1. Who we are
IciFlixy is a mobile top-up service for Algerian numbers (Mobilis, Djezzy, Ooredoo), operated by M&A Tech, Paris, France. M&A Tech is the data controller for the personal data described in this policy.
This policy applies to the iciflixy.com website and the IciFlixy mobile apps for iOS and Android (together, the "Service").
For any question about your data: contact@iciflixy.com.
2. Data we collect
We only collect what we need to deliver your top-up.
Data you provide
- Orders: the phone number to top up, the operator, the chosen plan or amount, and your email address.
- Support: your name, email address, order number and the content of your message when you contact us.
Payment data
Payments are processed directly by our payment providers. We never receive or store your card number, expiry date or security code. We only keep the amount, currency, payment method, status and transaction reference.
Data collected automatically
- Technical data: IP address, browser or device type, and the date and time of requests, recorded in our server logs.
- Strictly necessary cookies: see Cookies.
What we do not collect
The Service does not require a customer account. We do not access your location, contacts, photos or microphone, we do not use advertising identifiers, and we use no advertising or tracking tools.
3. How we use your data
| Purpose | Data | Legal basis |
|---|---|---|
| Send the top-up to the number you entered | Number, operator, plan | Performance of a contract |
| Collect the payment | Amount, payment reference, email | Performance of a contract |
| Send the receipt and order updates | Email, order details | Performance of a contract |
| Answer your requests and handle claims | Name, email, message, order | Contract and legitimate interest |
| Prevent fraud and secure the Service | Technical data, payment data | Legitimate interest |
| Meet our accounting and tax obligations | Orders and payments | Legal obligation |
We do not sell your data and do not use it for advertising or profiling.
4. Who we share your data with
Your data is only shared with the providers needed to run the Service:
- Stripe — card, Google Pay and Apple Pay payments. Stripe acts as an independent controller for payment data (Stripe's policy).
- OneClickDZ — delivers top-ups to the operators and processes CIB / Edahabia card payments. Receives the number, operator, plan and order reference.
- Mobile operators (Mobilis, Djezzy, Ooredoo) — receive the topped-up number and amount.
- Google — sends transactional emails (Gmail) and serves display fonts (Google Fonts).
- Our hosting provider — stores data on our servers.
- Authorities — only when required by law.
When you pay with Google Pay or Apple Pay, Google or Apple also process data under their own privacy policies.
5. Transfers outside the European Union
An Algerian top-up necessarily involves sending the number and plan to our partners in Algeria (OneClickDZ and the operators). This transfer is necessary to perform the contract you enter into with us (Article 49(1)(b) GDPR).
Stripe and Google may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Orders and accounting records: 10 years, as required by accounting law (Article L123-22 of the French Commercial Code).
- Support requests: 3 years after our last exchange.
- Server logs: 90 days at most.
- Session cookie: 120 minutes after your last activity.
After these periods, data is deleted or anonymised.
7. Security
All communication with the Service is encrypted (HTTPS). Payments are handled by PCI DSS certified providers, and access to data is limited to the people who need it to process your orders. No system is completely secure, but we take reasonable measures to protect your data.
8. Your rights
Under the GDPR and Algerian Law No. 18-07 on personal data protection, you have the right to:
- access your data and get a copy of it;
- have it corrected if it is inaccurate;
- ask for it to be deleted;
- restrict or object to certain processing;
- receive your data in a structured format (portability).
To exercise these rights, email contact@iciflixy.com. We reply within one month. You may also lodge a complaint with the CNIL (France) or Algeria's National Authority for the Protection of Personal Data (ANPDP).
9. Deleting your data
The Service does not create customer accounts, so there is no account to delete in the app. To have the data linked to your orders or support requests erased:
- email contact@iciflixy.com with the subject "Delete my data", or use our contact form;
- include the email address and/or phone number used for your orders;
- we confirm the deletion within 30 days.
Data we are legally required to keep (accounting records) is archived and isolated until the legal period ends, then deleted.
11. Children
The Service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy to reflect changes to the Service or the law. The date of the last update is shown at the top of this page. If a change is significant, we will say so clearly on the website.
13. Contact us
M&A Tech — Paris, France
Email: contact@iciflixy.com
Form: iciflixy.com/contact