Privacy policy
Understand how Mouwaten handles personal data, what becomes public, and how to exercise your rights.
Last updated: November 8, 2026
Your privacy and the rights of people mentioned in contributions matter. This notice explains current processing, public anonymity, safeguards and the choices available to you. GDPR rights apply where that regulation governs the processing.
Who this policy covers
Mouwaten is a citizen-led initiative based in Tunisia. This notice covers visitors, account holders, contributors and people named in public-interest content. Contact the team using the address below for privacy questions or to exercise your rights, even without an account. The controller’s full legal name and postal address have not yet been provided for publication. The contact is the platform’s existing security contact; it is not presented as an appointed data protection officer.
Data collected and its sources
You may provide a phone number, name, email, profile photo, language preference, reports, evaluations, comments and attachments. Identity verification involves private identity documents; approval may be required for reports and comments under current participation settings, while ratings without comments do not require it. The service also processes session and device information, push notification registration, security events and moderation records. With location permission, coordinates can resolve your governorate and nearby content. Public directory information and people mentioned in contributions may come from directory records and other contributors.
Purposes and legal bases
Personal data supports sign-in, account management, requested civic contributions, identity review, location features, service messages, moderation and security. Where the GDPR applies, each purpose requires a lawful basis: contract only when necessary for the requested service; consent for optional processing; a specific legal obligation where applicable; or legitimate interests supported by a documented assessment of necessity and people’s rights. Device permission alone does not establish every legal basis. The operator has not yet supplied the confirmed purpose-by-purpose basis or additional conditions for sensitive data. Contact the team for clarification before submitting unnecessary sensitive information.
Public contributions and private information
Published contributions and permitted attachments can be viewed and copied by others. Reports have a private original for their author and authorized reviewers and a separate public text version with detected personal details masked. Incomplete preparation holds the report for review; evidence remains private when personal information is detected or privacy checks are incomplete. Anonymous publication limits public author details but keeps the account link internally. Automated masking cannot detect every identifier, especially inside files. Please remove unnecessary personal information before submitting and contact the team if a publication affects your privacy.
Recipients and international transfers
Authorized reviewers and support staff access information needed for their duties. Hosting, storage, authentication, messaging, push notification and map providers may process service data. When AI screening is enabled, report text prepared with local masking and evaluation-comment text are sent to OpenAI for safety and contextual checks; this text pipeline does not send identity documents or proof media. Local detection can miss identifiers, so avoid unnecessary sensitive details. The operator has not yet supplied a verified list of hosting countries, provider retention and international-transfer arrangements. Where GDPR transfer rules apply, an appropriate transfer mechanism and safeguards are required; a policy statement alone does not establish them. You may request information about recipients and safeguards through the contact below.
Retention and deletion
Account information, identity files, contributions, moderation records, logs and backups serve different purposes and require separate retention limits. Retention must be limited to what is necessary for those purposes or a specific legal duty, with removal or anonymisation when justified. Exact approved periods and backup removal schedules have not yet been supplied by the operator. An export or deletion request starts a review; submitting it does not immediately erase every record. Legal obligations, the rights of others or lawful evidence preservation may limit deletion. The response to a request should explain any retained categories, reasons and applicable periods.
Cookies, browser storage and location
The website uses an authentication refresh cookie and browser storage for language preferences. The mobile app stores refresh credentials in platform secure storage and keeps access credentials in memory. Clearing storage may sign you out or reset preferences. You can withdraw location and notification permissions in your browser or device settings and manage push preferences in the app. Location-dependent features need permission for precise coordinates. Any additional non-essential tracking needs separate assessment and consent where required.
Your rights and choices
Where the GDPR applies, you may request access, correction, erasure, restriction of processing and, when the conditions are met, data portability. You may object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Rights are subject to legal conditions and the rights of others. You can update profile information in your account and submit export or deletion requests through the privacy dashboard.
Requests and complaints
Use the privacy dashboard for export or deletion requests, or contact the team for other rights and questions. Do not send identity documents with an initial email; proportionate identity checks may be needed. Where the GDPR applies, a response is normally due within one month. A permitted extension of up to two further months must be explained within the first month. You may lodge a complaint with the competent supervisory authority, including in the EU country of your habitual residence, workplace or the alleged infringement.
Security and automated decisions
Access controls, protected sessions, private document access and recorded reviews support security, without eliminating online risks. Automated checks can allow text to proceed, mask detected report details or hold a contribution privately for human review. Unavailable or uncertain required checks prevent immediate publication. Models do not ban accounts; authorized staff make restriction decisions. Held comments and their ratings do not contribute to public scores until approved. You can read feedback, explain your position and contact the team for human reconsideration. Where Article 22 of the GDPR applies, the protections concerning decisions based solely on automated processing with legal or similarly significant effects must be respected.
Children and sensitive information
Please avoid submitting unnecessary information about children or sensitive details such as health, beliefs or identity documents in public contributions. Contact the team if you believe a child’s data or other sensitive information requires review. Any processing involving children must respect applicable age and parental-consent requirements; the platform’s eligibility arrangements should be confirmed with the team before a child registers.
Changes to this policy
The date shown on this page identifies its latest publication. Material changes to processing require an updated notice and appropriate communication to affected people where applicable. Publishing a new notice does not replace consent or another legal requirement. This notice is available in English, French, Arabic and Tunisian Arabic; use the language menu to select a version.