Subprocessors
We use no advertising network, no analytics tool, no behavioural tracking service and no payment provider. The list below is therefore short, and deliberately so: every provider added is one more surface of risk.
What this page covers
A subprocessor is a provider that processes personal data on our behalf and on our instructions. Listed below are those involved in running https://apotheca.ma and the Apotheca application. Each is contractually bound to confidentiality and to appropriate security measures.
List of subprocessors
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | DNS records, site delivery, web application firewall and abuse protection for apotheca.ma, app.apotheca.ma and api.apotheca.ma. Also provides the anti-robot check (Turnstile) on the contact and demo forms. | IP address, request headers and metadata, edge logs. For the anti-robot check: IP address and technical browser signals, with no identification of the person. | United States (global network) |
| Cloudflare R2 | Storage of marketing site media and of images uploaded in the application (marketplace offers, announcements, forum). | Image files and their metadata. Objects are served publicly through a dedicated domain. | United States (bucket region configurable) |
| Hetzner Online GmbH | Hosting for the virtual private server carrying the site, the API, the PostgreSQL database and the Redis cache, through the Coolify orchestrator administered by the publisher. | All site and application data. | Germany (European Union) |
| Hetzner Online GmbH - object storage (legacy) | Former storage for images and supporting documents, predating the migration to Cloudflare R2. Nothing is written there any more; some addresses recorded before the migration may still point to it. | Image files and documents uploaded before the migration. | Germany, Falkenstein (European Union) |
| Zoho Corporation - ZeptoMail | Delivery of service emails: password resets, two-factor authentication codes, subscription notifications, and notification of enquiries received through the website forms. | Recipient's email address, message subject and body, delivery metadata. | United States (account data centre); headquartered in India |
| Google LLC - Geocoding API | Deriving city and country from the IP address on each login attempt, so that the login history is meaningful and unusual access can be flagged. | IP address of the person signing in. | United States |
What we do not use
It seems just as useful to say what is not on this list. Neither the site nor the application includes:
- any analytics or visitor statistics tool;
- any advertising network, conversion pixel or cross-site tracker;
- any online payment service - subscriptions are settled by bank transfer;
- any live chat platform, third-party CRM or prospecting tool;
- any generative AI service that data would be sent to;
- any third-party error tracking or session replay tool.
Transfers outside Morocco
Site and application data is hosted in Germany, within the European Union. The other providers above operate from the United States.
Either way this is a transfer outside Morocco, which articles 43 and 44 of law no. 09-08 make subject to CNDP authorisation. That authorisation has not yet been obtained as at the date of this page; it will be recorded here when it is.
Changes to this list
This list is updated whenever a provider changes. Client pharmacies are notified by email before a subprocessor handling application data is added, in accordance with their agreement.
For any question about this list, write to [email protected]. The processing itself is described in our privacy policy.