Last updated: October 2026.
What we collect
When you submit the enquiry form, we collect your name, email address, and any phone number, dates, package preference, surf level, group size or message details you provide. When you book online, we collect the details described under Bookings and payments. We do not collect card or other payment details through this website: Stripe takes payments on its own checkout page.
How we use it
To respond to your enquiry and, if you book, to take your payment and arrange your stay. We also measure enquiries and bookings, without your name or contact details, to see which pages and adverts bring them in. We don’t sell your details or share them beyond the services named in this policy, such as Stripe for payments, and we don’t use them for marketing unless you separately opt in.
How long we keep it
Enquiry details are kept in our email for as long as needed to handle your enquiry, your booking and reasonable follow-up. Booking details are kept as described under Bookings and payments. You can ask us to delete your data at any time by emailing hello@taghazoutsurftrip.com.
Cookies & analytics
We use Google Analytics to understand how the site is used: which pages people read, and how they found us. We also use Microsoft Clarity, which builds heatmaps and records how visitors move through a page (clicks, scrolling and mouse movement), so we can see where the site is confusing. Clarity masks the text you type, including anything you enter in the enquiry form, and we do not use it to identify you.
Microsoft Clarity stays switched off, and Google Analytics and Google Ads set no cookies, until you accept them in the cookie banner. If you decline, no analytics or advertising cookies are set and Microsoft Clarity never loads, so nothing is sent to Microsoft. Google is the part to be plain about: the site still sends Google Analytics a cookie-free count of the pages you view and of what you do there (what you click, how far you scroll, the surf level you pick, whether you send the enquiry form or, if you leave it, the last field you used, and your answer to the cookie banner), with no cookie identifier and without your name, email or phone number. Each of these is sent with the page’s address, which can contain the campaign tags or advert click reference of the link you followed and the package and surf level you chose. Steps of the booking form and completed bookings are counted only by package, with no dates, prices, payment reference or other booking details. Google Ads, whose tag is on every page, receives the same cookie-free signals with the same page addresses, but no booking value, and your browser keeps no advert click reference. If you accept, Google Analytics and Google Ads also receive the booking’s package, dates, party size, surf levels, room choices and value, any advert click reference or campaign tags from the link that brought you here and, once you have paid, Stripe’s reference for the payment. Completed bookings, with their value, and sent enquiries are then reported to Google Ads as conversions, and if you arrive from one of our adverts, your browser keeps that advert’s click reference for up to 90 days, so a booking can be matched to the advert that led to it. Google and Microsoft act as our processors and may process this data outside Morocco, including in the United States. We also use Google Ads cookies to measure which of our adverts lead to bookings. The cookie banner offers two choices of equal weight: “Accept” turns on both analytics (Google Analytics and Microsoft Clarity) and ad measurement (Google Ads), and “Decline” sets none of their cookies and leaves only the cookie-free count described above. Until you choose, the site behaves as if you had declined. You can change or withdraw your choice at any time with the “Cookie settings” link in the footer, which reopens the banner. The live forecast and the flights box are covered in the next section.
Live forecast, flights and affiliate links
The home page, the surf guide and the booking page show a live surf forecast. It comes from our own server, which gets swell data from NOAA’s WAVEWATCH III model (served by PacIOOS at the University of Hawaii), wind data from MET Norway and tide times from Marea, and keeps a copy. Our server’s requests carry only the bay’s location, so nothing about you is sent to NOAA, PacIOOS, MET Norway or Marea. On the home page and the surf guide the forecast loads as you scroll near it; on the booking page it loads with the page. No tap is needed, and your browser contacts no other company to show it.
The home page also has a flights box with recent fares to Agadir and a flight search from Aviasales, provided through the Travelpayouts affiliate network. Like the forecast, the fares need no tap, because they come from our own server: it asks Travelpayouts for recent Aviasales prices and keeps them for a few hours. Your browser loads nothing from Travelpayouts or Aviasales to show them. When you type in the “From” field of the search, what you type goes to our server, which asks Travelpayouts for matching cities. Travelpayouts receives the text you typed, but not your IP address or browser details.
The fares and the search are affiliate links. Clicking a fare or pressing the search button opens Aviasales in a new tab through a Travelpayouts link that records the click with our partner ID. When you arrive, Aviasales sets a cookie carrying our partner ID, so a booking made within 30 days can be credited to us. From then on you are on Aviasales’ website, under its own policy. If you book, Aviasales pays us a commission. We receive no name, contact or payment details from Aviasales or Travelpayouts, only reports of the clicks, bookings and commission from our links. Google Analytics also records each fare click or search, with the departure city code and the page language, under the cookie-banner rules described above.
Each company decides how it uses what it collects, under its own policy: Aviasales and Travelpayouts.
Bookings and payments
When you book on this website, the booking form asks for your package, surf level, dates and party size. If more than one of you is coming, it asks how many people are at each surf level, and you can add room upgrades if you want them. It then asks for your name and email address and an optional phone or WhatsApp number. We use these details to confirm your booking, arrange your stay and plan your airport pickup. The form does not ask for your address, date of birth, passport or card details.
The prices you see while you choose are worked out from your booking choices alone. Your name and contact details are sent only when you continue to payment. As you fill in the form, your browser keeps a copy of your answers, including your name, email and phone number, so nothing is lost if the page reloads. That copy stays on your device and is cleared when you close the tab. After you pay, that copy also holds Stripe’s reference for the payment, so the confirmation page can show the right booking. If you have accepted analytics in the cookie banner, your browser also keeps Stripe’s reference after you close the tab, so the same booking is not counted twice.
Payment is taken by Stripe, on Stripe’s own secure checkout page, not on this website. You enter your card or other payment details there, so they never pass through this website. To set up the payment, we send Stripe your name, email address and phone number (if you gave one), together with your booking: package, surf level or levels, dates, nights, party size, room upgrades, prices, the amount due now (the 20% deposit), the balance and the language of the page. Stripe stores these with the payment in our Stripe account. The payment methods you see, and any other details Stripe asks for on its page, depend on Stripe and our Stripe settings. Stripe explains how it handles your data in its privacy policy.
Stripe then tells our website whether the payment went through. We save a booking only once it is paid. The record holds your name, email address and phone number, your package, dates, party size and room upgrades, the total, the amount paid and the balance, the page language and Stripe’s reference for the payment. It is kept in our booking system with our website host, Hostinger, where we use it to plan your room. If a payment is still pending or does not go through, we save no booking.
Once you have paid, we email you a confirmation with your booking details, what you have paid and the balance. We also receive an email with the same details and your contact details, including when a payment is pending or has failed. Both emails are sent from our website. If a confirmation email cannot be sent, our server’s error log records your email address. The confirmation asks you to send us your flight number, and any dietary needs or late arrival, on WhatsApp. WhatsApp is run by Meta, which handles those messages under its own privacy policy.
We keep booking records and booking emails for as long as we need them for your stay, our accounts and any legal obligations. Stripe keeps its own record of the payment under its own rules. Google Analytics and Google Ads receive some booking details, but we don’t send them your name or contact details; the Cookies & analytics section above explains what they receive.
Contact
Questions about this policy: hello@taghazoutsurftrip.com.