Privacy Policy

Tripycco is an online marketplace, available as a website and as mobile apps for Android and iOS, where travellers discover and book trips organised by independent travel agencies. Tripycco is operated by EdbenDigital ("Tripycco", "we", "us").

We are the data controller for the personal data described in this policy, except where a travel agency processes your data for its own purposes, as explained in section 5. For any question about this policy or your data, write to [email protected].

This policy applies to the Tripycco website, the Tripycco mobile apps and the services provided through them. It applies to travellers, to agency staff who use Tripycco on behalf of an agency, and to visitors who browse without an account.

It does not cover how an agency handles your data outside Tripycco, for example when it books your hotel or transport. The agency's own privacy notice applies to that processing.

We do not collect your precise location, your contacts, advertising identifiers, or access to your camera or microphone. We never collect payment card or bank details, because Tripycco does not process payments: you pay the agency directly.

We do not sell your personal data, we do not use it for advertising or advertising profiles, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Travel agencies. When you book a trip, the agency that runs it receives your booking and the lead guest's contact details. The agency uses them to organise and perform the trip, which may include passing names to hotels, carriers or, for Omra and international trips, the authorities that issue visas and permits. For that purpose the agency acts as an independent data controller and is responsible for its own processing.

Other users. A review you publish is shown publicly with your full name and profile picture. An agency's name, description, logo and published trips are public.

Service providers. We rely on the following providers, which process data on our instructions under contracts that require them to protect it:

• Render, which hosts the Tripycco application servers in Frankfurt, Germany
• Neon, which hosts our database in Frankfurt, Germany
• Cloudflare, whose R2 service stores uploaded images and documents
• Expo, which delivers push notifications to your device through Google Firebase Cloud Messaging on Android and Apple Push Notification service on iOS

Google Play and the Apple App Store distribute the apps under their own privacy policies. If you message us through WhatsApp, that conversation takes place on WhatsApp under WhatsApp's own terms, and we use what you send only to answer you.

Authorities and legal matters. We disclose data when the law requires it, or where it is necessary to establish, exercise or defend legal claims. If Tripycco is reorganised, merged or sold, your data may transfer to the new operator, which will remain bound by this policy.

Profile pictures, trip photos and agency logos are published to be seen, and are served from long, unguessable web addresses that anyone holding the address can open. Business licence documents are stored the same way; they are only shown to our verification team, but please do not include in them anything beyond what verification requires.

Your account and booking data are stored in the European Union, in Germany. Some of our providers, including Cloudflare, Expo, Google and Apple, may process data in other countries, including the United States. Where they do, the transfer relies on appropriate safeguards such as the European Commission's standard contractual clauses. Transfers of data about users in Morocco are carried out in accordance with Law No. 09-08 and the requirements of the Moroccan data protection authority (CNDP).

• Account and profile data: for as long as your account exists.
• Reviews and saved trips: until you remove them or delete your account.
• Upcoming bookings: until the trip takes place, or until you cancel. Unpaid upcoming bookings are cancelled when you delete your account.
• Past bookings: kept for the agency's accounting and legal records. When you delete your account, your name, email address and phone number are removed from them.
• Notification tokens: until you sign out, delete your account or remove the app from your device.
• Sign-in sessions: until they expire, you sign out or you delete your account.
• Server logs: for a limited period, normally no longer than 30 days, unless needed to investigate a security incident.
• Agency verification documents: for as long as the agency account exists, and afterwards only where the law requires.

Under Moroccan Law No. 09-08 you have the right to be informed, and to access, rectify and object to the processing of your personal data. If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the rights to erasure, to restrict processing, to data portability and to withdraw any consent you have given.

• Correct your details at any time from your profile in the app or on the website.
• Delete your account from Profile in the app, or on the Delete your account page of this website.
• For any other request, write to [email protected]. We may ask you to confirm your identity, and we answer within 30 days.

If you believe we have not handled your data properly, you may complain to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), www.cndp.ma, or, if you live in the European Economic Area, to your local data protection authority. We would appreciate the chance to resolve your concern first.

The app asks for permission before sending push notifications, and you can turn them off at any time in your device settings. When you choose a profile picture, the app uses your device's system photo picker, which shares only the photo you select. The app does not access your location, contacts, camera or microphone.

The website uses only cookies that are strictly necessary for it to work. It sets no advertising or analytics cookies, which is why it does not show a cookie consent banner.

The app keeps your sign-in tokens in your device's encrypted secure storage, and stores your language, whether you have completed the introduction, and the notifications you dismissed on the device itself.

All connections to Tripycco are encrypted in transit. Passwords are stored only as salted one-way hashes, access to accounts uses short-lived tokens, and access to production systems is restricted. No service can guarantee absolute security, but if a personal data breach affects you, we will notify you and the competent authorities as the law requires.

Tripycco accounts are for people aged 18 and over. Minors may travel on trips booked by a parent or guardian, who provides their details for the booking. If you believe a child has created an account, contact us and we will delete it.

We will update this policy when the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you in the app or on the website before it takes effect.

EdbenDigital. Email: [email protected].