Privacy policy

This policy is published by Marocraft LLC, a company registered in the United States. Our products are sourced from cooperatives and workshops across Morocco and packed by hand in our own workshop in Morocco.

For any question about your data, write to contact@marocraft.com or message +212 665 448 540 on WhatsApp, Monday to Saturday, 09:00-19:00.

You give us your name, email address, phone number, shipping and billing address, the contents of your order, and anything you write to us. You never need an account to shop with us.

Your browser gives us basic technical data — IP address, device and browser type, pages viewed — which we use to run the site, measure how it performs, and block fraud. We never receive your card number.

• To take, pack and ship your order, and to send you a tracking number by email as soon as the order is dispatched.
• To answer your questions about delivery, returns and exchanges.
• To prevent fraudulent orders, and to meet accounting and consumer-protection obligations.
• To send marketing emails, only if you have explicitly agreed to receive them. Every one carries an unsubscribe link.

Marocraft never sees or stores your full credit or debit card numbers. Online payments are processed through PCI-DSS Level 1 certified payment gateways (including Stripe, Authorize.Net, Tazapay, PayPal, and Amazon Pay). In Morocco, orders can also be paid cash on delivery.

Card details are entered on encrypted, tokenized provider interfaces. We receive only a secure transaction token or reference sufficient to confirm the charge and to issue authorized refunds.

Orders and customer-service records are stored in Google Firebase (Firestore) on Google Cloud infrastructure. Product photos are served from Cloudflare R2, which holds no customer data.

• Shipping partners: your name, address and phone, so they can deliver.
• Payment providers: transaction data, never card numbers.
• Analytics providers, as described in section 9.
• Public authorities, when the law requires it.

We never sell or rent personal data.

• Order, invoice and customer-service records: as long as tax and consumer-protection law requires, typically up to ten years.
• Marketing-list data: until you unsubscribe.
• Visit statistics: our own cookieless counts are daily totals with no personal data, kept about 13 months; Google Analytics data is kept no longer than 24 months.

The whole site runs over HTTPS, and order records sit behind Firebase access rules so they are never publicly readable. Internally we work on a least-privilege basis: staff see only what their task requires.

No system is perfectly secure, but we work to keep the risk low and will notify you if a breach affects your data.

You can ask for a copy of the personal data we hold about you, have it corrected or deleted, restrict or object to certain uses, request a portable copy, and withdraw any consent you have given.

Email contact@marocraft.com and we will reply within 30 days. We may ask you to confirm your identity first, so that nobody else can request your data.

Essential cookies keep your cart, your currency and your session working; the site cannot function without them.

Our own server counts visits without cookies: each page view adds one to daily totals by page, country, device type, browser language and referring site. No identifier is created, nothing is stored on your device, and your IP address is used only for a moment to find your country — it is never stored. You can object to this measurement at /cookies, and it stops automatically when your browser sends a Global Privacy Control signal.

Google Analytics runs in Google Consent Mode: before you accept analytics cookies it sets no cookie and receives only cookieless signals, which Google uses to estimate traffic in aggregate; after you accept, it may use its cookies. The Meta Pixel runs only when it is enabled on the site, and only after you accept marketing cookies. This opt-in applies in the European Economic Area, the United Kingdom, Switzerland and Québec. Elsewhere, Google Analytics cookies are on by default and you can switch them off at any time at /cookies; advertising signals stay off everywhere until you accept marketing cookies.

You can refuse everything that is not essential from the consent banner, and change your mind later at /cookies.

Marocraft’s private administration connects to Google accounts that belong to Marocraft, so our team can run the store. Shoppers never sign in with Google, and this section does not concern any shopper’s Google account.

• Google Merchant Center: we publish and update our product listings, prices, shipping and return settings, and read their status.
• Google Analytics, read-only: we read reports on store traffic and sales.
• Google Search Console, read-only: we read how marocraft.com performs in Google Search and how its pages are indexed.
• Google Ads: we read our campaign results and manage our own campaigns. Any spending needs the owner’s approval first.
• Google account email address: we show which account is connected.

Access tokens are encrypted, stored on our servers on Google Cloud, and used only by our store administration. Reports from these services are kept in our own systems, and the AI services that prepare our store reports may process them, only to give that analysis to our team. Tokens are deleted when a connection is removed.

We do not sell this data, use it to advertise to individuals, or use it to train general AI models. Marocraft’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. The account holder can withdraw access at any time at myaccount.google.com/permissions.

We may update this policy as our practices change. The “Last updated” date at the top of this page always reflects the version in force. Material changes are announced with a banner on the store.