Privacy Policy

Moramara ("we", "us", "our") operates the booking platform available at moramara.com. We connect travellers with surf, yoga, hiking, and accommodation experiences across Morocco. Our registered address is in Morocco.

For any privacy-related enquiries, contact us at [email protected].

We collect the following categories of personal data:

• Account data - name, email address, password (hashed), profile photo. If you choose to sign in with Google, we receive the following data from Google via the OAuth 2.0 service: your Google Name (to display on your profile), your Google Email Address (to identify your account and send booking confirmations), and your Google Profile Picture (to personalise your account avatar). We request only the minimum scopes necessary: openid, email, and profile. We do not access your Gmail, Google Drive, Google Calendar, or any other Google service.
• Booking data - activity or accommodation selections, dates, guest counts. Payment is handled directly between you and the partner; we do not collect or store payment details.
• Communication data - messages exchanged with hosts or our support team.
• Usage data - pages visited, search queries, clicks, session duration (only if you consent to analytics cookies).
• Marketing data - email open/click events, ad interaction signals (only if you consent to marketing cookies).
• Device & technical data - IP address, browser type, operating system, referral URL.

Moramara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data received from Google is used only to:

• Create and authenticate your Moramara account.
• Display your name and profile picture within the platform.
• Send booking-related transactional emails to your Google email address.

We do not use Google user data to serve advertising, share it with third parties for their own use, or transfer it for purposes unrelated to providing and improving our core platform features.

We process personal data for the following purposes:

• Creating and managing your account.
• Processing booking requests and sending confirmation emails.
• Enabling messaging between guests and hosts.
• Providing customer support.
• Improving the platform (analytics - with consent).
• Sending promotional emails about new experiences (marketing - with consent, unsubscribe any time).
• Complying with legal obligations (fraud prevention, tax records).

We use cookies and similar technologies. You can manage your preferences at any time via the cookie banner shown on your first visit, or by clearing your browser's local storage.

We share your data only when necessary:

• Partners - name and booking details are shared with the experience provider so they can confirm and deliver the booking.
• Analytics providers - aggregated usage data (with your consent).
• Legal authorities - when required by law or to protect rights and safety.

We do not sell your personal data to third parties.

We retain account data for as long as your account is active. Booking records are kept for 7 years to comply with Moroccan tax law. Analytics and marketing data is retained for up to 13 months from collection. You may request deletion at any time (see section 8).

Our servers are located in the EU. Some third-party service providers (e.g. analytics) may process data outside the EU/EEA. In such cases we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.

Depending on where you reside, you may have the following rights under applicable data-protection law (including the GDPR):

• Access - request a copy of the data we hold about you.
• Rectification - correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") - ask us to delete your data.
• Restriction - ask us to pause processing while a dispute is resolved.
• Portability - receive your data in a machine-readable format.
• Object - opt out of processing based on legitimate interests or direct marketing.
• Withdraw consent - at any time for consent-based processing (cookies, marketing emails).

To exercise any right, email [email protected]. We will respond within 30 days.

Google account data: If you signed in with Google, you may request deletion of all data we received from Google (Google Name, Google Email Address, and Google Profile Picture) by emailing [email protected] with the subject line "Delete my Google data". We will permanently remove it within 30 days. Deleting your account removes all associated Google-sourced data.

We use industry-standard measures including HTTPS encryption, hashed passwords, and access controls to protect your data. No transmission over the internet is 100% secure; if you suspect a breach, contact us immediately.

Our platform is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Significant changes will be communicated by email or an in-app notice.

For any questions about this policy: [email protected]

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data-protection authority (e.g. CNIL in France, ICO in the UK, or the relevant authority in Morocco).