Privacy Policy

Information We Collect

We collect the following categories of information when you use the Platform:

• Account and profile information — your name, email address, phone number, profile photo (if you upload one), preferred language, and time zone. If you sign in with Google or Apple, we receive the basic profile details those providers share (such as your name and email address).
• Booking and ticket information — the experiences you book, booking references, dates, number of guests, ticket QR codes, and your booking history.
• Payment information — payments are processed by our licensed payment partners (AlinmaPay for Mada, Visa, Mastercard, Amex, Apple Pay, STC Pay and SADAD; Tamara for "Split in 4" instalments). Your card or account details are entered on the payment provider's secure pages and never stored on our servers. We keep only the transaction outcome: amount, currency, status, and a payment reference.
• Communications — messages you send us through the contact form, replies and messages you exchange with us on WhatsApp, and records of the transactional notifications we send you (for example booking confirmations and login codes).
• Reviews and content you submit — ratings, reviews, and any other content you choose to post on the Platform.
• Device and usage information — IP address, browser and device type, pages viewed, and general usage data collected through server logs and cookies or similar technologies (see our Cookies Policy).

How We Use Your Information

• To provide the service: create and manage your account, process bookings, deliver e-tickets with QR codes, and enable entry at the experience.
• To communicate with you: send transactional notifications (booking confirmations, ticket delivery, cancellations, refunds) via WhatsApp, SMS, or email, and deliver one-time passcodes (OTP) so you can sign in securely.
• To process payments and refunds through our payment partners, and to keep the financial records we are legally required to keep (including VAT e-invoicing under Saudi ZATCA regulations).
• To provide customer support and respond to your enquiries.
• To improve the Platform: understand how it is used, fix problems, and develop new features.
• To measure advertising, only with your consent: if you accept marketing cookies, we use the Meta Pixel and Meta Conversions API to measure how well our advertising performs (see "Advertising Measurement and Consent" below).
• To protect the Platform and our users: prevent fraud, abuse, and unauthorized access, and to comply with legal obligations.

Legal Bases for Processing

We process your personal information under the Saudi Personal Data Protection Law (PDPL) on the following bases: performance of our contract with you (providing bookings and tickets), your consent (marketing measurement cookies and, where required, specific communications), our legitimate interests (securing and improving the Platform), and compliance with legal obligations (tax, invoicing, and regulatory requirements).

How We Share Your Information

We do not sell your personal information. We share it only with the parties below, and only to the extent needed to run the service:

• Experience providers (vendors) — the vendor hosting the experience you booked receives the details needed to fulfil it, such as your name, booking reference, party size, and slot time.
• Payment providers — AlinmaPay and Tamara process your payments under their own security standards and privacy policies.
• Meta Platforms — we use the WhatsApp Business Cloud API to send you transactional messages and login codes on WhatsApp, and, only if you have consented, the Meta Pixel / Conversions API for advertising measurement.
• SMS providers — to deliver one-time passcodes by SMS where WhatsApp delivery is not available.
• Infrastructure providers — our hosting, storage, and content-delivery partners (such as DigitalOcean and Cloudflare) that run the Platform securely.
• Authorities — where disclosure is required by law, court order, or a competent government authority.

Advertising Measurement and Consent

When you first visit the Platform we ask whether you accept marketing cookies. If you decline, the Meta Pixel is never loaded, no advertising cookies are set, and no measurement events are sent — the Platform works exactly the same. If you accept, we send purchase and browsing events to Meta (via the Pixel in your browser and a server-side Conversions API copy) to measure our advertising. You can change your choice at any time using the "Manage cookies" control in the page footer.

Data Retention

We keep your information for as long as your account is active or as needed to provide the service. Booking and payment records are retained for the periods required by Saudi tax and commercial regulations (including ZATCA e-invoicing requirements), even after an account is deleted. Communications logs are kept for as long as needed for support, dispute resolution, and service quality.

Your Rights

Under the PDPL you have the right to:

• Know how your personal information is collected and used.
• Request access to a copy of the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information (see "Data Deletion" below).
• Withdraw consent at any time for processing that is based on consent, such as marketing measurement cookies.

To exercise any of these rights, contact us using the details in the "Contact Us" section. We will respond within the timeframes required by applicable law.

Data Deletion

You can request deletion of your account and personal information at any time:

1. Email us at [email protected] from the email address registered to your account, with the subject "Data deletion request", or
2. Send us a request through the Contact Us page on the Platform.

We will verify the request, delete or anonymize your personal information, and confirm completion — except for records we are legally required to retain (such as tax invoices and payment records), which are kept only for the mandatory retention period and then deleted.

Data Security

We protect your information with industry-standard measures: encrypted connections (HTTPS/TLS) across the entire Platform, encrypted storage of credentials, access controls limiting who can view personal information, and signed, verifiable ticket QR codes. No card or bank details are stored on our systems.

International Data Transfers

Our service providers may store or process information on secure servers located outside Saudi Arabia. Where that happens, we ensure the transfer complies with the PDPL and that the information receives an adequate level of protection.

Children's Privacy

The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from children. Bookings that include minors are made and managed by an accompanying adult.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows the current version. For material changes we will provide notice on the Platform or by email before the change takes effect.

Contact Us

For any privacy question, request, or complaint, contact us at [email protected] or through the Contact Us page on the Platform. If you believe your data protection rights have been infringed, you may also lodge a complaint with the competent data protection authority in Saudi Arabia.