This is a translation provided for convenience. In case of any discrepancy, the French version prevails. Version française
Privacy policy
Last updated: 25 October 2026
This policy explains what personal data Riadway collects, why, and how to exercise your rights. It applies Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data and, for people located in the European Union, the General Data Protection Regulation (GDPR).
1. Data controller
Riads Kech LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, États-Unis. Contact for any question about your data: contact@riadway.com.
2. Data collected and how it is used
We only collect the data needed for the service. We do not sell any data and do not carry out targeted advertising.
| Purpose | Data | Legal basis |
|---|---|---|
| Booking a stay | Name, email, phone, address and country, dates, rooms, number of guests, message to the riad | Performance of the contract |
| Paying the deposit and refunds | Amounts, Stripe payment reference (never the card number) | Performance of the contract, accounting obligations |
| Managing your account and login | Email, password (encrypted), booking history | Performance of the contract |
| Communicating with the riad | Messages in the conversation linked to the booking | Performance of the contract |
| Publishing a review | Scores, comment, first name and initial of last name | Your consent (you choose to publish) |
| Sending you service emails | Email, booking details | Performance of the contract |
| Registering and verifying a riad (owners) | Identity, contact details, documents (operating licence…) | Performance of the contract, verification obligation |
| Preventing fraud and securing the site | Technical logs (IP address, date, actions) | Legitimate interest |
3. Recipients and service providers
- The riad you book receives your name, your address and country, stay details, your message and your exchanges, in order to welcome you. Your phone number and email are only shared with the riad once the free cancellation period has ended; before that, the messaging hides contact details.
- Our technical service providers, which process data solely on our behalf: Supabase (database, accounts, files; servers in the European Union), Vercel (website hosting), Stripe (payments and refunds), Resend (sending emails).
- The authorities, only where required by law.
Published reviews are visible to everyone, with your first name and the initial of your last name.
4. Transfers outside Morocco and the European Union
Riads Kech LLC is established in the United States, and some service providers (Vercel, Stripe, Resend) process data there. These transfers are governed by the safeguards provided by these providers (standard contractual clauses of the European Commission or equivalent mechanisms) and, for data collected in Morocco, are subject to the formalities required by the Moroccan data protection authority (CNDP).
5. Retention periods
- Account: as long as it is active, then 3 years after the last activity, before deletion.
- Bookings and payments: 10 years, for accounting and tax obligations.
- Messages: 3 years after the end of the stay.
- Reviews: as long as the riad is on Riadway, unless deleted at your request.
- Owners’ documents: for the duration of the relationship, then 5 years.
- Technical logs: 12 months at most.
6. Your rights
You can request access to your data, its rectification, erasure or portability, or object to or request restriction of processing, by writing to contact@riadway.com from your account’s email address. We reply within 30 days. Some data must be kept despite a request for erasure (for example accounting data).
You may also lodge a complaint with the CNDP (www.cndp.ma) in Morocco, or with the data protection authority of your country of residence in the European Union.
7. Cookies
Riadway only uses cookies that are needed for the service: they keep you logged in, secure your session and remember the language you have chosen. No advertising or audience measurement cookies are used, which is why no consent banner is displayed. Payment, made on the Stripe page, is subject to Stripe’s privacy policy.
8. Security
Communications are encrypted (HTTPS), passwords are stored in encrypted form, access to data is restricted by strict rules (everyone only sees what concerns them) and owners’ documents are stored in a private space. In the event of a data breach presenting a risk, we will inform you and the competent authorities.