Privacy policy

This policy explains how Yat S Yat uses your personal data when you use this website and send a booking request.

1. Who is responsible

Yat S Yat SARL (trading as Yat S Yat), Medina, Marrakech, Morocco. Email: [email protected]. Phone: +212 637-302971.

2. What we collect

When you send a booking request, we collect:

• your name and phone number;
• the trip, date and time you chose, and the number of adults and children;
• the message you may add;
• the estimated total, a reference code and the status of your request.

We do not ask for the names of children, identity documents or payment details. Payment is made in person.

We also process technical data: your IP address and browser information, used to block spam and abuse and to keep the site secure.

3. Why we use your data

• to handle your request: call you to confirm, organise the trip and contact you if something changes (steps taken at your request before a booking);
• to protect the site against spam and abuse (our legitimate interest);
• to meet legal, accounting or tax obligations, where they apply.

Where the law requires consent, we rely on the consent you give by sending the request. We do not use your data for advertising, we do not sell it, and we do not send marketing messages unless you ask for them.

4. Who receives your data

Our team: only authorised people have access, through accounts protected by two-factor authentication.

Our technical providers, who act on our instructions:

• Supabase: database and file storage, servers in the European Union;
• Vercel: website hosting;
• Cloudflare: Turnstile, the anti-bot check on the booking form;
• Upstash: limits the number of requests, and briefly keeps your IP address and a one-way hash of your phone number, from minutes to hours;
• Telegram and Resend: they carry the notification we send to our own team when a request arrives, which contains your name, phone number, message and trip details.

Public authorities, when the law requires us to share data.

5. Transfers outside Morocco

Some providers process data outside Morocco (the database is hosted in the European Union; other services may process data in other countries, including the United States). We choose providers that apply appropriate security measures, and transfers are notified to or authorised by the CNDP where Law 09-08 requires it.

6. How long we keep your data

• booking requests: name, phone number and message are kept for 12 months after the trip date, then irreversibly anonymised; we keep only the trip, date and numbers for statistics;
• notification delivery logs: 90 days;
• security and admin activity logs (which include IP addresses): 180 days;
• request-limiting data: minutes to hours.

Copies of notifications held in our team's email and messaging apps are deleted when no longer needed.

7. Your rights

You can ask to access your data, correct it or delete it, and you can object to its processing for legitimate reasons (Law 09-08). If you live in the European Union or EEA, you also have the rights to restriction and portability under the GDPR.

To exercise your rights, write to [email protected]. We may ask you to prove your identity, and we reply within the legal deadlines.

You can also contact the CNDP (www.cndp.ma) or, if you live in the EU, the data protection authority of your country.

8. Cookies

We use a single functional cookie that remembers your language. We use no advertising or tracking cookies, and we have no audience analytics at the date of this update. The anti-bot check (Cloudflare Turnstile) may store technical information in your browser to work. Our staff admin area uses session cookies that visitors never receive. If we add analytics, we will update this page.

9. Security

The site uses HTTPS, access to requests is limited to our team with two-factor authentication, and access is logged. No system is perfectly secure: if an incident affects your data, we will take the steps and send the notifications that the law requires.

10. Children

This site is for adults. We only record how many children take part, never their names or data.

11. Changes

We may update this policy. The date of the last update is shown at the top of the page.

12. Contact

For any question: [email protected] or +212 637-302971.