Privacy policy

1. Scope and data controller

This policy applies to visitors, account holders, review authors and accommodation managers using Auberges Maroc.

The operator of the Auberges Maroc service acts as controller for the data required to operate accounts, the catalogue and related features.

2. Data we may process

The data processed depends on the features you use.

• Public account: name or public nickname, email address, preferred language, verification status and security data relating to sign-ins.
• Password authentication: the password is stored only as a cryptographic hash; Auberges Maroc does not know your plain-text password.
• Account features: favourites, reviews, enquiries, conversations, accommodation management access and history required to operate the service.
• Accommodation management: ownership or access requests, supporting documents where provided, access decisions and change history.
• Payments: transaction references and status required for accounting and service tracking; full bank-card details are handled by the relevant payment providers.
• Technical data: IP address or a derived fingerprint when used for security, browser information, technical logs, cookies and consent preferences.

3. Sign in with Google

If you choose “Continue with Google”, Auberges Maroc uses Google only to authenticate you, create your public account when necessary, or link your Google identity to an existing account.

We may receive your Google identifier, name, email address and information confirming that email address. Auberges Maroc never receives your Google password.

Auberges Maroc does not store Google access tokens or refresh tokens. The permissions requested are limited to basic identification, profile and email address.

4. Purposes and legal bases

We use data only to provide, secure, improve and administer Auberges Maroc, including account management, favourites, review publication and moderation, accommodation access requests, message delivery and payment tracking.

Depending on the processing activity, the legal basis may be performance of the requested service, our legitimate interest in securing and administering the platform, your consent where required, or compliance with a legal obligation.

5. Cookies and audience measurement

Strictly necessary cookies may be used for sessions, security and essential preferences.

Non-essential audience measurement tools are enabled only after your choice where consent is required. You can change this choice using the “Cookies” button in the footer.

6. Recipients and service providers

Data is available only to people and providers that need it to operate the service, such as hosting, email delivery, authentication, payment, security and technical maintenance providers.

When you use Google, Stripe, PayPal or another third-party service offered through the site, that provider also processes certain data under its own privacy rules.

Auberges Maroc does not sell your personal data to advertisers.

7. Retention and account deletion

Account data is kept while the account remains active or for as long as necessary to operate the service and comply with our obligations.

You can request permanent deletion from “Profile and security”. Strong confirmation is required before deletion.

When an account is deleted, favourites and social connections are removed, accommodation management access is revoked and the public identity is erased. Previously published reviews may remain visible in anonymised form.

Certain historical, security, payment or accounting records may be retained separately where necessary for evidence, abuse prevention or legal compliance.

8. Security

Auberges Maroc uses appropriate technical and organisational measures designed to limit unauthorised access, alteration, loss or disclosure of data.

No transmission or storage method can guarantee zero risk, so these measures are reviewed as the service evolves.

9. Your rights

Where applicable law provides them, you may request access, correction, deletion, restriction or portability of your data, object to certain processing and withdraw consent where processing is based on consent.

You can edit your identity and password from your account and permanently delete the account from “Profile and security”. You can also contact the service operator using the details below.

You may also have the right to lodge a complaint with the competent data protection authority.

10. International transfers

Some technical providers may process data from other countries. Where required by law, we rely on the appropriate legal safeguards implemented by those providers.

11. Changes to this policy

This policy may be updated to reflect new features, regulatory changes or changes of provider. The latest update date appears at the top of this page.