Privacy policy

1. Who we are

Rihla, based in Morocco, runs this platform. For the data of agency owners, we are responsible for it. For the data of travellers who write to an agency through its site, the agency is responsible, and we only store it on its behalf (see section 4).

2. What we keep about agency owners

• Your account: email, a password (stored scrambled, never readable) or your Google sign-in.
• Your business details and the content of your site: name, contacts, WhatsApp, texts, photos, tours, prices.
• A history of your site’s changes, so you can undo them.
• A count of the AI writing help you use each day, to keep it within its limits.

We use this only to run your site and your account, to answer you, and to tell you about important changes to the service. No advertising, no selling, no profiling.

3. Cookies

We use only the cookies needed to keep you signed in and to finish creating your site. No advertising or tracking cookies, so there is nothing to accept. Visitors of agency sites get no cookies from us.

4. Travellers’ data on agency sites

When a traveller sends a request or books a trip on an agency’s site, we store their name, email, phone, dates, number of travellers and message, and send the related emails. To slow down spam, we also keep a scrambled fingerprint of the sender that cannot be turned back into their address.

We never use this data ourselves: we do not read it, contact travellers, sell it, share it or use it for marketing or AI. Only the members of that agency see it. Each agency site shows its travellers a privacy notice naming the agency as responsible. Travellers who want to see, correct or delete their data should ask the agency; we help the agency do it.

5. Services we rely on

Some data is stored or carried by these services, which may be outside Morocco. Each one is bound to protect it and use it only for us.

• Supabase: the database, sign-in and photos (European Union).
• Vercel: hosting the website (European Union and United States).
• Resend: sending emails (sign-up, requests, bookings) (United States).
• PayPal: deposits, paid directly to the agency (worldwide).
• Google: sign-in with Google, and place search when an owner adds a stop (worldwide).
• Anthropic: the AI writing help in the admin (only what the owner types) (United States).

6. How long we keep it

• Your account and site: until you delete them. Deleting is immediate and final, from Admin → Account.
• Travellers’ requests and bookings: until the agency deletes them, or deletes its site.
• Backups made by our database service roll over and disappear within a few days.

7. Your rights

Under Moroccan law 09-08 (and the GDPR if you are in Europe), you can ask to see, correct or delete your data, and object to its use. You can download your content and delete your account yourself in the admin, or write to us at ihyadnayoub@gmail.com. You can also complain to the CNDP, Morocco’s data protection authority (cndp.ma).

8. Security

Each agency’s data is walled off from every other agency’s, connections are encrypted, and access is limited to what each person needs. If a security problem ever touches your data, we will tell you without delay.