Karizma Pay — Privacy policy
Karizma Pay (employees and companies) and Karizma Pay Commerçant (partner shops) — iPhone and Android
In short. Karizma Pay gives employees and companies in Morocco a payment account, cards, transfers, expense reports and gift cards. Payment accounts are opened and held by a payment institution licensed by Bank Al-Maghrib, Karizma Pay’s partner. We use your data only to run your account, to meet our legal obligations (identity checks, anti-money-laundering) and to keep the service secure. No advertising, no tracking across apps, no sale of data.
Who is responsible
KARIZMA CONSEIL SARL, Florida Centre Park 2, lot 6, 4th floor, office 34, Sidi Maârouf, 20520 Casablanca, Morocco — publisher of the Karizma Pay apps and service. For the payment account itself (opening, identity checks, transactions), the partner payment institution is also responsible for the data it processes under its licence. Contact: support@karizma.ma — +212 522 103 925.
What we process
| Information | Why | Who receives it |
|---|---|---|
| Identity and contact: name, mobile number, e-mail, employer or company, role | To create and secure your account, to send sign-in codes and notices | Karizma Pay; the payment institution; your employer for the company space you belong to |
| Identity check (KYC): identity document and a selfie taken in the app; for a company (KYB): legal documents and the people in charge | Legal obligation of the payment institution (know your customer, anti-money-laundering) | The identity document and selfie are captured by a specialised identity-verification provider working for the payment institution. They do not go through or stay on Karizma Pay’s servers: Karizma Pay receives only the result (level reached, accepted or refused). Company documents are sent to the payment institution; those it does not take are kept in your company file |
| Account and payments: balance, operations, beneficiaries, cards (masked number), gift cards, cash boxes, scheduled transfers | To execute and show your operations, prevent fraud, answer complaints | Karizma Pay; the payment institution; for business accounts, the people your company authorises |
| Expense receipts (photos or files) you add | To create your expense report; optional automatic reading (OCR) to pre-fill it | Karizma Pay and your employer. The OCR service is run by Karizma; the receipt is not kept there and the reading job is deleted after one day |
| Partner shops (Karizma Pay Commerçant): shop, stores, shop phones and their rights, gift-card redemptions and sales | To pair the shop’s phones, take gift-card payments and pay the shop | Karizma Pay; the payment institution; the shop’s administrators |
| Device: device identifier, a public key created on the phone, platform and app version, push notification token | To recognise your phone, sign sensitive operations and send notifications | Karizma Pay; Apple or Google (and Expo) only to deliver notifications |
| Security logs: dates, IP address, actions on the account | Security, fraud prevention, proof of operations | Karizma Pay |
| Support requests and complaints | To answer you | Karizma Pay; the payment institution when the request concerns it |
On your phone
- Face ID or fingerprint: checked by your phone’s system only; the app receives “yes” or “no”, never your biometric data.
- Camera: identity check, photos of receipts, scanning payment and gift-card QR codes — only when you use these features.
- Photos and files: only those you choose to attach.
- Sign-in tokens and the device key are kept in the phone’s secure storage (iOS Keychain, Android Keystore).
The apps do not use your location or your contacts, contain no advertising, no analytics and no crash-reporting component, and do not track you across apps or websites.
Where the data is kept
Karizma Pay’s servers are run by Karizma on a cloud infrastructure (Google Cloud). Some providers named above (identity verification, notifications) may process data outside Morocco; these transfers are made under the conditions of law 09-08 and the contracts that bind those providers.
How long
- Identity-check results, operations and account records: 10 years after the account is closed, as required by anti-money-laundering rules.
- Security and audit logs: 10 years.
- OCR reading jobs: 1 day. Notification tokens: until you sign out or the phone is removed.
- Demonstration data: deleted or anonymised after 90 days.
Deleting your account
- Karizma Pay: Profile › Delete my account. If your payment account (wallet) is still open, empty it and close it first from My wallet › Close my wallet; the app guides you.
- Karizma Pay Commerçant: Account › Delete the merchant account (shop administrator phone). Our team settles the balance and the open gift cards, then closes the shop account, its phones and its accesses.
- Or write to support@karizma.ma from the e-mail or phone number of the account.
Once the account is closed, your access, devices and notification tokens are removed. The data that the law requires us to keep (identity check, operations) is kept for the period above, then deleted.
Your rights
Under Moroccan law 09-08 you can ask to access, correct or object to the processing of your data by writing to support@karizma.ma. You can also contact the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel). Complaints about a payment can be raised with us, then with Bank Al-Maghrib.
Age
Karizma Pay accounts are reserved for adults (18 and over).
Changes
We will show any important change in the app before it applies.
Last updated: October 27, 2026