Privacy policy — Best Crédit

Best Crédit · September 2026 Document drawn up in the light of Organic Law no. 2004-63 of 27 July 2004 on the protection of personal data and of the requirements of the INPDP.

1. Data controller

STE YASA DE DEVELOPPEMENT DIGITAL SARL — Avenue Farhat HACHED, Sidi Abdelhamid, 4000 Sousse Médina, Tunisia — unique identifier: 1680871H. Personal data contact: contact@best-credit.net.

2. Data collected

• Account: full name, email address, phone number (verified by SMS), borrower profile (employee, retiree, student, company…), pension scheme where applicable.
• Financing requests: type, preferred financing regime (conventional, Sharia-compliant, or no preference — a financial product preference, visible on the anonymised listing; the platform never treats it as belief-related data and derives no profiling from it), amount, declared total project cost (the resulting financed share is visible on the anonymised listing), term, governorate and delegation (official list of La Poste Tunisienne — visible, like the governorate, on the anonymised listing), purpose, status, date of birth (retiree profile only — visible in the file summary, to assess age; never on the anonymised listing); guarantor (name, relationship, optional phone — with no identity number whatsoever) for the student profile.
• Supporting documents: documents uploaded depending on the profile — proof of income, professional certificates, bank statements, student card, guarantor's file (no copy of any identity document), articles of association and financial statements for legal entities —, stored in a private space; excluding any official public document (ID card, passport, commercial register extract), which are not collected (circular no. 5 of 2 September 2026).
• Funders: name, category, institution regime, KYB verification elements, authorised members (email, role); submitted offers (regime, amounts, credit rate or margin, processing fee, profit sharing where applicable, and the effective rate excluding insurance — computed and retained for the sole purpose of the excessive-rate pre-check, Law no. 99-64).
• Offers and decisions: offer contents, shortlists, acceptances, access grants and revocations (logged).
• Messaging: message content (with automatic masking of contact details until the full file is opened), PDF attachments, reports.
• Compliance: results of screening against international sanctions lists (score, lists concerned).
• Technical data: error logs, push notification tokens, language preference, email deliverability events (bounces, complaints).

3. Purposes and legal bases

• Providing the service: anonymised publication of requests, receipt and comparison of offers, messaging, notifications (performance of the terms of use).
• Securing: one-time code authentication, 2FA, logging of sensitive access, prevention of abuse and fraud.
• Meeting legal and due-diligence obligations: sanctions screening, rate checks against the BCT caps (Law no. 99-64), retention of moderation records.
• Communicating: transactional emails strictly related to account activity (no marketing without consent).

4. Who sees what — the confidentiality matrix

By default, a request is visible to verified funders in anonymised form (no name, no contact details). The declared summary (country of residence, income currency, scheme where applicable, declared monthly income — annual turnover for a legal entity) and then the full file (identity, contact details, guarantor, documents read-only via temporary links) are only opened to a given funder upon the borrower's explicit decision; sharing documents is itself a choice, declined by default at submission — without that consent the full file cannot even be requested; every decision is logged and revocable at any time with immediate effect — the platform itself never grants such access on the borrower's behalf. A granted access applies to the funder's organisation, whose team is managed by its own admins (every addition, removal or role change is notified to the person concerned). Access also ends automatically when the request concludes: acceptance of an offer (for the funders not selected), withdrawal by the borrower, or expiry after 90 days without an offer — every end of access is logged and notified. Accepting an offer opens the full file to the selected funder alone and exchanges mutual contact details. Best Crédit collects neither official public documents (national identity card, passport, commercial register extract — Head of Government circular no. 5 of 2 September 2026) nor any identity number (ID card number, commercial register, tax identification): the financial institution that needs one asks you directly through messaging — which opens as soon as you grant access (summary or full file) or an offer is made. Documents can be scanned with the camera: capture, cropping, enhancement and assembly into a PDF all take place locally on your device, without recourse to any third-party service — only the final PDF is uploaded, through the same channel as files chosen from storage. Best Crédit neither sells nor rents any personal data.

5. Recipients and processors

Data is processed by technical providers acting on Best Crédit's instructions:

Message translation: upon the user's explicit request (the “Translate” button on a bubble), the text of that message — already stripped of contact details — is sent to Anthropic to be translated, then displayed beneath the original. Nothing is stored, no translation is passed to the other party, and the feature never triggers on its own.

6. Retention periods

• A file's documents and messages: erased 12 months after it closes (acceptance, withdrawal, expiry or rejection) — and immediately if you delete a draft; replacing a document purges the previous version.
• Access grant/revocation logs and handled reports: 5 years (evidence) — a report still open is kept until it is handled.
• Account inactive for 3 years: deleted if it holds no business data, anonymised otherwise (public identity and phone erased).
• Cookie choice: 6 months.
• These purges are automated daily; technical logs follow short and proportionate periods.

7. Security

Data partitioning through database access rules (RLS); encryption of exchanges (TLS); private storage spaces with time-limited signed links; two-step verification (2FA TOTP) with a reinforced requirement on sensitive actions and the administration panel; logging of administrative actions; automatic masking of contact details in messaging; email suppression list in case of bounces.

8. Your rights

In accordance with Law no. 2004-63, you have rights of access, rectification, objection and erasure regarding your data. To exercise them: contact@best-credit.net (response within a reasonable time; proof of identity may be requested). You may also refer any complaint to the INPDP (National Authority for the Protection of Personal Data).

9. Cookies and local storage

Best Crédit uses no advertising cookies and no third-party trackers. Only the following are used: session cookies (Supabase authentication), the language preference (NEXT_LOCALE) and a few strictly functional local counters (e.g. the app-install prompt). These elements are necessary to run the service.

10. Updates

This policy may change along with the service and the regulatory framework. The applicable version is the one published on this page; substantial changes are notified by any appropriate means.

Last updated: September 2026 · Questions: contact@best-credit.net.

Authoritative version: the French version of this document is authoritative. The Arabic and English translations are provided for convenience; in the event of any discrepancy or dispute over interpretation, the French version alone shall prevail.