Privacy policy

1. Who is responsible for your data

Almusafir Holidays for Travel & Tourism is responsible for processing your data through SayiGo. Privacy contact: unified number and WhatsApp 920014410.

2. Data we collect

• Account data: the mobile number you verify with an SMS code, your name, and your email if you choose to add it.
• Technical data for security: your IP address in an encrypted, non-readable form, browser and device type, and sign-in dates — used to protect your account and prevent abuse of verification codes.
• One essential cookie that keeps you signed in. We do not use advertising or tracking cookies.
• Visa request data you submit on the platform or give our team: traveler details (name as in passport, passport number and expiry, nationality, date of birth, sex), passport copies, personal photos and supporting documents, and the travel date and appointment city. It is processed only to provide the service you requested.
• Payment data: payments are made directly through a licensed payment gateway (Moyasar). We never see or store your card number; we keep only the transaction reference, amount and status.
• Your chats with the «Sanad» AI assistant: your questions and its answers, the page you asked from, and one necessary cookie that identifies the chat and applies the daily question limit. We use them to answer you, improve the service and prevent misuse.

3. Why we use it

• To create your account, verify your mobile number and sign you in.
• To provide and follow up on the services you request, and to contact you about them.
• To protect the platform and accounts and to prevent fraud and misuse.
• To comply with legal requirements.
• We do not sell your data, and we do not use it for marketing without your consent.

4. Legal basis

We process your data based on your consent when you create an account, to perform a service you requested, to meet a legal obligation, or for a legitimate interest such as account security, within the limits allowed by law.

5. Sharing

• SMS provider: to send verification codes and service messages to your mobile.
• Payment gateway (Moyasar): to process online payments securely.
• AI provider (OpenAI): when automatic passport reading is enabled, the passport page image is sent to extract its details and show them to you to confirm or edit, with a request that the provider does not store it. This is an optional helper; you can always enter the details yourself.
• AI provider (Anthropic): when you use the «Sanad» assistant, your questions and part of the conversation are sent to generate the answer, without your account details or mobile number. Do not type passport, ID or card numbers in the chat.
• Hosting and database providers: to run the platform and store data securely.
• Official authorities, embassies, visa centres and relevant service providers: only as needed to provide the service you requested.
• When you contact us on WhatsApp, the conversation is also subject to WhatsApp's privacy policy.
• Some technical systems we rely on may be hosted outside Saudi Arabia. In that case we follow the cross-border transfer rules of the law and its regulations and limit the data to the minimum necessary.

6. Retention

• Account data: while your account is active, or until you ask us to delete it, unless the law requires us to keep it longer.
• Verification-code records: deleted automatically after 7 days.
• «Sanad» assistant chats: deleted automatically 90 days after the last message.
• Sign-in sessions: end after 30 days or when you sign out; their records are deleted later.
• Passport copies, personal photos and uploaded documents: deleted automatically from our servers as soon as the request is completed or cancelled; documents of unfinished drafts are deleted 30 days after the last change.
• Core request records (request number, service, amount, invoice, status): as long as needed to meet legal and accounting requirements.

7. Security

We use encrypted connections (HTTPS), never store verification codes in readable form, limit data access to authorised staff on a need-to-know basis, and apply sign-in attempt limits.

8. Your rights

• To be informed about how your data is collected and processed.
• To access your data and obtain a copy.
• To correct, complete or update your data. You can edit your name and email directly on your account page.
• To request destruction of your data when it is no longer needed, unless there is a legal reason to keep it.
• To withdraw your consent at any time, without affecting earlier lawful processing.
• To exercise your rights, contact us on 920014410. You may also file a complaint with the Saudi Data & AI Authority (SDAIA).

9. Minors

Accounts are for adults. Services for a minor are requested by the minor's guardian or legal representative.

10. Changes

We may update this policy when needed and show the last-updated date at the top. Material changes will be highlighted on the platform.