Last updated September 2026.
The controller of your personal data is GRAVITREK, INC., 1111B South Governors Avenue, #7289, Dover, Delaware 19904, United States. For anything in this policy, or to exercise any of the rights described below, email hello@moroccansanta.com.
Moroccan Santa does not use customer accounts or passwords. You can order as a guest, and we never ask you to create a login.
Your shipping address and email address are collected by Stripe on its own checkout page, not by us. Once payment succeeds, Stripe passes back to us only what we need to fulfil the order: your name, shipping address (street, city, state/region, ZIP or postal code, and country), email address, the quantity ordered, and the total paid. We do not collect or receive any personal data beyond that. If you contact us through the contact form, we also keep the name, email address, and message you send us so we can reply.
Payments are handled entirely by Stripe, a PCI-compliant payment processor. Your card details are entered on Stripe's own checkout page and never reach our servers -- we never see or store your card number, expiry date, or CVC at any point.
Because we don't use passwords, tracking an existing order works by emailing you a link instead. The link is unique, works only once, and expires automatically after 30 minutes. Clicking it is what proves the request came from you -- we never ask for a password.
Your information is used only to produce, ship, and support your order, to contact you about it, and to recognize you as a returning customer if you choose to use the features described above. We do not sell, rent, or share your personal data with third parties for their own marketing purposes.
Where the EU or UK GDPR applies, our legal bases are: performing our contract with you, for your name, address and email, which we need to make and post your cards (Article 6(1)(b)); complying with a legal obligation, for keeping order and payment records for tax and accounting (Article 6(1)(c)); our legitimate interests, for the one-click tracking links and returning-customer recognition, which let us run the shop without making you keep a password (Article 6(1)(f)); and your consent, for the newsletter only (Article 6(1)(a)), which you can withdraw whenever you like.
We share the minimum data necessary with the service providers who help us run this site: Stripe (payment processing and shipping-address collection) and Amazon (hosting and email delivery, for order confirmations and the one-click tracking links described above). These providers are only permitted to use your data to provide their service to us. We also give your name and address to the postal service that carries your parcel.
If you choose to subscribe to the newsletter, your email address is added to a single mailing list shared across the projects of our artist, Fadwa Morabet (including Moroccan Santa, Medina Zone, Belle Princess, and fadwamorabet.com), so that you hear about new work from any of them without subscribing separately to each. We record which site you signed up from. Subscribing is entirely optional and separate from ordering. Every newsletter carries a one-click unsubscribe link, and you can also ask us to remove you using the contact details below.
We are a United States company and your cards are printed and posted in Morocco, so your name and shipping address are transferred outside the European Economic Area and the United Kingdom in order to fulfil your order. Our providers Stripe and Amazon also process data in the United States. Where we move personal data out of the EEA or the UK we rely either on it being necessary to perform your contract with us, or on the Standard Contractual Clauses approved by the European Commission together with the UK International Data Transfer Addendum. Ask us and we will tell you which applies to a given transfer.
Order and payment records: 7 years from the order date, which is what US tax and accounting rules require. Contact-form messages: 24 months. Newsletter subscription: until you unsubscribe. One-click tracking links: 30 minutes. After those periods we delete or anonymise the data. You can ask us to delete it sooner and we will, except for anything we are legally required to keep.
You can ask us to: tell you what data we hold about you and give you a copy; correct it; delete it; restrict how we use it; object to our using it; and send it to you, or to someone else, in a portable machine-readable form. Where we rely on your consent -- the newsletter -- you can withdraw it at any time, and that does not affect anything done before you withdrew it. We answer within one month and we do not charge for it.
If you are not happy with how we handle a request and you are in the EU or the UK, you have the right to complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the authority for the country you live in, listed by the European Data Protection Board (edpb.europa.eu). You do not have to come to us first.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising -- and we have not done either in the past 12 months. We do not knowingly collect data from children. You have the right to know what we collect, to have it deleted, to have it corrected, and not to be treated differently for asking. Those are the same requests described above, made the same way.
This site uses a session cookie to remember the contents of your cart and, briefly, which order you just placed or are tracking. We do not use advertising or cross-site tracking cookies. The contact form is protected by Google reCAPTCHA, which sets its own cookies to tell people from bots; it is used only to block automated abuse and is covered by Google's own privacy policy.
We may update this policy from time to time. Continued use of this site after an update means you accept the revised policy.
Questions about this policy, or to exercise your data rights: hello@moroccansanta.com
GRAVITREK, INC., 1111B South Governors Avenue, #7289, Dover, Delaware 19904, United States.
