Privacy policy

Last updated: October 13, 2026

Tomobelti is a management app for car rental agencies, based in Casablanca, Morocco. This page explains which data we process, who can see it, where it is stored, how it is protected and what your rights are under Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data.

In short

• Each agency only sees its own data: this separation is enforced by the server, not just by the app.
• We do not sell data, we do not show ads and we do not share data with anyone for commercial purposes.
• Data travels over HTTPS and is encrypted on Google's servers (Firebase).
• The agency's administrator can export all of its data to an Excel file at any time.

Who is responsible

For the data an agency records about its own customers (contracts, ID documents, driving licences…), the agency is the data controller: it decides what to record and informs its customers. Tomobelti hosts and processes this data only on the agency's behalf, to run the app, and uses it for nothing else.

For the accounts of agencies and their staff, and for requests sent from this site, Tomobelti is the data controller.

Data we process

• Subscription or trial request (forms on this site): name, agency name, city, phone, WhatsApp, email, message.
• Accounts: email, name, role and permissions of each user, app version and date of last use. Passwords are handled by Google (Firebase Authentication): Tomobelti never sees them.
• Agency: name, logo, contact details, ICE number, settings, subscription payments.
• Data entered by the agency: vehicles, contracts, expenses and customer records (name, national ID number, passport, driving licence, date of birth, address, phone).
• Chat assistant: the messages you write in it and, in the app, the name of the screen shown. They are sent to Anthropic (Claude) to produce the answer, without your name or your agency's data; Tomobelti does not store them. Do not write passwords or customer data in it.

Why

Only to provide the service: running the agency, printing contracts and invoices, managing accounts and the subscription, answering requests and protecting the app against abuse. No profiling, no advertising.

Who can see the data

• The agency's users, according to the permissions its administrator sets page by page; the administrator can disable an account at any time.
• The person running the Tomobelti platform has technical access, used only for support, managing the subscription, at the agency's request or when the law requires it.
• Our technical providers, to run the service: Google (Firebase: database, sign-in and hosting; reCAPTCHA: protection against abuse; Google Fonts), Vercel (site hosting), Unsplash (photos on the home page), SheetJS (Excel export tool), jsDelivr (car brand logos), Brevo (sending e-mails: free-trial link, Monday backup) and Anthropic (chat assistant). Agency data only goes through Google and, for the weekly backup, Vercel and Brevo; the others only receive the technical connection details (IP address, browser) needed to serve their files.

Where the data is

The database (Firestore) is hosted by Google in the European Union ("eur3" region: Belgium and the Netherlands). Sign-in accounts (e-mail and encrypted password) are handled by Firebase Authentication, a global Google service. The site's pages are served by Vercel; every Monday, a Vercel function also reads each agency's data to email it its backup, without keeping it; e-mails are sent through Brevo (a French company). These servers are outside Morocco. Assistant messages go through a Vercel function and are processed by Anthropic in the United States.

Security

• Encrypted connection (HTTPS) and data encrypted on Google's servers.
• Security rules enforced by the server: an account can only read its own agency's data, and only the pages its administrator opens to it.
• Nothing is permanently erased by mistake: anything deleted in the app can be recovered on request.
• Sign-in with fingerprint or Face ID is available: the password then stays encrypted on the device.
• To work offline, the app keeps a copy of the data on the device; it is erased when you sign out. On a shared computer, always sign out after use.

Backup

From the app's “Sauvegarde” (Backup) page, the administrator can download a complete Excel file at any time (vehicles, contracts, customers, expenses, settings) and import it back; the app reminds them every week. In addition, every Monday, this file is emailed automatically to the agency's email address (the one in its contact details), from the address contact@tomobelti.ma (Brevo sending service). This file contains personal data: keep it somewhere safe and protect the mailbox that receives it. To change the address or stop these emails, contact us.

How long we keep data

An agency's data is kept as long as its account exists. When a subscription or trial ends, the app pauses without erasing anything, so the agency gets its data back if it resumes. At the agency's written request (phone, WhatsApp or e-mail), we delete its data from the platform: the platform's manager does it personally and confirms when it is done. Remember to export an Excel backup first. Requests sent from this site are kept as long as needed to handle them and follow up with the agency. When Tomobelti deletes an agency, it stays in a trash for 15 days (accounts blocked, can be restored), then its data and accounts are erased automatically.

Browser storage

Neither the site nor the app uses advertising or analytics cookies. The app stores in the browser only what it needs: the sign-in session, the remembered email, the copy of the data and a few settings. reCAPTCHA (Google) may set a technical cookie to detect bots. The assistant conversation stays in the browser tab until it is closed.

Your rights

Under law no. 09-08, you can ask to access, correct or delete your data, and object to its processing on legitimate grounds.

• Staff member or customer of an agency: contact the agency first; we help it respond.
• Agency or site visitor: call us on 06 20 69 75 90 or message us on WhatsApp.

You can also file a complaint with Morocco's data protection authority, the CNDP: www.cndp.ma.

Changes

This page may change as the app evolves. The date at the top shows the latest update; for any significant change, we inform the agencies.