Privacy Policy — Stash & Go

1. Who processes your data

The Stash & Go luggage storage service is operated in Agadir, Morocco, and the website stashandgo.ma is its point of entry. The operator of the service is the controller of the data processing described below.

For any question about your data: contact@stashandgo.ma.

2. Data collected

When you make a booking

your first and last name;
your e-mail address;
your phone number;
the number of the identity document presented at drop-off (passport or identity card);
the partner location chosen, the drop-off and pick-up dates and times, the number and size of the bags, the amount due;
the IP address from which the booking was made;
the technical context of the request: the site or search engine that brought you to us, any campaign named in the link you clicked, your browser, your operating system, your screen size, your time zone and languages, together with the country, city and network operator associated with your IP address.

When you send a message via the contact form

your name, your e-mail address, the subject and content of your message;
the IP address from which the message was sent, and the same technical context as above.

Automatically, when browsing the site

Our hosting provider records in its technical logs the IP address, the date, the page requested and the browser used. These logs serve the proper operation and security of the site; they are not used for commercial purposes.

The site uses no advertising audience-measurement tool, no third-party tracker and no social network button that would track you from one site to another. The technical context described above is recorded only when you send us a booking or a message: simply browsing the pages creates no profile.

3. Why we collect it

Data	Purpose	Legal basis
Name, e-mail, phone	Identify you at the partner location, send you the confirmation and reach you if anything unexpected occurs	Performance of the contract
Identity document number	Ensure that luggage is returned only to the person who dropped it off	Performance of the contract, security of the deposit
Booking details	Organise storage, calculate the price, keep the accounts	Performance of the contract, legal obligation
IP address	Limit abuse (bulk bookings, automated submissions)	Legitimate interest
Technical context and origin of the request	Tell a genuine booking apart from an automated submission or a test, know through which channel our customers find us, and fix display problems specific to one browser or device	Legitimate interest (service security and measurement of our own activity)
Contact message	Reply to you and keep a record of the exchange	Legitimate interest

Your data is never sold, rented or exchanged. No commercial prospecting is sent to you without your express request.

4. How long we keep it

Bookings: for the duration of the deposit, then kept for evidentiary and accounting purposes for the applicable statutory period, before deletion or anonymisation.
Contact messages: 3 years from the last exchange.
Customer-area access links: 2 hours. Only a cryptographic fingerprint of the link is stored; the link itself exists only in your e-mail.
Anti-abuse counters: 2 days.
Hosting provider's technical logs: according to the provider's retention policy, in principle a few weeks.

5. Who has access to it

The Stash & Go team, to process the booking and reply to you.
The partner location where you drop off your luggage, which receives only the information needed to hand back the luggage: your name, the reference, the number of bags and the times.
Our hosting provider, which stores the data on its servers.
An IP address location service (ip-api.com), queried at the time of your request to obtain the country, city and network operator matching your address. Only the IP address is sent to it: neither your name, nor your e-mail, nor any detail of your booking.
The payment provider, if you choose to pay online (see section 6).
Our audience-measurement and advertising tools (Hotjar and Google Ads), which receive browsing information from your browser, without your name or contact details (see section 8).
The map background in the booking flow (OpenStreetMap): your browser requests the map images from it, which passes on your IP address, with no cookie and no detail of your booking.

Your data may be disclosed to the competent authorities where required by law.

6. Payment data

No bank card number passes through our servers and none is stored on them. Our booking entry point explicitly rejects any card data: if online payment is offered, you are redirected to the secure page of the provider (Stripe or PayPal), which itself collects the payment information under its own responsibility and in accordance with its own privacy rules.

In return we only receive the payment status and a transaction reference. When payment is made directly at the partner location, no banking data is collected at all.

7. Security

the entire site is served over HTTPS, with forced redirection and HSTS;
the booking logic and database credentials are stored outside the web directory: they are not accessible from the Internet;
customer-area access links are short-lived and stored only as a fingerprint;
access attempts are capped per IP address to prevent blind searching for bookings;
a strict content security policy limits what the browser may load on our pages to our own site and a short list of named services (see section 8).

8. Cookies and local storage

The site uses two third-party services that set cookies in your browser: one to measure audience, the other for advertising. Both are described below, together with everything else your browser keeps.

Audience measurement (Hotjar): anonymously records how the pages are used (page views, clicks, scrolling) to help us improve the site. This service receives neither your name, nor your email address, nor the details of your booking.
Advertising (Google Ads): lets us know which ads bring visitors and which actions follow (message sent, WhatsApp click, arrival on the booking page, paid booking). When a booking is paid online, only the amount and the booking reference are sent — never your name, your email address or the contents of your booking. This data is processed by Google, which may host it outside Morocco.
Session storage: during a booking, the information you enter is kept in your browser (sessionStorage) so that you can go back without re-entering everything. It disappears when the tab is closed and is never transmitted to a third party.
Display preferences (localStorage): the language and currency you pick in the menu are kept by your browser for your next visits. On your first visit, the language is suggested from your browser's language. Nothing is sent to any third party.
Device cookie (lg_appareil, one year): set at the end of a booking, it lets this same device find your bookings again without typing a reference or e-mail. It only holds a random identifier, never your data. The QR code and pick-up code are shown only for an ongoing booking.
Back-office session cookie: reserved for the Stash & Go team, it is set only on the administration page and never on public pages.
Origin memory (localStorage): on your first visit your browser keeps a randomly drawn identifier, the page you arrived on and the site that referred you to us. This identifier carries no information about you and serves us only inside stashandgo.ma: it cannot follow you across other sites, nor identify you. It reaches our server only if you send us a booking or a message, and disappears if you clear this site's data in your browser.

Both services are active as soon as you arrive on the site: no banner asks for your agreement beforehand. You can object at any time by blocking third-party cookies in your browser settings, or by browsing in private mode — the site remains fully usable. For advertising, you can also adjust ad personalisation in your Google settings.

9. Your rights

In accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, and with the General Data Protection Regulation (GDPR) where you reside in the European Union, you have the following rights:

Access: obtain a copy of the data concerning you.
Rectification: correct inaccurate information.
Erasure: request the deletion of your data, subject to accounting obligations and the duration of any ongoing deposit.
Objection: object to processing based on our legitimate interest.
Restriction: request the freezing of a contested processing operation.
Portability: receive your data in a machine-readable format.

You can already view and cancel a booking yourself from the Track my booking page, using your reference and the e-mail address used for the booking.

10. Contacting us, lodging a complaint

To exercise your rights or ask a question, write to contact@stashandgo.ma, stating your request and, where applicable, your booking reference. We reply within one month at the latest.

If our reply does not satisfy you, you may refer the matter to the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP) in Morocco, or to the data protection authority of your country of residence if you reside in the European Union.

11. Changes

This policy may evolve with the service. The date of the last update appears at the top of the page. In the event of a substantial change, customers with an ongoing booking are informed by e-mail.