Privacy Policy.

This Privacy Policy explains how Marocain LLC (“Marocain”, “we”, “us”) collects, uses, and shares personal data when you use marocain.investments and related services (the “Service”), and the rights you have. Marocain is the controller of the personal data described here.

You can reach us about privacy at privacy@marocain.investments, or by post at Marocain LLC, 1111B S Governors Ave STE 7520, Dover, DE 19904, United States (tel +1 (816) 624-3833).

Information you give us

• Account data — the email address, name, password (stored only as a salted hash), and role you provide when you register.
• Enquiry and lead data — when you contact an agent, request a service, or use a form: your name, email, phone number, message, and the listing or topic you enquired about.
• Newsletter and marketing — the email address you submit to subscribe.
• Preferences — saved listings (watchlist), followed items, saved searches, and recently viewed listings.
• Payment data — when you buy a paid service, our payment processor collects your card and billing details; we receive only a transaction record and limited details (e.g. last four digits, status), not your full card number.
• Communications — messages, requests, and correspondence you send us.

Information collected automatically

• Usage and device data — IP address, browser and device type, pages and listings viewed, actions taken, referring pages, and timestamps.
• Approximate location — derived from your IP address (not precise GPS).
• Cookies and similar technologies — see “Cookies” below.

Information about property professionals in listings

The Service aggregates public property listings that may include the professional contact details of agents, agencies, or sellers (e.g. an agency name or business phone published with the listing). We process this limited professional information to operate the marketplace; such persons may object or request removal by contacting us.

We use personal data to:

• provide, maintain, and secure the Service, and manage your account;
• route your enquiries to the relevant agent or agency and enable them to respond;
• process payments and deliver paid services you request;
• send transactional messages (e.g. account, security, service updates) and, where permitted, newsletters and marketing you can opt out of;
• personalise content and remember your preferences and saved items;
• operate the AI features (e.g. scoring, valuations, descriptions, translations, concierge) — for which relevant listing and query context is sent to our AI processors;
• analyse and improve the Service, prevent fraud and abuse, and keep it secure; and
• comply with law and enforce our Terms.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service and account you request); your consent (e.g. marketing emails, non-essential cookies), which you can withdraw at any time; our legitimate interests (to secure, analyse, and improve the Service, prevent abuse, and operate the marketplace), balanced against your rights; and compliance with legal obligations.

We use strictly necessary cookies and similar storage to run the site (e.g. to keep you signed in and remember your language). We may also use limited analytics to understand usage and improve the Service. Where required, we ask for your consent to non-essential cookies and default to the most privacy-preserving option. You can control cookies through your browser settings; blocking essential cookies may break parts of the Service.

We do not sell your personal data. We share it only as follows:

• Agents and agencies — when you send an enquiry, we share the details necessary for them to respond to you.
• Service providers (processors) who process data on our behalf under contract, including: Supabase (database, authentication, and file storage), Vercel (application hosting and AI gateway), Hetzner (data-collection infrastructure), Resend (email delivery), Stripe (payment processing), our AI providers (e.g. Google/Gemini, and, as fallbacks, OpenRouter and OpenAI, for scoring, valuation, translation, and assistant features), and Sentry (error monitoring).
• Legal and safety — where necessary to comply with law, legal process, or a lawful request, or to protect the rights, safety, and property of Marocain, our users, or others.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not disclose your contact details to agents or third parties except as needed to fulfil your own request or as described above.

We operate from the United States and use service providers that may process data in the United States, the European Union, and elsewhere. Where we transfer personal data out of the EEA, the UK, or Morocco, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism. You may contact us for more information about these safeguards.

We keep personal data only as long as needed for the purposes described here — for the life of your account and a reasonable period afterwards — and longer where required to comply with law, resolve disputes, or enforce our agreements. When no longer needed, we delete or anonymise it. Aggregated or de-identified data that no longer identifies you may be retained.

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent. You can export or delete your account data at any time from your account settings, or by contacting us; we honour verified requests as required by law and will not discriminate against you for exercising your rights.

EEA/UK residents (GDPR): the rights above, and the right to lodge a complaint with your local supervisory authority. California residents (CCPA/CPRA): the rights to know, access, correct, and delete your personal information, and to opt out of “sale” or “sharing” — note that we do not sell or share your personal information as those terms are defined. Morocco (Law 09-08): the rights of access, rectification, and objection, overseen by the CNDP.

To exercise a right, email privacy@marocain.investments. We may need to verify your identity before acting on a request.

We use technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls, and row-level database security. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to any incident.

The Service is not directed to children and is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

You can opt out of marketing emails at any time using the unsubscribe link in the email or by contacting us. We will still send you necessary service and transactional messages related to your account.

We may update this Policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect means you accept the updated Policy.

For any privacy question or request, contact privacy@marocain.investments, or write to Marocain LLC, 1111B S Governors Ave STE 7520, Dover, DE 19904, United States (tel +1 (816) 624-3833). Marocain LLC is the data controller. EIN 37-2120102 · Company No. 2787941.