1. Who we are
Avangate Hospitality Services FZE (the "Company," "we," "us"), operating moroccolaw.ai (the "Service"), is the data controller for personal information processed through the Service.
Contact our Data Protection Officer at: dpo@moroccolaw.ai.
2. What we collect
Information you provide: name, email, phone (Pro signup), password (hashed with Argon2 — never plaintext), preferences (region, language), the text of the questions you ask, Vault uploads (Pro), and payment information collected by Stripe (we do not see or store full card details).
Information collected automatically: usage data, IP address, browser type, and cookies.
Information we do NOT collect: sensitive personal data (race, religion, health) unless you voluntarily share it; children's data; full credit card numbers.
3. Lawful bases under Law 09-08
- Contract performance — providing the Service and subscriptions
- Legitimate interest — service improvement, security, and anonymized analytics
- Consent — marketing and lead routing to partner lawyers
- Legal obligation — compliance with regulatory requirements
5. Your rights under Law 09-08
- Access — receive a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion ("right to be forgotten")
- Portability — receive your data in machine-readable format
- Restrict processing — limit how we use your data
- Object — opt out of processing based on legitimate interest
- Withdraw consent — where processing is based on consent
- Lodge a complaint with the CNDP (Morocco's data protection authority)
To exercise these rights, contact dpo@moroccolaw.ai. We respond within 30 days.
6. Security
- TLS encryption in transit (HTTPS everywhere)
- AES-256-GCM encryption at rest for Vault contents
- Argon2 password hashing
- Row-level security on all personal data tables
- Multi-factor authentication for admin accounts
If a data breach affects your personal data, we will notify you within 72 hours, as required by Law 09-08.
7. How long we keep it
Account data is kept while the account is active + 30 days after deletion. Payment records are kept for 7 years (Morocco corporate records standard). Backups are kept 7-14 days on a rolling basis.
8. Children's privacy
The Service is not directed at users under 18. We do not knowingly collect personal data from children. If you become aware that a child has provided personal data, contact dpo@moroccolaw.ai for immediate deletion.
Full, legally binding French version: /privacy.