Privacy policy

Tamobila ("Tamobila", "we", "us") is a software platform for car-rental agencies, built and operated from Agadir, Morocco. This policy explains what personal data we collect, why we collect it, and the rights you have over it. It applies to the marketing site at tamobi.la, the Tamobila application, and the booking microsites we host for rental agencies.

1. Who is responsible for your data

For data you give us directly — creating a Tamobila account, contacting us, subscribing to a plan — Tamobila is the data controller.

For data a rental agency manages inside Tamobila — its customer files, rental contracts, inspection photos, bookings made on its microsite — the agency is the data controller and Tamobila acts as a processor on its instructions. If you are a customer of a rental agency that uses Tamobila, your contractual relationship is with that agency; direct your requests to it first, and we will assist it in answering them.

2. What we collect

Account data. Name, email address, phone number, organization name, role, and UI preferences when an operator creates or joins a Tamobila workspace.

Rental operations data (on behalf of agencies). Customer identity details (name, contact details, driving-licence and ID document scans), rental agreements, vehicle inspection photos, payment and deposit records, and messages exchanged with the agency through connected channels (e.g. WhatsApp).

Booking data. When you book a vehicle on an agency's microsite: the dates, vehicle, your name, phone, email, and the documents you choose to upload to complete the booking.

Vehicle telemetry. Where an agency equips its fleet with GPS/telematics devices, we ingest vehicle position and health data. This is fleet data, attached to the vehicle and the rental period — not a profile of you as an individual.

Technical data. Server logs (IP address, user agent, timestamps), and product analytics (page views, feature usage) collected through PostHog to understand how the product is used. We do not sell this data or use it for third-party advertising.

Billing data. Subscription and invoicing details. Card payments are processed by Stripe; we never store full card numbers.

3. Why we process it

• To provide the service: accounts, fleets, rentals, bookings, contracts, invoices.
• To operate hosted microsites and process the bookings made on them.
• To send transactional notifications (booking confirmations, reminders, receipts).
• To provide AI-assisted features (e.g. document scanning/OCR, message assistance) — content is sent to our AI subprocessors only to produce the requested result and is not used by us to train models.
• To bill subscriptions and metered usage.
• To secure the platform, prevent abuse, and comply with legal obligations.

4. Legal bases

We process data to perform our contract with you or with the agency, to comply with legal obligations (accounting, tax), and on the basis of our legitimate interest in securing and improving the service. Where consent is required (e.g. certain cookies or marketing), we ask for it and you can withdraw it at any time.

5. Where your data goes

We use a small set of subprocessors to run Tamobila: cloud hosting and content delivery (Cloudflare), payment processing (Stripe), email/SMS/WhatsApp delivery providers, and AI model providers for the features described above. Each is bound by a data-processing agreement. Some are located outside Morocco; where data leaves Morocco or the EEA, we rely on appropriate safeguards (contractual clauses and equivalent mechanisms).

We never sell personal data.

6. Retention

Account data is kept for the life of the account and deleted or anonymised after closure, subject to legal retention duties. Rental and invoicing records are kept as long as the agency's legal obligations require (accounting law typically imposes multi-year retention). Technical logs are kept for a short rolling window. Agencies can delete customer records from their workspace at any time.

7. Your rights

Under Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data, and where applicable the GDPR, you have the right to access, rectify, and delete your data, to object to or restrict processing, and to data portability. To exercise these rights, write to [email protected]. If you are a rental-agency customer, we may redirect your request to the agency that controls your file. You may also lodge a complaint with the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) or your local supervisory authority.

8. Security

Data is encrypted in transit, access is scoped per organization and per role, and production access is restricted and logged. No system is perfectly secure; if a breach affects your data, we will notify the affected controllers and authorities as required by law.

9. Cookies

We use strictly necessary cookies (session, language preference) and product analytics. Microsites hosted for agencies use only the cookies needed to operate the booking flow.

10. Changes and contact

We may update this policy as the product evolves; the date above reflects the latest revision. Material changes will be announced in the application.

Tamobila — Agadir, Morocco · [email protected]