What this website collects, and what it does not.
In short: this website sets no cookie and loads no tracker. What we know about you comes from what you send us to book and organise your stay.
Who is responsible
This website is published by SALAM CAILLE, host of Villa Safira, Résidence Akenza 1, Villa 272, route de l'Ourika km 10, Marrakech, Morocco, who is the controller of the data described here. Contact: contact@villasafiramarrakech.com, or WhatsApp at the number shown on this website.
Browsing this website
The web server keeps standard access logs (IP address, page requested, time, browser) for security and troubleshooting; they are deleted after 14 days. We count visits ourselves, with no cookie, no IP address and no identifier: only the day, the landing page and where the visit came from. No third-party audience measurement, no advertising tracker and no cookie are used.
Writing to us
If you write to us on WhatsApp (a Meta service) or at contact@villasafiramarrakech.com, including by replying to our emails (a mailbox hosted by Spacemail, a service of Spaceship, Inc., United States, and forwarded to the host's mailbox, Gmail, a Google service), we use your name, dates and requests to answer you and organise your stay.
Booking online
For a booking we collect your name, email, phone number, dates, number of guests, language, and the time you accepted the booking conditions (with their version), as well as where your visit came from (for example Instagram or Google) and, if you tell us, how you heard about the villa. We use them to carry out the booking (payment, confirmation, arrival preparation), to write to you about it and to meet our accounting and tourism obligations. We never use them for advertising and never sell them. After payment, your contact details and dates are passed to our guest portal (villasafira.tech, same controller, same server), and we email you your personal link to upload your identity documents and sign the agreement there.
Payment
Payment is made on Stripe's secure page (Stripe, LLC, United States). Your card is first authorised, then charged only once we have checked availability. We never see or store your card details; Stripe processes them under its own privacy policy (stripe.com/privacy). We send Stripe your email, the amount and a booking reference, never your name in its metadata.
Emails
Booking emails (confirmation, cancellation, refund) are sent by Resend (Resend, Inc., United States) from the European Union (Ireland), with your email address, name and stay details. No open or click tracking is enabled.
Identity documents
Moroccan tourism regulations require guests to be registered. Identity documents are never uploaded to this website: you upload them through a secure link on our guest portal (villasafira.tech). For the guest registration required by law, they are sent to the residence's security officer through a secure page of our guest portal, accessible through a personal link. They are deleted 90 days after your departure, or 30 days after a cancellation.
Who receives your data
The villa's host; the residence's security officer, for identity documents only (guest registration required by law); and our providers, each for its own task only: Hostinger (hosting of the website and its database, data centre in Paris, France), Stripe (payment), Resend (emails), Spacemail (the contact@ mailbox), Google (the host's mailbox, which receives messages sent to contact@, and encrypted backup copies that Google cannot read), Telegram (internal notifications to the host, with no name or contact details), Meta (WhatsApp: if you choose to write to us on WhatsApp). Airbnb only receives the booked dates, without any name, to keep our calendars in sync.
Transfers outside Morocco
Our hosting provider is located in France (a country recognised as ensuring adequate protection). Stripe, Resend, Google, Meta and Spaceship are located in the United States: the data they process therefore leaves Morocco and, if you live in the European Union, the European Union. For payment, Stripe, LLC participates in the EU-U.S. Data Privacy Framework, and Stripe also provides for the European Commission's standard contractual clauses. These transfers are subject to the formalities required by Law 09-08 with the CNDP (declaration and transfer requests being filed).
How long
Server logs: 14 days. Contact details (name, email, phone): 2 years after your last stay. Accounting records (dates, amounts, reference, acceptance of conditions): 10 years. Identity documents: 90 days after departure, 30 days after a cancellation. Encrypted backup copies: 14 days on our server, 30 days on Google Drive. Payment data at Stripe: according to Stripe's legal obligations.
Security
The website is only served over HTTPS; card details never go through our servers; the database is only reachable by the website, with restricted rights; backups are encrypted; our technical logs contain no name, email or phone number (only a booking reference).
Your rights
Under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data and, for European Union residents, the GDPR, you may ask to access, correct or delete your data, or object to its use; European Union residents may also ask for restriction or portability. Write to contact@villasafiramarrakech.com. You may complain to the CNDP (cndp.ma) in Morocco or, in the European Union, to your national data protection authority.
Updates
Last updated on 24 October 2026. Changes are published on this page.
