Privacy Policy

• Account data: name, email, password (encrypted) or Google sign-in details.
• Verification data: full name, passport number and nationality read from your passport photo, or the last 4 digits of your National ID / Iqama. The passport photo itself is analysed and immediately discarded — never stored.
• Host profile data: photos, bio, languages, hobbies, experiences, prices, gender and an approximate location (about 1 km) if you choose to share it.
• Booking data: dates, number of guests, services, notes, amounts, agreement references and reviews.
• Messages you send in in-app chat (phone numbers, emails and links are hidden automatically).
• Technical data: device, browser and basic usage logs needed to keep the service secure.

• To create and run your account and verify identities (performance of contract and legal obligation).
• To process bookings, invoices, payouts and VAT records (contract and legal obligation).
• To send service emails such as booking updates and host decisions (contract).
• To keep the Platform safe, prevent fraud and resolve disputes (legitimate interest).
• To improve matching and AI search suggestions using the description you type (legitimate interest). We do not sell your data.

Hosts see the first name, dates, group size and messages of visitors who contact or book them; visitors see public host profiles. We use trusted service providers for hosting, database, email delivery, maps and AI processing, bound by confidentiality and data protection terms. We disclose data to authorities when required by Saudi law.

Some of our service providers may process data outside the Kingdom. Where this happens we rely on the transfer conditions set out in the PDPL and its Transfer Regulation, and apply appropriate safeguards.

We keep account data while your account is open. Booking, invoice and tax records are kept for the period required by ZATCA and commercial record-keeping rules (generally up to 10 years). Chat messages are kept for up to 2 years for dispute and safety purposes. Other data is deleted or anonymised when no longer needed.

Under the PDPL you have the right to:

• Be informed about how your data is used.
• Access and obtain a copy of your data.
• Correct inaccurate or incomplete data.
• Request deletion of data that is no longer needed, subject to legal retention.
• Withdraw consent where processing is based on consent.
• Complain to SDAIA if you believe your rights were breached.

We use encryption in transit, row-level access controls so users only see their own private data, private storage for host photos with temporary links, and server-side verification. No system is perfectly secure; please tell us immediately if you suspect misuse of your account.

We use essential cookies and local storage to keep you signed in and remember your language. See the Cookie Policy in our Site Policies.

Saudi HOST is not intended for anyone under 18. Minors may join an experience only as part of a group booked by a parent or guardian.

For privacy requests write to support@saudihost.app. We respond within 30 days.