Privacy policy

This policy describes the processing of personal data carried out on cigara.ma, published by UXS SARL AU (Rabat, Morocco), in accordance with Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data and its implementing texts.

What we collect, and nothing else

The site collects a single piece of data, and only if you provide it voluntarily: your email address, entered in the “get notified at opening” sign-up form.

The site uses a single advertising tracker, the Meta pixel, described below. To measure traffic, five audience measurement tools are in place:Ahrefs Analytics, cookieless, which counts page views in aggregate, and Google Analytics (Google LLC), which sets audience measurement cookies (the _ga prefix) to distinguish visitors and sessions, under the terms of Google’s privacy policy. These statistics serve only to understand how the site is used; you can block these cookies in your browser with no effect on your browsing.

The third is Microsoft Clarity (Microsoft Corporation), which records browsing behaviour within the page anonymously — scrolls, clicks, heat maps — to spot what hinders reading. It sets the _clck and _clsk cookies and masks input fields, under the terms of Microsoft’s privacy statement. These recordings serve only to improve the site and can also be blocked from your browser.

The fourth is Cloudflare’s audience measurement (Cloudflare, Inc.), the site’s host, which counts page views and loading timeswithout any cookie and without identifying visitors.

The fifth is PostHog (PostHog, Inc.), which measures how some of the site’s features are used — sign-up, language or theme changes, reading a guide to the end, clicks on maps and external links — to learn what is genuinely useful. It sets no cookie: a random identifier is kept in the browser’s local storage (a key starting with ph_), and it receives the IP address, from which it infers country and city. If you sign up, your email address is sent to it to link your visits to your sign-up (see below). The data is hosted in the United States, under the terms ofPostHog; clearing the site’s data in your browser deletes this identifier.

Finally, for visitors connecting from Morocco only (based on their IP address), the site uses one advertising tracker: the Meta pixel (Meta Platforms, Inc.), which tells Meta which pages are viewed in order to measure the effectiveness of adverts shown on Facebook and Instagram and to target their audience. It sets the _fbp cookie and sends Meta the IP address, the pages viewed and browser information; Meta may link this data to your Facebook or Instagram account if you have one, under the terms of Meta’s privacy policy. You can block it in your browser and control the advertising use of this data in your Meta account settings. Outside Morocco, it is not loaded at all. If you sign up from Morocco, your email address is also sent to Meta, in hashed form (see below).

Purpose and legal basis

Your email address is first used to inform you of the opening of the CIGARA boutique and, where relevant, of the house’s news. The legal basis for this processing is your consent, expressed by submitting the form. It is also used, in the PostHog measurement tool, to link your sign-up to the pages you have viewed and will view on the site from the same browser, to understand what leads people to sign up. For sign-ups made from Morocco, it is also sent to Meta in hashed form (SHA-256), to measure sign-ups resulting from its adverts. No automated decision is based on it.

How the collection works

The form sends your address to a Google Forms form operated by the house. It is therefore processed by Google LLC as a technical processor, and may as such be stored on servers located outside Morocco, under the terms of Google’s privacy policy.

Recipients and retention

The addresses collected are accessible only to the UXS SARL AUteam. They are neither sold, nor rented, nor shared with third parties for commercial purposes. They are kept until the boutique opens and, at the latest,twelve months after collection if you have not responded, or deleted immediately upon simple request.

Your rights

In accordance with law 09-08, you have the right to access, rectify and object to the processing of your data, as well as the right to withdraw your consent at any time. To exercise these rights, write to contact@cigara.ma; we reply within ten working days. You may also refer the matter to the CNDP(Commission nationale de contrôle de la protection des données à caractère personnel), the competent Moroccan authority.

Security

The site is served entirely over HTTPS. The form submission is encrypted end to end up to Google’s servers. No data is stored on the site’s own servers, as the site is entirely static.

Changes to this policy

This policy may evolve when the boutique opens, in particular if new processing appears (orders, delivery). The date of the last update and any substantial change will be indicated on this page.

Last updated: 27 September 2026, addition of the Meta advertising pixel for visitors from Morocco, and hashed transmission of sign-up addresses to Meta.