Privacy policy

01Who is responsible for your data

The data controller is data controller — legal entity name, registered address and registration number.

We have not appointed a Data Protection Officer. The platform is operated by a very small team and requests are handled directly by the operator, at the address in the last section.

02What we collect, and when

We collect personal data at one moment only: when you submit a quote request. Nothing is collected from you while you browse trips.

From the quote form, we collect and store: your name, your email address, your country, your phone number if you choose to give one, the number of people travelling and the type of group, your approximate dates or preferred month, your budget band, your fitness level, and the free-text message you write to the agency.

If you tell us you are travelling as a family, we also store the ages of the children travelling, because an agency cannot plan a mountain itinerary responsibly without them. This is the most sensitive information on the form and it is used for nothing else.

We also store a request reference and a private link token, so that you can follow your request without signing in.

We keep a short technical record of quote submissions — the sending IP address, or the email address used — purely to stop the form being abused. A submission we reject as abuse leaves a counter with a reason, and no copy of what was submitted.

The contact form and the "Join the platform" form collect the information you type into them — name, email and message for the first; your agency's details for the second. This information is not stored in our database: it is sent by e-mail to the operator through a technical queue, which clears it automatically about a week after submission, and at most two.

03Why we are allowed to hold it

We hold it in order to do the thing you asked us to do: pass your request to a local agency so they can quote for your trip. In GDPR terms this is the performance of a service you requested, and for the abuse-prevention records, our legitimate interest in keeping the form usable.

We do not use your data for marketing. There is no mailing list to join or leave. We do not profile you and we make no automated decisions about you.

04Who receives it

The agency your request is matched to. They receive your name, email, phone number if given, your message and your trip details, by email — that email is the record that your request was delivered. Agencies see only the requests assigned to them.

Resend, our email provider, which transmits those emails on our instruction.

hosting provider — name, country and address, which hosts the database and the site.

Our error-monitoring service, when the site hits a bug. Personal fields and request references are stripped out before an error report leaves the server, so these reports do not carry your name, email, phone number or message.

Our website analytics, if and when it is switched on. It is cookieless, records no personal data, and is not active at the time of writing.

Nobody else. We do not sell data, and we share it with no advertiser.

05WhatsApp — what actually happens

When you choose to continue on WhatsApp, we do not send anything to WhatsApp or to Meta. We hand your own browser a link with a pre-written message in it. Nothing is transmitted until you tap send, and when you do, it is your WhatsApp app sending your message to the agency.

That matters for two reasons. It means we have no WhatsApp business channel holding your conversation. It also means that once you send it, the message — which contains your name and your trip details — is in that agency's WhatsApp and in Meta's systems, under your own agreement with WhatsApp and theirs. We cannot delete it for you.

06Cookies

This site sets one cookie on its own: NEXT_LOCALE, which remembers whether you are reading in French or English. It does not track you, it is not shared, and the site cannot show you the right language without it. A cookie strictly needed to deliver the page you asked for does not require your consent, so we do not ask about that one.

We also use Google Analytics to measure how the site is used. Its script loads on every page, but it starts in a mode where it is not allowed to store anything: no cookie is written and no measurement is recorded until you accept. If you refuse, or simply never answer, it stays in that mode and nothing about your visit is kept.

If you accept, it sets cookies (_ga, and one named for our property) and records how you moved through the site. If you later change your mind, use “Cookie choices” at the bottom of any page: that switches it off again straight away and expires the cookies it set. Refusing is one click, exactly like accepting, and the site works identically either way — nothing is withheld from you for saying no.

Saved trips are stored in your own browser's local storage, not in a cookie and not on our servers. Your cookie answer is stored the same way, which is why recording it does not itself set a cookie. Clearing your browser data removes both, and we never see them.

07How long we keep it

Quote requests are kept for retention window — default 24 months after the last activity on the request. After that, an automatic job strips out your name, email, phone number, country, message and any children's ages, and keeps only the anonymous business record: the reference, which agency handled it, and whether it led to a booking.

We keep that anonymised record rather than deleting the row outright because it is what our accounts are built on — deleting it would silently change a past month's figures. Once anonymised, it no longer identifies you.

The technical abuse-prevention records are deleted after 90 days.

A review you choose to publish stays published, because it is content you asked us to show. You can ask us to remove it at any time — see the next section.

08Your rights, and what we can honestly promise

You can ask us what we hold about you, ask us to correct it, or ask us to erase it. Quote the reference from your confirmation email, or the email address you used, and we will find it.

On erasure, we will normally anonymise your request rather than delete the row — the same process described above, applied immediately instead of waiting. Where a request never led to a booking, we can delete it outright instead, and we will if you ask.

Two things erasure cannot reach, and we would rather say so than imply otherwise. Anything you sent to an agency over WhatsApp is in their phone and in Meta's systems, not ours. Email already delivered to an agency's inbox is likewise theirs.

If you have published a review, tell us and we will delete it. We delete it rather than just removing your name, because a review's text can mention details that identify you and we have no way to detect those automatically — removing the name alone would be pretending to erase you.

You also have the right to complain to a supervisory authority: the CNDP in Morocco, or your own national data protection authority if you are in the EU.

09Reviews are public

If you leave a review after your trip, the first name or name you give, your country, your rating and your text are shown publicly on the trip and agency pages. Nothing is published until we have read it.

Please do not put your email address, phone number or anything else private in the review text. It will be public, and we cannot reliably strip it out.

10Contact

For anything on this page, including access and erasure requests, write to contact address for privacy requests.

11Changes to this policy

If we change what we collect or who receives it, we will change this page and move the date at the top before the change takes effect.