Privacy policy

1. Who is responsible

Tariq Marrakech is responsible for the personal data collected on this site and when you book with us. We process it in line with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, and we respect the equivalent rights of visitors from the European Union.

2. What we collect

When you book

• the lead guest’s name and WhatsApp number
• the date, number of guests, product, options and extras you choose
• the name of your riad or hotel, used as the pickup place
• anything you write in the notes, such as a flight number, a restaurant name, allergies or a baby’s age
• the booking reference, price and status (for example, picked up or paid)

When you ask us to plan a trip

Your travel dates, the number of adults and children, the kind of trip, what you need, your budget range, your name, WhatsApp number, email if you give it, and anything you write in the notes.

When you create an account

Your email address, used only to send you sign-in links, and the list of products you saved to your wishlist. An account is optional: you can book without one.

When you ask Tariq, our concierge

The text of your questions and the products suggested in reply.

When you arrive through a riad’s QR card

The code of that riad, so we can pay it its commission.

Technical data

Your IP address, used briefly to prevent abuse of the booking and concierge features, and standard server logs kept by our hosting provider.

We do not ask for payment card details. We don’t ask for passport numbers, and we don’t need an email address or an account to book. Please don’t put sensitive information in the notes or the concierge chat beyond what we need to deliver your booking safely.

3. Why we use it

• To deliver your booking: plan pickups, brief drivers and suppliers, send your pickup time on WhatsApp and collect payment. This is necessary to perform the contract you enter into when you book.
• To keep you safe: allergies, health notes and children’s ages are used only to prepare your service. You provide them with your consent, and you can ask us to delete them at any time.
• To answer your questions and trip requests in the concierge chat, on WhatsApp and by email if you gave one.
• To run and improve the service: accounting, preventing fraud and abuse, paying riad partners, and reading which questions come up most so we can offer what travellers need. This is our legitimate interest.
• To meet legal obligations, such as keeping accounting records.

4. Who sees it

We never sell your data and we don’t use it for advertising. We share it only with:

• Your driver and the supplier delivering your service (for example the balloon operator, desert camp, therapist or henna artist): only the name, phone number, pickup place, guest count and relevant notes.
• The riad partner whose QR card you used: the booking reference, date and amount, so it can be paid its commission. Not your phone number or notes.
• Service providers that host and run the site, under contract and only on our instructions: Vercel (website hosting), Supabase (database) and Anthropic (the AI model that answers concierge questions). WhatsApp (Meta) handles the messages you exchange with us there.
• Authorities, when the law requires it.

5. Data stored outside Morocco

Our hosting, database and AI providers store or process data on servers in the European Union and the United States. We use providers that offer strong contractual and security safeguards, and we transfer only what is needed to run the service.

6. How long we keep it

• Booking records, including amounts paid: for the period required by Moroccan accounting and tax law, then deleted.
• Booking notes, which can contain allergy or health information: cleared 90 days after the date of your service.
• Concierge questions: stored without being linked to your name, number or booking, and deleted after 24 months.
• Trip requests that don’t become a booking: deleted after 12 months.
• Accounts and wishlists: until you ask us to delete your account. Deleting it removes your email and wishlist.
• Technical logs: kept by our hosting provider for a short period, usually under 30 days.

7. Cookies and storage on your device

We use no advertising or tracking cookies. The site stores a few small items on your device so it works as you expect:

• My trip, saved items and your last booking details (browser storage), so you can see your bookings and book the next one faster. They stay on your device and you can clear them in your browser settings.
• Your chosen date, guests and currency, so prices show the right total.
• The riad partner code (a cookie for 30 days), if you arrived by scanning a riad’s QR card.
• A sign-in cookie, only if you sign in to your account (or, for our team, the dispatch board).

8. Your rights

You can ask to access the data we hold about you, correct it, delete it, or object to its use. Contact us on WhatsApp at +212 618 070 450 with your booking reference. We reply within 30 days. We may need to keep booking and payment records that the law requires us to keep.

If you are not satisfied with our answer, you can contact the Moroccan data protection authority, the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel), or the data protection authority in your own country.

9. Security

Booking data sits in a database that cannot be read from the public website. Only our team, signed in, can see bookings, and drivers and suppliers receive only what they need for your service. Connections to the site are encrypted.

10. Children

Bookings must be made by an adult. We only hold information about children that a parent or guardian gives us to prepare a service, such as a baby’s age for a car seat.

11. Changes to this policy

We update this policy when our service or the law changes. The date at the top shows the latest version. See also our Booking conditions and Terms of use.