Privacy Policy
We write it in plain language, because a policy nobody understands is not a policy. Last updated: 7 October 2026.
Who we are
- BASNETZ (basnetz.com and the BASNETZ apps for Android and iOS) is the service that stores and processes the data described here. The platform is operated from Algeria.
- For any question about your data, write to us from the contact page. The same page handles access, correction and deletion requests.
What we collect
- Account data: your email address or phone number, your name, and a hashed password we never see. Phone numbers may be verified by a one-time code sent by SMS or WhatsApp.
- Your page data: what you write yourself — name, field, services, prices, photos, opening hours, location, postal or bank account numbers you choose to publish for payments. This is data you publish deliberately, to be seen.
- Requests, bookings and orders: the name, phone number, message, address and order details sent by whoever wants a service. Only the page owner concerned sees them.
- Clinic files: when a clinic uses the platform, its patient files — name, phone, visit notes, diagnosis, prescriptions and documents — are health data. They belong to the clinic, which is responsible for them; we store and protect them on its behalf.
- Students and children: schools and trainers keep seats, attendance, homework, results and certificates. A child's seat is registered by a parent or guardian, from the guardian's own account.
- Payments: amount, method, receipt photo you upload for a transfer, and the reference returned by the card gateway. We never see your full card number: card payments happen on the SATIM gateway.
- Messages inside a group: what a teacher and their students write to each other in a group's space.
- Reviews, reports, contact-form messages and newsletter subscriptions you send us.
- Device data: the push-notification token of your phone if you turn notifications on, the language of your device, and technical logs (IP address, browser, time) kept briefly for security.
- Usage statistics: how many visits a page gets and how many contact clicks, counted without identifying the visitor, and only when the visitor has accepted that in the consent bar.
Why we use it
- To run the service: show your page, deliver requests and bookings, open seats, issue certificates and prescriptions, and process the payments you start.
- To keep you informed: emails and notifications about what happens on your page or your seat — never advertising.
- To keep the platform safe: preventing abuse, spam and fraud, and keeping records that the law requires for payments.
- To improve the platform, using aggregate numbers that do not identify anyone.
Device permissions
- Location: only when you tap “near me” in search, to sort results by distance. It is not stored.
- Microphone: only when you record your pronunciation in a language lesson. The recording is processed on your device and is not uploaded unless you choose to send it.
- Camera and photos: only when you scan a QR code or upload a photo or a payment receipt.
- Notifications: only after you turn them on in the app. You can turn them off at any time in the app settings or in your phone settings.
- Face ID, fingerprint or phone code: to lock the app if you enable the lock. Nothing biometric leaves your phone.
What we do not do
- We do not sell your data or your customers' data to anyone.
- We do not place third-party ads and we do not use advertising trackers that follow you across sites or apps.
- We do not read your calls or WhatsApp conversations — those happen between you and your customer, outside the platform.
Who sees what
- Your published page is public by nature — that is its purpose. What you put in it is visible to everyone and may be indexed by search engines.
- Your unpublished page (draft) is visible to nobody but you.
- Requests, appointments, orders, patient files, seats and hidden reviews are visible only to the page owner concerned and, where relevant, to the customer, patient or student they belong to. This is enforced at the database level, not in the interface.
Who we share it with
- Service providers who process data on our behalf, under contract and only for the purpose stated: Supabase (database, files and authentication), Vercel (hosting), SATIM and the CIB network (card payments), Algérie Poste (postal transfers), Google Firebase Cloud Messaging and Apple Push Notification service (delivering notifications to your phone), our email and SMS/WhatsApp delivery providers (sending codes and notifications).
- Video lessons may be embedded from YouTube or Vimeo; those services receive your IP address when a video loads.
- Public authorities when the law requires it.
- Nobody else. No data broker, no advertising network.
How long we keep it
- Your account and page data: as long as your account exists. Deleting the account deletes them.
- Requests, bookings and orders: as long as the page they were sent to exists.
- Payment records: kept as the law on commercial records requires, without your name once your account is deleted.
- Security logs: a few weeks. Statistics: as aggregate numbers only.
- Contact-form messages and newsletter subscriptions: until you ask us to remove them.
Children and students
- BASNETZ is not aimed at children. Opening an account requires being at least 16 years old; publishing a page requires being an adult.
- A child can only hold a seat in a school or trainer's group, registered by a parent or guardian from the guardian's account, who sees the child's progress and manages the seat.
- If you believe a child has created an account by themselves, write to us and we will delete it.
Your rights
- You can edit any detail on your page at any time.
- You can hide your page with one click and it becomes a draft nobody sees.
- You can export your data from Settings, and ask us to correct anything you cannot change yourself.
- You can object to a use of your data, or complain to the Algerian data-protection authority (ANPDP) if you believe your rights were not respected.
- You can delete your account and its data permanently, yourself, at any time — see “Delete your account” below.
Delete your account
- From the website or the app: sign in, open Settings, then “Delete my account” at the bottom of the page, and type your username to confirm.
- Deletion is immediate and final: your page, its services, photos and reviews; the groups and courses you own alone; your bookings, requests, messages, notifications and the files you uploaded.
- Payment records are kept without your name, because the other party's accounts need them. Groups you teach for a school stay with the school.
- If you can no longer sign in, write to us from the contact page and we will delete the account for you.
Hosting and security
- Data is stored with our database provider (Supabase) with encrypted connections, in the European Union.
- Whatever identifies a patient or describes their health in clinic files — name, phone, diagnosis, prescription — and what a visitor writes when booking, is encrypted on our server before it reaches the database provider, with a key the provider does not hold. Someone who reads the database, or a copy of it, reads nothing of it; and a record altered outside the platform shows up as altered instead of being read as true.
- Permissions are enforced by row-level policies: one account cannot reach another account's data even if it tries.
Applicable law and transfers
- This policy follows Algerian law 18-07 on the protection of natural persons in the processing of personal data.
- Our providers host data outside Algeria (European Union and United States), under contracts that bind them to protect it.
Changes
- When this policy changes materially, we tell you on the site or by email before the change applies, and we update the date at the top.