Legal

Merchant privacy policy

For partner businesses using the merchant space (back-office).

Merchant space · Back-office

1. Introduction

This policy describes the data we process when you create and manage a merchant space (back-office) to run your own loyalty program.

Are you a mobile app user? See the customer privacy policy.

In short: we process your business data solely to operate the service. We do not sell your business data.

2. Information we collect

  • Business: name, business type, city, logo
  • Owner: name, email address, phone number
  • Invited cashier accounts: name, email address
  • Content you create: rewards, offers, highlights, images
  • Program activity: transactions, points issued, rewards redeemed
  • Subscription and billing

3. How we use this data

  • Create and manage your space and your team’s access
  • Provide the loyalty service and the mobile app to your customers
  • Manage your subscription and support
  • Keep the service secure and prevent abuse

4. Sharing

We rely on technical providers (hosting, file storage, email, payment) solely to operate the service. We do not sell your business data.

5. Security

  • Encryption in transit (TLS / HTTPS)
  • Restricted and logged back-end access
  • Secure authentication
  • Regular backups

6. Retention & deletion

Your data is kept for as long as your space is active. To delete your space, email [email protected] - erased within 30 days, subject to legal obligations (for example billing records).

7. Your rights

The rights of access, rectification, deletion, portability and objection apply to your merchant data.

8. Your customers’ data (controller / processor)

For the personal data of your own customers (display name, loyalty activity), you are the data controller and we act as a processor, on your instructions and on your behalf.

This relationship is governed by our merchant terms and our Data Processing Agreement (DPA), available on request at [email protected].

9. Cookies and local storage

Neither the public site nor the merchant back-office sets tracking cookies of its own. The analytics we run ourselves store nothing on your device: they use the tab’s memory, which is cleared as soon as you close it.

9.1 Advertising partners’ cookies

Set by Google and Meta when their scripts load:

  • Google Ads (_gcl_aw, _gcl_au) - measuring sign-ups that came from our ads
  • Meta Pixel (_fbp, _fbc) - measuring and optimising our Facebook and Instagram ads

They are governed by Google’s and Meta’s own privacy policies; both receive this data for their own purposes.

9.2 Required for the merchant back-office to work

  • Sign-in token - kept in your browser’s local storage; without it you would be logged out on every page
  • Language and theme - your display preferences
  • g_state (Google) - set by “Sign in with Google” during authentication

These are essential: refusing them makes signing in impossible.

9.3 How to refuse them

You can block or delete these cookies in your browser settings, and turn off personalised advertising in Google’s and Meta’s ad settings.

10. Changes

The “last updated” date will change; significant changes are notified in the back-office or by email.

11. Contact

Carte Fidélité Maroc - Support · [email protected] · reply within 5 business days.

A question about your data?

Email us at [email protected] - reply within 5 business days.