Your data. Kept to what we need.

Gear House is a brand operated by , (RC , ICE ), which is the data controller for the personal data described here. Contact for anything about your data: .

We process personal data under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, and the GDPR where it applies to visitors in the European Union.

• Rental and crew requests (with or without an account): name, phone, email, company, ICE, shoot dates, location, project type, the gear and crew you ask for, and your messages. Why: to answer your request, prepare the quote, confirm the rental and invoice it. Basis: taking steps at your request before a contract, then the contract.
• Customer account (optional): name, email, phone, company, ICE, a password (stored only as a one-way scrypt hash, never readable) and your request history. Why: to fill in your details and show your requests in one place. Basis: your consent when you create the account.
• Crew profiles: see section 13 of our terms. What is public once approved, what stays private (email and phone), and how to delete your profile.
• Studio owners: contact details and studio information sent through “List your studio”. The owner's name, phone and email are never published.
• Partner and newsletter sign-ups: the details you enter in those forms, used only to answer you or send our news. Ask us at any time and we remove you from the list.
• At pickup: a copy of your ID (CIN or passport) and the deposit details, as described in our rental terms. ID copies are destroyed after return and settlement.
• Technical data: our server keeps short security logs (IP address, time, page) to stop abuse such as repeated login attempts. We do not use advertising trackers or analytics cookies.

• We only set cookies that are needed for the site to work: a sign-in cookie when you log in to your customer account, your crew space or the admin. They are HttpOnly, sent only over HTTPS, and expire on their own.
• Your gear list and the reference of requests you send are stored in your own browser (local storage) until you clear them. We don't see them until you send a request.
• No advertising, social-media or analytics cookies are used, so there is no consent banner to click.

We never sell your data. A few service providers process it on our behalf, only to run the site:

• Railway: hosts the website and its database (servers in the Netherlands, EU).
• Cloudflare: domain name system, security, and forwarding of emails sent to our @gearhouse.ma addresses.
• Resend: sends the emails the site generates (request confirmations, account and password emails), from servers in Ireland, EU.
• Google Fonts: serves the typefaces used on the pages, which means your browser contacts Google's servers.
• Anthropic: if you use the AI shoot planner, the brief you type (idea, budget, dates, city) is sent to Anthropic's Claude model to suggest a gear and crew list. Don't include personal details in your brief. When the AI planner is turned off, plans are built on our own server.
• WhatsApp (Meta) and your email provider: when you choose to contact us that way, their own privacy terms apply.

Some of these providers are based outside Morocco (EU and United States). Transfers are limited to what each service needs, and are made under the conditions set by Law 09-08.

• Requests that became rentals, and their invoices: for the period required by Moroccan accounting and tax law.
• Requests that didn't go ahead: up to 24 months, so we can follow up and see your history, unless you ask us to delete them sooner.
• Customer account: until you delete it. You can do that yourself from Account → Delete account.
• ID copies: destroyed after return and settlement of the rental.
• Security logs and daily backups: a few weeks, then overwritten.

Under Law 09-08 you can access your data, have it corrected, and object to its processing for legitimate reasons, including to any marketing. You can also ask us to delete it when we no longer need to keep it.

• With an account, you can see and edit your details and delete the account yourself.
• For anything else, write to or on WhatsApp. We answer within 30 days, and may ask you to confirm your identity first.
• If you're not satisfied with our answer, you can contact the Moroccan data-protection authority, the CNDP (cndp.ma).

The site runs only over HTTPS. Passwords are stored as salted scrypt hashes, sign-in sessions are random tokens stored in hashed form, login attempts are rate-limited, and the database is backed up daily. Only the Gear House team can see contact details in our admin.

If we change how we use your data, we update this page and its version date. For important changes affecting account holders, we'll also tell you by email.