Privacy policy

Who is responsible for my data?

The data controller is the publisher of kreators.ma, identified in the legal notice. In this policy, “Kreators”, “we” and “us” mean that publisher.

Your data is processed under Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data, and its implementing decree 2-09-165 of 21 May 2009. The supervisory authority in Morocco is the National Commission for the Control of Personal Data Protection (CNDP, www.cndp.ma).

For any question about your data, write to us through the contact form or at contact@kreators.ma.

What personal data do you collect?

We only collect what you give us and what the site needs to work:

• Account: your name, email address, password, role (creator or client) and language. The password is stored only as a hash: nobody can read it, not even our team. One account has one role.
• Sign-in with Google: if you choose “Continue with Google”, Google sends us your name, email address, profile photo and an identifier of your Google account, with technical tokens that make the sign-in work. We never receive your Google password.
• Creator profile: username, display name, headline, bio, city, languages, niches, gender (optional), social accounts with follower counts and, if you give it, the engagement rate you declare, the share of your audience in Morocco, packages with their price in MAD, whether you can issue an invoice, your links page and its look, and your contact details (WhatsApp, phone, email).
• Clients: the creators you save to your shortlists.
• Contact form: your full name, email address, phone (optional), subject, message and language. We also keep a hash of your IP address, not the address itself, only to limit abuse.
• Security: when you sign in, we store the IP address and browser used with your session, to spot a suspicious sign-in. At sign-up, Cloudflare Turnstile checks technical signals from your browser to tell a person from a bot.
• Technical logs: like any website, our server records the requests it receives (IP address, page requested, browser, date) for security and troubleshooting. Actions by the Kreators team in the admin area are logged with a hash of the IP address that changes every day, never the address itself.
• Creator statistics: page views, link clicks, profile views and contact clicks are plain totals. No data about the person who viewed or clicked is attached to them. To avoid counting the same visit twice, the server keeps a temporary hashed identifier in memory for a few minutes, then forgets it: nothing is stored.
• Cookies and audience measurement: a few necessary cookies keep your language, your session and your cookie choice. Only if you accept, Google Analytics measures your visit (pages viewed, device type, approximate region). The details are in the cookie policy.
• Free tools: the rate calculator, invoice, quote, media kit, QR code and the other free tools run in your browser. What you type in them is not sent to Kreators.
• We do not ask you for any sensitive data (health, religion, political opinions…). Please avoid writing any in your bio or in the contact form.

Who can see my creator profile?

Your profile stays private until the Kreators team has reviewed it and listed it in the directory. Once it is listed:

• Visible to everyone, including search engines such as Google: username, display name, headline, bio, city, languages, niches, social accounts and declared follower counts, audience share in Morocco, packages and prices in MAD, whether you invoice, badges and your links page kreators.ma/yourname.
• Visible only to signed-in members: your WhatsApp, phone and email contact details. Visitors who have not signed up see a masked version.
• Never public: your account email, your password, your IP address and your statistics, which only you and the Kreators team see.
• Your gender, if you give it, is not shown as text: it is used to draw your avatar and in the search filter of signed-in clients.
• What you add to your links page (a WhatsApp link, for example) is public: only put there what you want everyone to see.

Why do you use my data?

Each use rests on a basis set out in article 4 of law 09-08:

• Creating and running your account, signing you in, listing your profile, saving your shortlists: this is needed to provide the service you ask for when you accept the terms of use (performance of the contract).
• Sending you the service emails (address verification, new password, replies to your contact request): performance of the contract.
• Answering messages sent through the contact form: your request itself, or our legitimate interest in replying to you.
• Reviewing profiles before they are listed, preventing fraud, bots and abuse, and securing accounts: our legitimate interest in protecting users and the site.
• Measuring the site’s audience to improve it: your consent, which you can withdraw at any time.
• Meeting our legal obligations and answering requests from the competent authorities: legal obligation.

Who has access to my data?

Your data can only be accessed by:

• The Kreators team, only for what it needs: reviewing profiles, support and security.
• Signed-in members, for creators’ contact details, and the public, for listed profiles (see above).
• Our technical providers, who host the site and the database, send the emails, measure the audience or block bots. They process your data only to provide that service to us (see the next section).
• Judicial or administrative authorities, only when the law requires it.
• Nobody else: we do not sell your data, rent it out or use it for advertising, and we do not send you marketing emails.
• When you contact a creator on WhatsApp, by phone or by email, the conversation happens outside Kreators, under the rules of those services.

Where is my data hosted? Does it leave Morocco?

Yes. Your data is hosted and processed outside Morocco, by technical providers chosen for their security: hosting the site and the database, sending emails, audience measurement (only if you accept) and protection against bots.

Law 09-08 governs these transfers abroad in its articles 43 and 44. They are needed to provide the service you ask for, and each provider commits, in its contract terms, to protect the data it processes for us.

How long do you keep my data?

• Account and profile: as long as your account exists. When you ask us to delete it, we erase the account, profile, packages, links page and shortlists. A copy may remain for the limited time our database backups are kept, then it disappears.
• Sign-in session: until you sign out, and it expires after 7 days without use. The IP address and browser stored with the session are erased with it, when you sign out or delete your account.
• Contact form messages: as long as it takes to answer you, and 12 months at most.
• Your cookie choice: 6 months, then we ask you again.
• Google Analytics cookies: up to 2 years according to Google’s documentation, and only if you accepted.
• Server technical logs: a short time, then they are erased automatically.
• Log of team actions: kept for security and to keep track of moderation decisions.
• Statistics: totals with no personal data, erased with the profile. The temporary identifier that stops a visit being counted twice stays in memory for a few minutes and is never stored.

How do you protect my data?

• The whole site runs over HTTPS: traffic between your browser and our servers is encrypted.
• Passwords are stored as a hash: nobody can read them, not even our team.
• The session cookie is protected: scripts on the page cannot read it and it is only sent over HTTPS.
• Your email address must be verified before the first sign-in, repeated sign-in attempts are limited per IP address and an anti-bot check protects sign-up.
• Only the members of the Kreators team who need it can access the data, and their actions in the admin area are logged.
• No system is perfect: if you think someone else has used your account, choose a new password and write to us straight away.

What are my rights over my data?

Law 09-08 gives you the following rights, free of charge:

• Right to information (article 5): to know who processes your data and why. That is what this page is for.
• Right of access (article 7): to get confirmation that we process your data, and a copy of it.
• Right of rectification (article 8): to have inaccurate or incomplete data corrected, completed, updated or erased. You can also edit your profile yourself from your workspace.
• Right to object (article 9): to object, on legitimate grounds, to the processing of your data, and to object free of charge to its use for marketing.
• Account deletion: we erase your account and profile when you ask.
• Withdrawing consent: you can refuse or withdraw your consent to audience measurement at any time, with the “Cookie preferences” link at the bottom of the site’s pages.

How do I use my rights or delete my account?

Write to us through the contact form or at contact@kreators.ma, from your account’s email address: this lets us check that the request really comes from you. Do not send a copy of your ID card or any other sensitive document; if there is any doubt, we will ask you to confirm by email.

We answer free of charge, and a correction is made within the ten days set by article 8 of the law.

If you believe your rights have not been respected, you can complain to the CNDP (www.cndp.ma).

Can minors use Kreators?

No. Kreators is for people aged 18 or over, creators and clients alike. We do not knowingly collect data about minors. If you think a minor has created an account, write to us through the contact form and we will delete the account.

Can this policy change?

Yes, when the site evolves or the law changes. The update date at the top of the page shows the version in force. If a change affects how we use your data, we tell you on the site or by email before it applies.