Privacy policy

Last updated: 1 January 2026

1. Data controller

Scale X ("we", "our", "us") is operated by Scale X SARL, registered in Casablanca, Morocco. For any question about your personal data, write to privacy@scalex.ma.

2. Data we collect

We collect the following categories of data:

Host account data: email, name, phone, address, billing details.
Guest data: first and last name, nationality, date of birth, ID document number, ID photo, electronic signature.
Reservation data: stay dates, amounts, property concerned.
Technical data: IP address, browser type, access logs, kept 12 months for security.

3. Legal basis and purposes

Performance of the contract: providing the Scale X service to the host.
Legal obligation: keeping the police form for 1 year (Decree 2-02-186).
Legitimate interest: improving the product, preventing fraud.
Consent: marketing communications (explicit opt-in).

4. Hosting and transfers

Data is hosted in the European Union (Frankfurt, Germany) on ISO 27001 and SOC 2 Type II certified infrastructure. No transfer outside the EU takes place without standard contractual clauses approved by the European Commission.

5. Retention periods

Host account data: duration of the subscription + 3 years (accounting obligations).
Police forms: 1 year after the end of the stay (Decree 2-02-186, art. 6).
Signed contracts: 10 years (civil limitation period).
Scanned ID documents, electronic signature and connection IP: 180 days after the end of the stay, then automatic deletion (the host can request earlier deletion).

6. Your rights (Law 09-08 and GDPR)

You have the following rights over your personal data:

Right of access, rectification and erasure.
Right to portability (CSV/JSON export).
Right to object to processing.
Right to lodge a complaint with the CNDP.
To exercise these rights: privacy@scalex.ma.

7. Security

TLS 1.3 encryption in transit, AES-256 at rest, two-factor authentication available, access logging, daily encrypted backups. Annual security audits.

8. Cookies

We only use functional cookies (session, language preference). No advertising or third-party tracking cookies.

9. Changes

Any substantial change to this policy will be notified by email at least 30 days before it takes effect.