Privacy
Privacy Policy
This policy explains what personal data the Nayfaat app and website collect, why we collect it, and what you can ask us to do with it. We collect only what we need to take and manage your booking. We do not sell your data, and we do not use it for advertising or tracking.
Who we are
Nayfaat is a private holiday house north-west of Riyadh, Saudi Arabia, together with the Nayfaat iOS app used to book it ("Nayfaat", "we", "us"). We are responsible for the personal data described here.
Contact us about privacy at privacy@vyspir.com.
What we collect
Your account
Your name and email address, and a password if you create one. Passwords are stored only as a secure hash by our authentication provider; we cannot see them. If you use Sign in with Apple, Apple gives us your name and either your email address or a private relay address, if you chose to hide it.
Your booking
Dates, number of guests, add-ons, promo code, any note to the host, the booking reference, prices, payment method and payment status.
Guest registration
Your mobile number, and your national ID, Iqama or passport number. Saudi guest-registration rules require us to hold this for every stay. You may also choose to upload a photo of your ID.
Payments
Payments are made by bank transfer. We keep the receipt image you upload so we can match it to your booking. The app does not collect or store card numbers.
Notifications
If you allow notifications, we store a push token for your device so we can send booking updates and your gate code.
On your device only
- Location: used once, on the map screen, when you tap "How far is it from me?". It is used on your device to calculate the distance and is never sent to us or stored.
- Photos and camera: only the image you choose to attach, such as a receipt or an ID.
- Calendar: the app adds your stay to your calendar only when you ask it to. It does not read your calendar.
- Your language, numeral and calendar preferences, and an unfinished checkout, are saved on your device.
How we use it
- To hold dates, take and confirm your booking, and check your transfer.
- To register guests as Saudi law requires.
- To send your confirmation, reminders and gate code by notification, WhatsApp or email.
- To answer your messages and provide support.
- To keep financial and tax records, and to meet our other legal obligations.
We rely on performing our contract with you, on our legal obligations, and, for notifications, on your consent, which you can withdraw at any time in your device settings.
Who we share it with
Only with the services that run the app, and only what each one needs:
| Service | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage for bookings, profiles, IDs and receipts | Servers in India |
| Apple | Sign in with Apple, and delivering push notifications | Global |
| Expo | Sending push notifications to your device | United States |
| MapTiler and OpenStreetMap | Map images. They receive your IP address when a map loads, not your identity | Europe |
| Only if you choose to message us there | Global |
Because some of these services are outside Saudi Arabia, your data is transferred abroad. We use providers that protect it with encryption and access controls.
We share guest-registration details with the competent Saudi authorities where the law requires it. We never sell personal data or share it for advertising.
How long we keep it
We keep your account while you use it. Booking, payment and invoice records are kept for as long as Saudi tax and accommodation regulations require, even after you delete your account.
When you delete your account in the app (Account → Delete account), your account and personal data are erased within 30 days, except the records we are legally required to keep.
Your rights
Under Saudi Arabia's Personal Data Protection Law you can ask to:
- know what data we hold about you and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data, subject to what we must keep by law;
- withdraw consent you have given.
Email privacy@vyspir.com. We will reply within 30 days. You can also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
Security
Data is encrypted in transit. Access to bookings, IDs and receipts is restricted by account: a guest can see only their own, and only the property owner can see all of them. ID photos and receipts are kept in private storage, never on a public link.
Children
Bookings must be made by an adult aged 18 or over. We do not knowingly collect data from children through the app.
Changes to this policy
If we change this policy we will update the date at the top, and tell you in the app if the change is significant.