Connector privacy notice
How information is used when you connect IYYAJP to an AI application
1. What this notice covers
This notice explains the information used when you connect your IYYAJP account to ChatGPT, Claude, or another supported AI application through the IYYAJP connector. It covers connector use and the sign-in needed for it; it does not describe every separate account, billing or website feature.
SIMULATOR ONLINE operates this connector. Contact us about connector privacy at [email protected].
2. How the connection works
You sign in on IYYAJP and explicitly approve a named application’s read-only access. The application receives a separate, revocable OAuth credential. It does not receive your IYYAJP password or website session cookie through this flow.
The connector searches published decisions and retrieves selected decision text, abstracts, chamber/topic information and source links. It can return Arabic and an available, current French version already stored on the platform. It does not edit, publish or delete decisions, import files, access unpublished decisions, or generate a new translation. Your account status, subscription access and shared reading limits apply.
3. Information processed and why
| Category | Examples | Purpose |
|---|---|---|
| Account and entitlement information | Internal user ID, email address, role, organization association, account/subscription status and language preference | Identify the account, display the account approving access, and check whether a request is permitted |
| Connection and authorization records | Application ID/name and callback; approved scope; account-linked grant; approval, expiry and revocation information; credential digests | Create the connection, authenticate requests, rotate credentials and revoke access |
| Tool inputs and returned content | Search keywords, selected filters, requested language, decision IDs and page positions; selected decisions and abstracts | Find and deliver the material you requested to your chosen AI application |
| Activity and limit records | The first 80 characters of a search term on the first search page, viewed decision IDs, account email and event times; account-based request/read counters | Maintain platform search/read activity, usage reporting and shared limits, and investigate misuse or service problems |
| Network, login and security information | Request timing, route/status information, security events, IP-related rate-limit information and browser/security signals where applicable | Operate the service, protect sign-in and detect abusive requests. For connector calls, a network address may belong to the AI provider rather than your own device |
The complete search term is processed to perform a search; the activity entry described above stores only its first 80 characters. Do not include passwords, authentication codes, payment-card details, government identifiers, confidential client facts or other unnecessary personal information in a search.
The connector’s tools do not request full chat transcripts, memories or uploaded files. An AI application may derive a tool input from your conversation, so information you put into a search can still reach IYYAJP. The connector itself makes no AI-model call to answer your question or translate a decision.
Published decisions have been processed for anonymization. If you identify remaining personal information, send the decision link or ID and a short description to our contact address; avoid sending an entire sensitive document unless an appropriate channel is arranged.
4. Who receives information
Your chosen AI provider receives the search results and decision sections returned to its requests, including relevant metadata, abstracts and citation URLs. That provider processes this material under the terms and privacy settings applicable to your AI account or organization. Its retention, training and sharing settings are separate from IYYAJP’s.
Review the relevant OpenAI privacy information and Anthropic privacy information, including the version or business agreement applicable to your region and account. This notice does not promise how either provider will retain or use content.
The service uses OVHcloud hosting and Cloudflare network/security services. Cloudflare Turnstile is used in the website’s protected sign-in flow where enabled. These providers may process service data needed for their functions. See Cloudflare’s privacy policy and its Turnstile privacy addendum. The infrastructure providers process information under their applicable service terms and privacy information. See OVHcloud’s personal-data information.
5. International processing
IYYAJP uses OVHcloud hosting and Cloudflare network/security services. These services and your chosen AI provider may process information outside Morocco or your country. The AI provider’s processing locations depend on the service, account and agreement you use. Contact us for information about IYYAJP’s hosting and service-provider arrangements. This notice does not represent a claim of a particular regulatory approval or transfer authorization.
6. Retention and credential expiry
Credential validity and storage duration are different. Expiry or revocation stops authorization; it does not immediately erase every related record or backup.
| Information | Current retention and expiry |
|---|---|
| Pending authorization | The request expires after 10 minutes. Expired requests become eligible for the database cleanup described below. |
| Authorization codes | A code can be used once within 5 minutes. Its stored digest becomes eligible for cleanup 30 days after expiry, to retain replay-security evidence. |
| Access credentials and grants | Access credentials last up to 1 hour; grants and refresh credentials last up to 30 days from approval and can be revoked earlier. Credential digests remain until their grant has expired and cleanup removes them. Cleanup runs in bounded batches when new clients register or new authorization requests start, so there is no fixed physical-deletion deadline. |
| Request-limit counters | The background worker’s daily cleanup removes counter events older than one day. This cleanup is separate from search/read activity records. |
| Account, application-registration and search/read activity records | There is currently no fixed automatic deletion period for these records. They may remain after a connection or subscription ends until they are removed administratively, including in response to an applicable privacy request. |
| Infrastructure logs | The website access log is rotated at approximately 20 MiB. It retains up to five rotated files, with rotated files older than 90 days removed when log rotation runs. The current active log can remain until rotation; these settings do not guarantee that every log entry is erased after 90 days. Other application/container logs do not currently have a fixed automatic deletion period configured by IYYAJP. Cloudflare’s own records follow the applicable Cloudflare service arrangements. |
| Backups and support correspondence | Backups can retain copies after removal from the active service. There is currently no verified fixed automatic deletion schedule covering all deployment backups or support correspondence; these records remain subject to administrative retention and applicable obligations. |
To request access, correction or deletion, use the contact details below. A request may need to be assessed against security, contractual or legal retention requirements. IYYAJP cannot erase copies already received by your AI provider; use that provider’s controls for those copies.
7. Security and website cookies
The connector uses HTTPS, per-account authorization and a read-only scope. Opaque access/refresh credentials and authorization codes are stored as digests rather than their raw values. Where a registered application uses a client secret, the stored secret is encrypted. Shared reading limits and account/subscription checks remain in force.
Signing in and approving a connection use the platform’s existing session cookie and security controls. Turnstile can process browser and network signals for bot protection; its published addendum explains its own processing. The connector’s authenticated tool calls do not ask the AI application to solve a browser CAPTCHA. The IYYAJP sign-in cookie is named tok_session and currently has a maximum browser lifetime of 24 hours. Signing out clears it, and the session may become invalid earlier. The website can also remember language and display preferences in browser local storage until you change or clear them. Cloudflare’s own security-cookie behavior is described in its privacy information.
8. Your controls and requests
You can decline a connection or revoke it through IYYAJP’s connection-management screen. Revocation stops that grant from authorizing future access. You can also disconnect in your AI application. Disconnecting does not cancel your IYYAJP subscription or erase content already delivered to an AI provider, a chat, an export or a backup.
To ask about your information, access it, correct it, or exercise an applicable objection or deletion/blocking right, contact [email protected]. Explain the request and identify the relevant account or decision. Identity verification may be needed; do not send a password or connector credential. Requests will need to be assessed under the applicable law and any relevant retention obligations.
Where applicable, you may raise a privacy concern with the Moroccan CNDP or another competent data-protection authority. Your rights and any retention exceptions depend on the applicable law.
9. Updates
The effective date is shown at the top of this page. Updates to this notice will be published here with a revised date. Contact us if you need information about a change that affects your use of the connector.