Privacy Policy

Hajz Shahr is committed to protecting its users' privacy and safeguarding their personal data. This policy explains how your information is collected, used, and protected when you use the platform. This policy applies to all platform users (website and app), and is subject to Saudi Arabia's personal data protection regulations.

We collect the following types of information: • Identity data: Full name, mobile number, email address • Booking data: Stay dates, guest information, selected payment method • Usage data: Pages you visit, session duration, device and browser type • Communication data: Support messages and communications with our team • Image files: Property images uploaded by owners

We use the information we collect to: • Create and manage your account • Process and confirm booking requests • Communicate with you about your bookings and inquiries • Improve platform services and user experience • Send notifications related to your account and bookings • Comply with legal and regulatory requirements

We do not sell your personal data. We share your data only in the following cases: • With owners: We share the booking data necessary to complete the reservation • Technical service providers: Oracle Cloud (Jeddah, Saudi Arabia) to host and run the platform and its database, and Supabase (Frankfurt, EU) for stored payment receipts and compliance files until they are migrated • SMS provider: We use 4jawaly to send verification codes and booking messages to your phone number • Email provider: We use Resend to send confirmation and password-reset messages • Google sign-in: If you choose to sign in with Google, we receive only your name and email address from them • Analytics: We use Google Analytics, through Google Tag Manager, to measure how the site is used — see section 5 • Legal authorities: When formally required by the competent authorities in Saudi Arabia None of these providers is permitted to use your data for their own purposes.

We use essential cookies to: • Maintain your login session • Remember your basic preferences We also use Google Analytics cookies to measure how the site is used. We do not use cookies for advertising or share data with ad networks.

We apply strict security standards to protect your data: • Encryption in transit (HTTPS/TLS) • Password encryption using secure algorithms (bcrypt) • Data access restricted to authorized platform staff only • Regular security system reviews

You have the following rights regarding your personal data: • Access: Request a copy of your stored data • Correction: Correct inaccurate data • Deletion: Request deletion of your account and data • Objection: Object to processing your data for certain purposes To exercise any of these rights, contact us at: support@hajzshahr.com

• Account data: Retained as long as your account is active • Booking data: Retained for 5 years for legal and financial purposes • Session data: Automatically deleted after 7 days of expiry • Upon account deletion: Your personal data is deleted within 30 days

Our platform is intended for users 18 years and older. We do not intentionally collect data from minors. If we discover that a minor has registered, we will immediately delete their account.

We may update this policy from time to time. We will notify you of any material changes via email or in-platform notification. Continued use of the platform after updates are published constitutes your acceptance.

For any inquiries about this policy or your personal data: • Email: support@hajzshahr.com • WhatsApp: 0555131881 • Address: Saudi Arabia

The platform and its database are hosted on servers inside the Kingdom of Saudi Arabia (Oracle Cloud, Jeddah). Some uploaded documents — payment receipts and compliance files — are still stored with our provider Supabase inside the European Union (Frankfurt, Germany) while they are migrated into the Kingdom. For that data, this means it is transferred to and stored outside the Kingdom. We take care that this transfer complies with the Personal Data Protection Law, and that our provider maintains an adequate level of protection through encryption in transit and at rest, and strict access controls. By using the platform you acknowledge that you have been informed of this.