On this page
Data controller
Contact for any question about your data: xcursionguide.official@gmail.com
Applicable law
We apply Moroccan Law no. 09-08 on the protection of individuals with regard to the processing of personal data, under the supervision of the CNDP. For users located in the European Union, we also apply the General Data Protection Regulation (GDPR).
The data we collect
- Account: first name, last name, email address, username, password (stored only as an irreversible hash), language, sign-up date.
- Team: trainee accounts created by a trainer (first name, last name, email), personal access link and registered workstation (browser and system type, date).
- Training: entries typed in the simulator, the state of your fictitious PNRs, points, accuracy and activity.
- Subscription: trial or subscription status, customer ID and payment history provided by Stripe. We never see or store your card number.
- Security: log of sign-ins and refused attempts with a truncated network address (for example 203.0.113.x), and encrypted two-step verification data.
- Contact: the information you send us through the contact form.
We use no advertising, no advertising trackers and no third-party analytics. Fonts are hosted on our own servers.
Why we use it
- To provide the service (account, simulator, saved progress, teams): performance of the contract.
- To manage the trial, subscription and billing: performance of the contract and legal obligations.
- To protect accounts and the website (blocking attacks, one workstation per trainee, security log): legitimate interest.
- To answer your messages: legitimate interest or pre-contractual steps.
- To send the emails the service needs (access, password reset, payment): performance of the contract.
Who receives your data
Your data is never sold. Only the publisher can access it and, for trainee accounts, the trainer who manages the team (name, email, activity and scores). We use the following providers:
- Stripe (subscription payments): Stripe processes payment data as an independent controller; see stripe.com/privacy.
Some providers may process data outside Morocco or the European Union. These transfers rely on the safeguards provided by law (standard contractual clauses or equivalent mechanisms).
How long we keep it
- Account and training data: as long as the account exists. It is deleted when you delete your account or when the trainer deletes a trainee account.
- Trial accounts never used: deleted at the latest 24 months after the trial ends.
- Billing records: for the legal retention period for accounting documents.
- Security log: the last 300 events, with truncated addresses.
- Contact messages: 12 months at most.
Your rights
You can ask at any time for access to your data, its correction or deletion, the restriction of processing, object on legitimate grounds, and receive your data in a reusable format (portability).
From the My account page, you can directly download your data and delete your account. For any other request, write to xcursionguide.official@gmail.com; we reply within 30 days at the latest.
You can also complain to the CNDP (cndp.ma) or, if you live in the European Union, to the data protection authority of your country.
Security
Encrypted connection (HTTPS), irreversibly hashed passwords, two-step verification available to everyone, automatic blocking of repeated attempts, encrypted secrets, trainee access limited to one workstation, security headers and an event log. No system is foolproof: if an incident affects your data, we will inform you and notify the competent authority where the law requires it.
Minors
The service is intended for professionals and people in training. Accounts for students under 18 can only be created by a school or trainer, under their responsibility.
Cookies
Details of the cookies and local storage used are on the Cookies page.