Privacy policy

Data controller

Personal data collected on caftanium.com is processed by the publisher of Caftanium in accordance with Law 09-08 on the protection of individuals with regard to the processing of personal data. Any question: contact@caftanium.com.

Data we collect

• Account: display name, email address, password (stored hashed), language; Google identifier if you sign in with Google.
• Requests to boutiques: piece, size, dates, chosen branch, message, and the contact details the boutique needs to answer you (including your phone number if you give it).
• Favourites and reviews (rating, comment, display name).
• Boutiques: company details and person in charge, contact details, photos, verification documents, subscription information.
• Technical data: IP address, device type and security logs, used to protect the service (abuse limits, fraud detection).

We do not collect your precise location: searching by city or neighbourhood uses what you type.

Why

• to provide the service: accounts, favourites, requests, exchanges with boutiques, reviews;
• to send you emails about your account and requests (confirmation, boutique reply, reminders);
• to verify boutiques and moderate content;
• to secure the platform and meet our legal obligations.

Your data is never sold. No promotional email is sent without your consent.

Sharing with boutiques

Caftanium is a matchmaking service: when you send a request, contact a boutique or leave a review, the necessary information is passed on to the boutique concerned. The boutique uses it to handle your request and is responsible for it on its side.

Service providers

We use providers that process data on our behalf only:

• server and database hosting in the European Union;
• photo storage (Google Cloud, European Union);
• email delivery (Resend);
• artificial-intelligence assistance (OpenAI): writing listings and editing photos for boutiques, interpreting searches — only the texts and photos needed are sent;
• Google sign-in (if you choose it) and map display (OpenFreeMap / OpenStreetMap).

Some of these providers are located outside Morocco. These transfers are covered by contractual safeguards and carried out in line with the procedures of the National Commission for the Control of Personal Data Protection (CNDP).

Newsletter

The newsletter (new arrivals, collections, offers) is only sent to people who asked for it, by ticking the optional box when creating an account by email or from their account. Accounts created with Google or with a phone number are never subscribed. We keep the date of your consent; you can unsubscribe at any time from the “My account” page, and the date of your consent is then erased. This choice is separate from the emails about your account and your requests.

Cookies

Caftanium sets cookies needed for the site to work: keeping you signed in, protecting against forged requests (CSRF) and remembering your language. They do not require your consent. Audience measurement and advertising cookies are only set with your consent, given or refused on your first visit. Your choice is kept on your device for six months and can be changed at any time through the “Cookies” link at the bottom of the page.

With your consent to audience measurement, a random session identifier (“caftanium-visitor” cookie, 13 months) lets us count how often each piece is viewed (once per piece every 24 hours), record the language of your searches and, if you sign in, link this session to your account. It is shared with no third party and deleted as soon as you withdraw your consent.

Retention

Account data is kept while the account is active, then deleted or anonymised after it is closed, unless the law requires us to keep it. Requests and reviews are kept for your account and boutique history. Security logs and technical messages are kept for a limited time, then erased automatically.

Security

Traffic is encrypted (HTTPS), passwords are stored hashed and access to data is limited to those who need it. Boutique verification documents are stored privately.

Deleting your account

You can delete your account yourself, at any time, from the “My account” page. To confirm it is really you, we ask for your password (if your account has one) and a one-time code sent by email, or by text message if your account is linked to a phone number.

• erased immediately: your name, email address, phone number, password, Google or phone sign-in, favourites, notifications, newsletter subscription and sessions;
• kept without your name or contact details: your past requests (rentals, fittings, purchases) and your reviews, for the boutiques' records and our legal obligations;
• deletion is permanent: the account cannot be restored, but your email address can be used to create a new account.

If you manage a boutique or have a rental, fitting or purchase in progress, deletion is only possible once the boutique is closed or the request is finished or cancelled.

Your rights

Under Law 09-08, you have the right to access and correct your data and to object, on legitimate grounds, to its processing. You can delete your account yourself (see above) or ask us to delete your data.

Write to contact@caftanium.com from your account address. You may also lodge a complaint with the CNDP (www.cndp.ma).