Privacy Policy

1. Who is responsible for your data?

The operator of Slek is responsible for processing the data of your account (identity, sign-in, business profile). Its legal identity and contact details are given in the Legal information page.

For the data of your own clients and suppliers that you enter in Slek, you decide how it is used and you remain responsible for it; Slek only processes it to provide you with the Service, on your instructions.

2. The data we process

Account: your name, e-mail address and password (kept as an irreversible hash, never readable), as well as your language and notification preferences.

Sign-in with Google: if you choose “Continue with Google”, Google sends Slek your name, your e-mail address and the indication that this address is verified. Slek does not receive your Google password, does not keep your photo and has no access to your mailbox or contacts. Google processes your sign-in on its own side under its own privacy policy.

Business profile: the activity name, address, phone number, tax identifiers (NIF, NIS, tax article, trade register, auto-entrepreneur card), the CCP or RIP details you choose to show, and your logo.

Your activity: invoices, quotes, purchase orders, delivery notes, credit notes, payments, expenses, articles, reminders and notifications, as well as the PDFs and CSV journals archived at your request.

Your clients and suppliers: the name, address, e-mail, phone number and tax identifiers you enter about them.

Activity log and errors: the important actions taken in your account (sign-up, creating or changing documents, exports…) and the application’s errors, with their date. This log is used for security and support.

Contact messages: the name, e-mail address and text you send through the contact form; they are forwarded to the team by e-mail.

Payments: the identifier and amount of the Chargily Pay transactions linked to your plan or your invoices. Slek neither receives nor keeps your card number.

Technical data: your IP address may be used temporarily to limit abuse (for example on the contact form); it is not attached to your profile. Page speed: your browser sends Slek, with no cookie and no identifier, speed measures (display time, page stability, responsiveness) together with the name of the page visited and the type of screen (phone, tablet, computer); they are added up into anonymous statistics to improve the Service, are attached neither to you nor to your account, and your IP address is only used to limit the number of submissions (it is not kept).

Connected devices: to limit each account to a number of devices (2 by default), each browser receives a random identifier kept in its local storage, and for each device we record its identifier, its browser and system type (deduced from the User-Agent header), its IP address, and the dates of first sign-in and last activity. You see this list in Settings → “Connected devices” (IP address partly masked) and can disconnect a device; an e-mail warns you when a new device signs in. A device with no activity for the period you choose (15 days, 30 days, 60 days or 1 year) no longer counts and is disconnected.

3. Micro-importer profile (suitcase trade)

If you turn on the micro-importer profile in the Settings, Slek also processes: your national identity number, your tax identification number and your BEA foreign-currency account reference (encrypted before they are stored: only the last four characters remain readable in the application), the number and expiry date of your self-entrepreneur card, your CASNOS number, the references of your general import authorisation, your trips, the goods and purchase invoices attached to them, your prepared declarations, your customs receipts, your stock, your sales (with the name, address and NIF of your customers that you enter) and your numbered ledger.

This data is used to check the conditions of executive decree 25-170, to prepare your declarations, labels, delivery notes and invoices, and to keep your simplified accounts. Slek prepares and tracks your declarations but does not file them: the legal filing is made on the ANAE platform.

The purchase invoices and photos of the paper register pages that you attach are kept in a private space that only you can read. Slek e-mails you when your general authorisation or card is about to expire (60, 30 and 7 days before, then once it is over), unless you turn e-mail alerts off in the Settings.

Each refusal by a rule and each warning is recorded in a compliance log attached to your account; the application uses it to show a risk banner (90-day period). Slek’s administration sees your compliance status (authorisation, card, trips of the month, warnings) but never your amounts, purchases, stock or ledger.

Accounting records are kept as long as your account exists, so that you can meet the 6-year retention obligation; the ledger is append-only (a mistake is corrected with a reversing entry). You can at any time export this data, erase your encrypted identifiers or delete your account, which erases everything else.

4. Why we use it

Your data is used to create and secure your account; to produce your documents, calculations and reports; to send the e-mails you trigger (invoices, reminders) and those tied to your account (welcome, password reset, summaries and reports that you can switch off in Settings); to process payments; to answer your messages; and to detect abuse and fix errors.

Slek does not send advertising, does not sell your data and measures the audience of its public pages only through Google Tag Manager (see “Audience measurement” below).

These processing operations are necessary to provide the Service you ask for, for its security and to meet the operator’s legal obligations. Where a processing operation will need your consent, it will be requested separately and clearly, and you will be able to withdraw it.

The box ticked at sign-up only confirms acceptance of the Terms of Service; on its own it is not your consent to all the processing described here.

5. Who can access your data

Your data is accessible to you, to the members you invite (read-only) and, as far as needed for support and security, to the Service’s administrators, whose console shows account information, the plan, the recent list of documents (number, type, status, date) and the activity log.

Technical providers process data on the operator’s behalf: the hosting of the database and files (Supabase, installed on the operator’s infrastructure), the e-mail sending service (SMTP) and the payment provider Chargily Pay. They only have access to the data needed for their task. Google (Google Tag Manager, for audience measurement) acts under its own terms: see “Audience measurement” below. If the operator has entered a WhatsApp number, clicking the “WhatsApp” button opens the WhatsApp service (Meta): Slek sends it nothing before that click. Their exact list and location will be specified by the operator before the Service opens to the public.

The e-mails you send to your clients from Slek contain the information of your document and are received by the recipients you choose. Data may also be disclosed at the request of a competent authority.

6. Your logo: publicly readable storage

Your business logo is saved in a publicly readable storage space so that it can appear on your invoices. Anyone who knows the file’s address can therefore see it without signing in. That address contains a technical account identifier; logos are not publicly listed.

Only add a logo you are happy to make public, with no personal data or confidential information. The image is re-encoded before it is stored (any metadata it carried is removed). You can replace or delete it at any time in Settings; it is also deleted with your account.

Your other files (archived PDFs, CSV journals) are in a private space, accessible only to your account.

7. How long we keep it

Your data is kept as long as your account is active. When you delete your account (Settings → “Delete my account”), your profile, clients, documents, payments, expenses, reminders, notifications, activity log, the list of your connected devices, archived PDFs and CSV journals and your logo are erased, together with your sign-in identifier.

If the operator makes technical backups, they may contain this data for a limited time before being deleted; the operator will specify that period.

Please note: regulations may require you to keep your accounting and tax documents for a minimum period. Export your data before deleting your account and ask your accountant for advice.

Messages sent through the contact form are kept in the team’s inbox for as long as needed to deal with your request.

8. Your rights

Under law No. 18-07, you have a right to information, a right of access, a right of rectification and a right to object on legitimate grounds concerning your personal data.

In the application you can view and edit your information (Settings and the relevant sections), export your data in JSON format (Settings → “Export my data”) and delete your account (Settings → “Delete my account”).

For any other request, write to us using the contact form on the Legal information page, stating the e-mail address of your account. You can also refer the matter to the national authority for the protection of personal data (ANPDP).

If your data is in the client file of a Slek user, address your request to that user first: they are responsible for that data.

9. Security

Each account is isolated: the database rules prevent a user from reading another user’s data. Passwords are kept as an irreversible hash, the content of uploaded files is checked, and archived documents are stored in a private space.

Any installation open to the public must encrypt connections (HTTPS): that depends on the hosting configuration. No system is infallible, so choose a long, unique password and report any incident to us. In the event of a data breach likely to affect you, the operator will inform the people concerned and the competent authority as the law requires.

10. Transfers outside Algeria

Data is hosted where the operator installed the Service. Google, which provides Google Tag Manager, processes measurement data on its own servers, which may be outside Algeria. If a provider (for example for sending e-mails) processes data outside Algeria, that transfer only takes place under the conditions set by law No. 18-07, in particular authorisation from the competent authority and an adequate level of protection. The country of hosting and the providers concerned will be stated before the Service opens to the public.

11. Cookies and local storage

Slek uses no advertising cookies. Your browser only keeps items needed to operate: your sign-in session, this device’s random identifier (see “The data we process”), your language, your theme, your chart type and the announcements you closed. You can clear them in your browser settings; you will then have to sign in again. Fonts are served by Slek itself, without calling a third-party service.

Audience measurement: Slek loads Google Tag Manager, a Google service, only on its public pages (presentation, contact, legal notice, terms and privacy), never in the signed-in area, the administration console or the sign-in and sign-up pages, and only if you are not signed in. It lets the operator measure traffic and use of the Service (pages viewed, origin, clicks). Depending on the configuration chosen by the operator, Google may receive your IP address and information about your browser, and set measurement cookies. Slek’s own code does not send the content of your documents to Google; what the Google container reads or sends depends on how the operator configures it. You can block these trackers in your browser or with an extension, without any effect on how the Service works. The tools actually enabled and their retention period will be specified by the operator before the Service opens to the public.

12. Changes

This policy may change, in particular when the operator adds a provider or a processing operation. The version date is shown at the top of the page; if a change is important, you will be told.

13. Contact

For any question or request about your data, use the contact form on the Legal information page.

Open the contact form