in the following cases:

  • payments via Stripe: data processed in the United States (Stripe is certified under the EU-US Data Privacy Framework);
  • payments via African providers (CinetPay, PawaPay, Paystack, Fawry, PayMob, Flutterwave, Pesapal, PayFast): data processed in the providers’ respective countries;
  • Google services (OAuth, Meet, Calendar): data processed in the United States (Google is certified under the EU-US Data Privacy Framework).

Zaame is hosted on servers located in France (o2switch).

For transfers to countries without a level of protection recognized as adequate by the European Union, we ensure that Standard Contractual Clauses (SCCs) or equivalent mechanisms are in place.

10. Changes to this policy

We may update this Policy at any time. Changes are published on our website and in the application, with a revised update date.

11. Contact

For any question about this Privacy Policy or your personal data, you can write to us at: [email protected].