Privacy Policy

Moramara ("we", "us", "our") operates the booking platform available at moramara.com. We connect travellers with surf, yoga, hiking, and accommodation experiences across Morocco. Our registered address is in Morocco.

For any privacy-related enquiries, contact us at support@moramara.com.

We collect the following categories of personal data:

• Account data - name, email address, password (hashed), profile photo. If you choose to sign in with Google, we receive the following data from Google via the OAuth 2.0 service: your Google Name (to display on your profile), your Google Email Address (to identify your account and send booking confirmations), and your Google Profile Picture (to personalise your account avatar). We request only the minimum scopes necessary: openid, email, and profile. We do not access your Gmail, Google Drive, Google Calendar, or any other Google service.
• Booking data - activity or accommodation selections, dates, guest counts. The booking deposit is paid through PayPal (see section 5) and the balance directly to the partner; we do not collect or store your card or PayPal account details.
• Communication data - messages exchanged with hosts or our support team.
• Usage data - pages visited, clicks, scrolling, session duration and session recordings (with cookies only if you accept analytics, see section 4).
• Email engagement data - whether you opened our marketing emails and which links you clicked (only if you subscribed to them).
• Device & technical data - IP address, browser type, operating system, referral URL.
• Referral data - if you arrive through an affiliate's referral link: the affiliate code, the page you landed on and the time. We do not store your IP address with it. If you book with an affiliate's code, the code is kept on the booking.
• Affiliate program data - if you apply to the Moramara Affiliate Program: your name, contact email, country, whether you act as an individual or a business, your channels, the code you propose and the version of the affiliate terms you accepted. For payouts: your PayPal email (stored encrypted), legal name and country, and the invoices we issue in your name for your payouts.

Moramara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data received from Google is used only to:

• Create and authenticate your Moramara account.
• Display your name and profile picture within the platform.
• Send booking-related transactional emails to your Google email address.

We do not use Google user data to serve advertising, share it with third parties for their own use, or transfer it for purposes unrelated to providing and improving our core platform features.

We process personal data for the following purposes:

• Creating and managing your account.
• Processing booking requests and sending confirmation emails.
• Enabling messaging between guests and hosts.
• Providing customer support.
• Improving the platform (analytics - with consent).
• Sending promotional emails about new experiences (only if you ticked the box at checkout or turned it on in your profile; unsubscribe any time).
• Complying with legal obligations (fraud prevention, tax records).
• Remembering an affiliate's referral link for 90 days so the right affiliate is credited when you book (only with your consent, see section 4).
• Running the affiliate program: reviewing applications, crediting bookings, paying commissions and preventing self-referral and fraud. This relies on our agreement with the affiliate, on our legal obligations for accounting, and on our legitimate interest in preventing fraud.

We use a small number of cookies. Essential cookies keep you signed in and are always on. Analytics and referral tracking cookies are only set if you allow them in the cookie banner. We do not use advertising cookies.

Clarity session recordings mask the text you type into forms before anything is sent to Microsoft.

If you click Reject, no analytics cookies are set. Google Analytics and Clarity may still receive basic, cookieless signals (for example that a page was viewed), which cannot be linked to you across visits.

If you decline referral tracking, no referral cookie is set. An affiliate's link still works during the visit where you clicked it, and an affiliate's code typed at checkout always works. The affiliate never receives your personal data.

Changing your mind: open Cookie settings (also in the footer of every page) to accept or reject again. If you withdraw your consent, we delete the analytics cookies already set. We ask again every 12 months, or sooner if we add a new tool.

Our emails: marketing emails sent via Brevo contain a small image and tracked links that tell us whether an email was opened and which links were clicked. This is covered by your subscription to those emails, not by the cookie banner. Booking emails (confirmations, messages from partners) do not track opens or clicks.

We share your data only when necessary:

• Partners - name and booking details are shared with the experience provider so they can confirm and deliver the booking.
• Service providers who process data on our behalf and only on our instructions: Clerk (sign-in), Google (Google Analytics), Microsoft (Clarity), Brevo (marketing emails) and Resend (booking and account emails).
• PayPal processes the booking deposit. You enter your payment details with PayPal, not on Moramara: we only receive the payment status, amount and PayPal transaction references, never your card or account details.
• Affiliates - if you book with an affiliate's code or link, the affiliate only sees a booking reference, the package name, the month of arrival and their commission. Never your name, contact details or exact dates.
• PayPal (affiliate payouts) - if you are an affiliate, we send your commissions to the PayPal email you give us.
• Legal authorities - when required by law or to protect rights and safety.

We do not sell your personal data to third parties.

We retain account data for as long as your account is active. Booking records are kept for 10 years to comply with Moroccan tax law. You may request deletion at any time (see section 8).

• Referral clicks - 120 days (the 90-day referral period plus 30 days for disputes). After that, only monthly totals with no personal data are kept.
• Rejected affiliate applications - 1 year after the decision.
• Affiliate account and payout details - while you are in the program, then 5 years after you leave it.
• Affiliate commissions, payouts, invoices and terms acceptances - 10 years, for our accounting obligations.
• Google Analytics - up to 14 months from collection.
• Microsoft Clarity - session recordings 30 days, heatmaps and aggregated reports up to 13 months.
• Marketing emails (Brevo) - while you are subscribed. If you unsubscribe, we keep only your email address on a do-not-contact list so we never email you again.

Our servers are located in the EU, and Brevo is an EU (French) company. Some service providers, such as Google, Microsoft, Clerk, Resend and PayPal, may process data in the United States. In such cases we rely on the EU-US Data Privacy Framework where the provider is certified (Google and Microsoft are), and otherwise on Standard Contractual Clauses (SCCs) approved by the European Commission.

Depending on where you reside, you may have the following rights under applicable data-protection law (including the GDPR):

• Access - request a copy of the data we hold about you.
• Rectification - correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") - ask us to delete your data.
• Restriction - ask us to pause processing while a dispute is resolved.
• Portability - receive your data in a machine-readable format.
• Object - opt out of processing based on legitimate interests or direct marketing.
• Withdraw consent - at any time for consent-based processing (cookies, marketing emails).

To exercise any right, email support@moramara.com. We will respond within 30 days.

Google account data: If you signed in with Google, you may request deletion of all data we received from Google (Google Name, Google Email Address, and Google Profile Picture) by emailing support@moramara.com with the subject line "Delete my Google data". We will permanently remove it within 30 days. Deleting your account removes all associated Google-sourced data.

We use industry-standard measures including HTTPS encryption, hashed passwords, and access controls to protect your data. No transmission over the internet is 100% secure; if you suspect a breach, contact us immediately.

Our platform is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Significant changes will be communicated by email or an in-app notice.

For any questions about this policy: support@moramara.com

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data-protection authority (e.g. CNIL in France, ICO in the UK, or the relevant authority in Morocco).