Privacy Policy
Last updated: September 21, 2026
1. Information We Collect
We collect only the personal information needed to operate our car-rental service: (a) account data - first name, last name, email address, phone number and country of residence; (b) Google Sign-In data - your name, email address and profile photo, received directly from Google when you choose that sign-in method; (c) booking data - pickup and return locations and dates, vehicle selection, extras, and messages you send us; (d) technical data - device type, browser, approximate location (country/city), and standard server logs (IP address, pages visited) used for security and debugging. We do not collect passport numbers, national ID numbers, or credit-card details through online booking; payment is made in cash (MAD) at vehicle pickup.
2. How We Use Your Information
We use your information exclusively to: create and administer your account; process, confirm and manage vehicle reservations; communicate booking updates and provide customer support; operate the loyalty program; issue invoices and meet Moroccan legal and accounting obligations (Law No. 09-08). Google account data is used solely to identify you, link your reservations to your account, and prefill booking contact fields. We never use your data for advertising, profiling, credit scoring, or any purpose you have not agreed to.
3. Storage, Processors & Sharing
Your data is stored in our Supabase-hosted PostgreSQL database (hosted on Amazon Web Services infrastructure in Europe) and accessed by our staff from Morocco. We share data only with the service providers required to run the service: Supabase (database, authentication and file storage), Google (Sign-In authentication, Maps location display), and Cloudflare (hosting, security and content delivery). We never sell, rent, or share your personal data with advertisers, data brokers, or resellers. Google user data is never used for ads, retargeting, or lending decisions, and our staff access it only to operate your bookings or investigate abuse, in line with Google's Limited Use requirements.
Google Sign-In Data
When you sign in with Google, Google LLC shares your name, email address, and profile photo with us under the openid, email, and profile scopes - the minimum scopes needed for account sign-in. This data is used only to create and manage your L&M CAR account, link your reservations, and operate the loyalty program, and is stored securely in our Supabase-hosted database in Europe. We never receive or store your Google password, and we never access your contacts, Drive, Gmail, or any other Google data. You can sign out at any time from your account page, disconnect Google access at any time in your Google Account security settings, and request deletion of your account and all associated data by emailing [email protected]. Google's own handling of your information is governed by the Google Privacy Policy (https://policies.google.com/privacy).
4. Data Security
We protect your information with TLS-encrypted connections, authenticated database access with row-level access controls, least-privilege staff access, and regular software updates, in accordance with Moroccan Law No. 09-08. No method of transmission over the Internet is completely secure, so we cannot guarantee absolute security, but we act promptly to address any suspected breach and notify affected users as required by law.
5. Data Retention
We keep your data only as long as needed: account profile data is retained while your account is active and deleted when you close your account or request deletion; reservation and invoicing records are kept as long as Moroccan tax and commercial law requires; customer-support correspondence is kept for up to 3 years; technical security logs are kept for up to 12 months. Expired data is deleted or anonymized on a rolling basis.
6. Your Rights & Law 09-08 Compliance
Under Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data (overseen by the CNDP), you have the right to access, rectify, oppose, and request deletion of your personal data. To exercise any of these rights, email [email protected] from your account email address; we respond to verified requests within 30 days. You may also lodge a complaint with the CNDP (www.cndp.ma).
7. Cookies
We use strictly essential cookies and local storage for sign-in sessions, language and currency preferences, and security. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list and retention of each cookie.
8. Children's Privacy
L&M CAR services are intended for adults aged 21 and over, in line with our rental requirements. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy to reflect service, legal, or Google-policy changes. Material changes will be announced on this page with a revised date above, and, where appropriate, by email before they take effect.
10. Contact Us
For any inquiries regarding your personal data or exercising your rights under Law 09-08, contact L&M CAR SARL at [email protected] or call +212 665 412 909.