Terms of service

1. Who these terms are between#

These Terms of Service (the “Terms”) are the agreement between you, the person or organisation holding a Gheima account (“you”), and Gheima (“we”, “us”). They apply every time you create an account, deploy a service, or pay an invoice.

Gheima is operated by Omar BAABOUJ, an auto-entrepreneur registered in Morocco under Loi 114-13 in the Registre National de l'Auto-Entrepreneur, ICE / RNAE no. 003706803000143. An auto-entrepreneur is a natural person, not a company, and is not entered in the Registre de Commerce, so there is no RC number to quote.

If you are agreeing to these Terms for a company, a school or any other organisation, you confirm you are allowed to bind it, and “you” means that organisation.

2. What Gheima provides#

Gheima is a platform-as-a-service. You connect a Git repository, we build it into a container image and run it on our infrastructure behind HTTPS on a subdomain of gheima.ma or on a custom domain you control. Around that we provide managed Postgres, MySQL, MongoDB, Redis, object storage, search and queue instances, cron jobs, preview environments, logs, metrics and alerts.

We may add, change or withdraw individual features. Where a change removes something you are actively relying on, we will tell you before it takes effect and, where we reasonably can, give you a way to move off it.

3. Your account#

• You must give an accurate email address and keep it reachable. It is how we send sign-in links, invoices and incident notices.
• You are responsible for everything done under your account, including by team members you invite and by API keys you issue.
• Keep your credentials to yourself. We strongly recommend enabling two-factor authentication; on team accounts an owner can require it.
• Tell us promptly if you believe an account, an API key or a deploy token has been compromised so we can revoke it.

Accounts have roles. Owners and admins can see billing, manage members, reveal environment variables and delete resources; the audit log records who did what and when, and those records are kept as accountability evidence.

4. Acceptable use#

You may run essentially any lawful workload on Gheima. You may not use it to:

• break Moroccan law, or the law that applies to you or to the people your service reaches;
• host or distribute malware, phishing pages, or content that impersonates a person or an organisation;
• send unsolicited bulk email, or use our outbound mail relay for anything you do not have consent to send;
• attack, scan or attempt to gain unauthorised access to other tenants, our infrastructure, or third parties;
• mine cryptocurrency, run distributed proxy or VPN exit nodes, or otherwise consume shared capacity in a way that degrades other customers;
• circumvent plan limits, metering, or the isolation between accounts;
• send sustained traffic far past your plan's bandwidth allowance with no overage budget. Past five times the allowance, or three times on Free, we may limit it after telling you.

We do not routinely inspect the contents of your containers, databases or buckets. We do act on abuse reports, on automated signals such as sustained outbound scanning, and on lawful orders.

5. Your code and your content#

Your code, your data and everything your application produces remain yours. Nothing here transfers ownership.

To run your service we need a narrow, practical licence: permission to fetch your repository, build it, store the resulting image in our registry, run it, replicate it for scaling and previews, back it up, and show it back to you in logs and consoles. That licence exists only so the platform can do its job, lasts only as long as you keep the resource, and covers nothing else. We do not use your code or your data to train models, and we do not share it with anyone except the sub-processors listed in our Sub-processors page.

6. Plans, prices and billing#

Prices are published on our pricing page in Moroccan dirhams (MAD), and the published price is the amount charged: nothing is added at checkout. Gheima is operated by an auto-entrepreneur, who is exempt from Moroccan VAT (TVA) under article 91-II-3° of the Code général des impôts, as a natural person whose annual turnover is below 500,000 dirhams: invoices carry no TVA amount, they state the exemption instead, and no TVA is reclaimable on them. If that ever changes (for instance if the business converts to a company), we will say so here first, and it will apply to invoices issued from that date onward, never retroactively.

• A plan is paid in advance for its period: monthly, or for a longer period where the checkout offers one, at the price shown for it.
• No card is ever charged without you. The Moroccan payment gateways we use cannot store a card, so every card payment is one you make, and we remind you by email before the current period ends: at least a month ahead for a plan paid for longer than a month, and a week ahead for a monthly one. A period renews on its own only if you turn on auto-renew: the next period is then paid from credit already in your prepaid wallet, and only when that credit covers it.
• On a plan, usage past what it includes is never billed afterwards. It can only be paid from credit you have already put in your prepaid wallet, up to a monthly overage budget you set, as section 7 describes. Metered billing, which our team switches on only at your request, works differently: depending on what is agreed with you, usage is paid from your wallet as it accrues or invoiced after the month closes.
• Invoices are issued to the billing email on the account and are available in the dashboard.

If a period ends without a payment, we email you a renewal notice and open a 14-day grace window, shown in the dashboard. For those 14 days your plan stays as it is and nothing of yours is paused. If the window passes without a payment, the account moves to the Free plan. Your data is not deleted, and paying for a plan again restores it. Anything over the Free plan’s limits can no longer be created or changed until then.

7. Usage metering#

Your plan includes monthly allowances of bandwidth and build minutes, and paid plans also include storage: on current plans one pool shared by buckets, managed databases and persistent volumes. CPU and memory are never metered on a plan: they are bounded by your plan’s service size and memory pool. On the Dev, Pro, Team and Agency plans you can go past a usage allowance up to a monthly overage budget you set, and only that overage is charged, from your prepaid wallet, at the rates shown on the Billing page. The budget starts at 0 MAD, which makes every allowance a hard limit, and the wallet never goes below zero. On the Free and School plans allowances are always hard limits. Outbound traffic from the Morocco region is metered on its own: it counts against your plan’s bandwidth allowance, and traffic past it is charged at the Moroccan rate under the same budget rules. Usage is read from the platform’s own telemetry and shown in the dashboard as it accrues.

When an allowance is used up and no budget or credit is left: new builds are not started, new uploads to object storage are refused, and on a plan with a storage pool so are new buckets, databases and volumes, while everything stored stays readable and deletable and databases and volumes keep accepting writes, and outbound traffic keeps flowing without being charged. Nothing is deleted or stopped. Your overage budget is your spend limit: we alert you at 80% and 100% of each allowance and of the budget, and can never charge more than the budget or your wallet balance, whichever is lower.

8. Cancelling and refunds#

You can cancel at any time from the dashboard. Cancellation takes effect at the end of the period you have already paid for; we do not pro-rate a partial month, and we do not refund a period you have used.

A first yearly plan is the exception: if it is not what you wanted, write to us within 14 days of paying and we will refund it in full. After those 14 days a yearly plan is not refunded, but you can move to a cheaper plan at any time and keep the value of the time you paid for.

Founding 30 accounts get a longer window. The first 30 accounts to pay for a plan before 1 February 2027 can ask for a full refund within 30 days of that first payment, whether the plan is monthly or yearly. Write to hello@gheima.ma and we refund the whole payment.

Withdrawal. If you buy as a consumer, the law gives you 7 days from your purchase to withdraw from it, without giving a reason and without penalty (loi 31-08, art. 36). A plan starts the moment you pay for it, so at checkout we ask you to agree to that immediate start; once you have agreed and the plan has started, the 7-day right of withdrawal no longer applies to it (art. 38). If you bought a plan without giving that agreement, you can still withdraw within the 7 days and we will refund it. Credit you top up in your prepaid wallet is different: within 7 days of a top-up, write to hello@gheima.ma and we will refund the part of it you have not spent, without delay and within 15 days at most.

If we suspend or terminate your account for a reason that is our fault (for example we withdraw a feature you had paid for), we will refund the unused part of the period. If we terminate it for a breach of section 4, we will not.

9. Regions and data residency#

Every resource you create belongs to one region and stays in it. The region is chosen at creation and never changes: moving a workload across a border is a redeploy plus a data migration, not a setting. New resources on every plan go to the ma-1 region (Casablanca, Morocco) by default.

Workloads in the ma-1 region carry a data-residency commitment. What it covers is precise, and we would rather be precise than impressive: it covers your customer data at rest in that region (application containers, managed databases, object-storage buckets, snapshots and build inputs). The control plane, which is the dashboard, the platform database that holds resource metadata and encrypted configuration, and the audit log, is not tied to the region of your workloads: it serves every account from one place. Since 21 September 2026 that place is Casablanca, Morocco, in the ma-1 region, whichever region your workloads are in. Which keys can decrypt which secrets is stated in our Privacy Policy and in the Data Processing Agreement.

10. Availability and support#

We publish live platform health on our status page. We aim for high availability and we design for it, but we do not currently offer a contractual uptime SLA with service credits. If and when we do, it will be a separate document referenced here.

We perform maintenance that can cause brief interruptions, and we try to schedule anything disruptive outside Moroccan business hours. Support is by email, in Arabic, French or English.

11. Suspension and termination#

We may suspend a service, or an account, where there is a serious and immediate problem: an active attack coming from your workload, a legal order, a payment that has gone unpaid past its grace period, or a breach of section 4. Where the situation allows it we contact you first; where it does not (an in-progress attack, for instance), we act first and explain immediately afterwards.

When you close an account, we soft-delete it and destroy live credentials straight away: sessions are revoked, connected Git tokens and two-factor secrets are cleared. The account then sits in a grace window of thirty days during which we can restore it. After that it is hard-purged: managed databases, buckets, search and queue instances and their volumes are deprovisioned for real, and the account record is deleted. Encrypted backups can still contain the data for up to fourteen more days before they age out.

12. Third-party services#

Gheima connects to services we do not control. GitHub is reached through a GitHub App you install; GitLab through an access token you paste for your own instance. Payments run through our payment provider, named in the privacy policy. Email is sent through our relay. Using those connections means accepting their providers’ terms too, and we are not responsible for their acts or outages, though we will tell you when one of them is why something of ours is broken.

13. Warranties#

We provide the platform with reasonable skill and care. Beyond that, and to the extent the law allows, we provide it “as is”: we do not warrant that it will be uninterrupted, error-free, or fit for a purpose you have not told us about. Nothing in this section limits rights you have as a consumer that cannot be limited.

14. Limitation of liability#

Neither side limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.

Subject to that, and to the extent the law allows: neither side is liable to the other for indirect or consequential loss, loss of profit, loss of goodwill, or loss of data that the affected party could have prevented by keeping its own backups; and our total liability to you in any twelve-month period is capped at the amount you paid us in that period.

15. Changes to these terms#

We will update these Terms as the platform changes. Every version carries a version number and a date, and the current one is always at this address. For a change that materially reduces your rights or increases your obligations, we will notify you by email at least thirty days before it takes effect; continuing to use the platform after that date means you accept the new version.

16. Governing law#

These Terms are governed by Moroccan law. Any dispute we cannot settle between us goes to the competent courts of Casablanca, Morocco. If you are a consumer resident elsewhere, this does not deprive you of the protection of mandatory rules of your own country.

17. Contact#

Write to hello@gheima.ma. For anything about personal data specifically, see the Privacy Policy, which sets out the same address and the process we follow.