Privacy Policy

KTI Voyages · Last updated: 9 June 2026

1. Introduction

KTI Voyages ("we", "us", "the app") is a mobile application that helps travellers in Morocco plan, follow, and enjoy their guided trips. This policy explains what data we collect, how we use it, who we share it with, and how you can exercise your rights — including deleting your account.

2. Data we collect

2.1 Account information

Email address and name (required for sign-up)
Profile preferences (language, notification settings)
Authentication tokens issued by our authentication provider (Supabase Auth)

2.2 Trip data

The trips ("voyages") you are enrolled in and their itineraries
Activities, accommodations, transport, and guide assignments linked to your trip
Booking transactions and payment status (we do not store full payment-card numbers — only the method and status)
Complaints ("réclamations") you submit and the messages exchanged with our support team
Group chat messages exchanged with other travellers on your trip and private messages with your assigned guide

2.3 Location

With your permission, the app uses your device's location to:

Display a "you are here" marker on your trip map
Send local notifications when you enter a stop city or approach a suggested activity on your itinerary

Location is processed on your device and is not transmitted to our servers or shared with third parties. You can revoke location permission at any time in your device settings.

2.4 Notification tokens

If you accept notification permission, your device generates a push token (APNs on iOS, FCM on Android). We store this token alongside your user ID so we can deliver booking confirmations, complaint replies, and trip updates. You can opt out by disabling notifications in your device settings — your account remains usable.

2.5 Technical data

Device model, operating system version, and app version (for debugging and analytics)
App crash logs and error reports (when you experience a crash)

2.6 AI assistant (Gemini)

When you use the in-app AI assistant, your messages and the surrounding trip context are sent to Google's Gemini API via our server (the request never reveals your raw account credentials). Conversations are processed to generate replies and to detect complaints we should escalate to our support team. We do not use your AI conversations to train any model.

3. How we use your data

To operate the core features of the app (auth, trip itineraries, messaging, payments, notifications)
To communicate with you about your bookings and trips
To improve the app (anonymous aggregate analytics and crash reports)
To respond to support requests and resolve complaints
To comply with legal obligations

We do not sell your data. We do not display third-party advertising in the app and we do not share your data with advertising networks.

4. Who we share data with

Supabase (database, authentication, storage) — our backend infrastructure provider.
Google Cloud / Firebase Cloud Messaging — to deliver push notifications to Android devices.
Apple Push Notification service (APNs) — to deliver push notifications to iOS devices.
Google Gemini API — to power the in-app AI assistant.
Your assigned guide and other travellers on your trip — for the messaging features. Guides see only the travellers on trips they are assigned to.

5. Data security

All network traffic between the app and our servers is encrypted in transit (HTTPS / TLS).
Database access is gated by row-level security policies — your account can only see and modify your own data.
Push delivery uses signed JWTs and provider-issued tokens — no raw secrets are shipped in the mobile app.

6. Data retention

We retain your account and trip data for as long as your account is active. After you delete your account (see section 7), all personally-identifying information is removed from our active systems within 30 days. Anonymised aggregate analytics may be retained indefinitely.

7. Your rights — including account deletion

You have the right to:

Access the data we hold about you
Correct inaccurate data
Export your data in a portable format
Delete your account and all associated personal data
Withdraw consent for optional processing (e.g. notifications)

How to delete your account.

You can request account deletion in either of the following ways:

In-app: open the app → Profile tab → Settings → Delete account, and confirm. Your account and all associated data are scheduled for deletion within 30 days.
By email: send a request from your registered email address to booking@ktivoyages.com with the subject "Account deletion". We respond within 7 days.

Deletion removes: your account profile, your trip enrolment, your booking history, your complaints and messages, your saved preferences, and your push notification token. Some records may be retained for legal or accounting reasons (e.g. invoice records) for the legally-required minimum period only.

8. Children's privacy

KTI Voyages is not directed at children under 13 and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. International data transfers

Our infrastructure may process data in regions outside Morocco (typically the European Union, the United States, or other regions where our cloud providers operate). All transfers are subject to appropriate safeguards (standard contractual clauses or equivalent).

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated in the app and the "Last updated" date at the top of this page will be revised.

11. Contact

For privacy questions, data requests, or to exercise any right described above, contact:

Email: booking@ktivoyages.com