Privacy policy

Last updated: 23 October 2026

Who we are

Samarkand Bakery is a home bakery in Tetouan, Morocco. We are responsible for the personal data described on this page. Questions and requests: orders@samarkandbakery.com or WhatsApp +212 680 342 679.

What we collect and why

• When you order: your name, phone number, the items, the collection date and time, and any note you add. Your email address is optional; we use it for the order confirmation and for loyalty points. If delivery is offered and you choose it, we also keep the delivery address and the map position you pick.
• Payment: most orders are paid in cash at collection. If you pay with PayPal, PayPal processes the payment under its own privacy policy; we receive only a confirmation and a PayPal reference, never your card details.
• My Samarkand account: you sign in with your email and a one-time code, with no password stored. The account shows your orders, saved details (name, phone, address, language) and loyalty points. Reminders on your phone are sent only if you turn them on, and offers only if you opt in. You can switch both off at any time.
• Loyalty points: 5% of each order comes back as points linked to your email; points expire after 12 months.
• Reviews: if you leave a review, we publish your first name, rating and text. Google reviews shown on the site come from Google.
• Enquiries and bookings: what you write in the contact or events forms, and the phone number used for a Free Karak booking (so each person can book once).
• Technical data: our server keeps short-lived logs (IP address, pages, time) for security, and Google Analytics gives us anonymous statistics about how the site is used. Your basket is stored in your own browser.

We use this information only to prepare and hand over your order, contact you about it (usually on WhatsApp), send confirmations and reminders, run the loyalty programme, answer your messages and keep the site secure. We do not sell your data and we do not send marketing unless you have opted in.

Cookies

A session cookie remembers your language. When you sign in to My Samarkand, a sign-in cookie keeps you signed in for 30 days. Google Analytics sets its own cookies for anonymous statistics; you can block them in your browser without affecting your order.

Who we share it with

• Hosting: our site and data run on a server in Germany (Hetzner), in the European Union, with daily backups.
• Email delivery: providers that send our confirmation and reminder emails.
• PayPal when you pay online, and Google for analytics, maps and the display of Google reviews.
• Internal alerts: new orders are sent to the bakery owner's phone (Telegram) so they can be prepared.

Ordering through an AI assistant

You can use an AI assistant such as Claude or ChatGPT to browse our menu, check availability and place a pre-order, through our Model Context Protocol connector. The assistant's provider receives what you type under its own privacy policy. If you sign in through an assistant, we give it an access key limited to your own account, valid for up to 30 days; you can remove it at any time from the assistant's settings, and every action taken through it is logged. We never share your data with an assistant you did not connect yourself.

How long we keep it

Orders are kept while you have an account and as long as the law requires for accounting. Sign-in codes expire after 15 minutes. You can ask us to delete your account data, your reviews or your saved details at any time.

Your rights

Under Morocco's Law 09-08 on the protection of personal data, you can ask to see, correct or delete the information we hold about you, and object to its use. Write to orders@samarkandbakery.com or message us on WhatsApp; we answer within 30 days. Our services are not aimed at children under 16, and we do not knowingly collect their data.

Changes

If this policy changes, we update the date at the top of this page.