Privacy Policy
Last updated: 2026-07-15 · العربية
1. Data Collected
The following data is collected from three sources: (a) From the identity provider upon sign-in: name, email address, profile photo, and provider identifier (Google is the currently enabled provider). (b) Data provided by the user: nationality, for the purpose of personalizing visa information; countries visited by the user with optional details including dates, duration of stay, trip type, and notes; the user's contributions to the Platform, including reviews, photos, suggested places, questions and answers, phrases, votes, ideas, and complaints; and the user's profile privacy preference. (c) Data collected automatically: sign-in session data via a single cookie; moderation logs of the user's actions; interactions necessary to operate Platform features such as followed countries and notification preferences; and approximate usage data used to prioritize page updates.
2. Processing of Photo Data
Every photo uploaded by the user undergoes re-encoding immediately upon receipt, during which all metadata (EXIF), including geographic location coordinates, is removed prior to any storage. The Platform does not store the capture location of any photo under any circumstances.
3. Data Not Collected
The Platform does not collect precise geographic location, payment data, biometric data, or the user's browsing history outside the scope of the Platform.
4. Purposes of Data Use
The collected data is used for the following purposes: providing the service, including profile management, nationality-based content personalization, and sending notifications; content moderation, carried out through automated checks that filter content and refer it for review, with decisions on sensitive matters remaining subject to mandatory human review by the Platform's staff; improving content by extracting factual updates from public reviews; preparing aggregated, anonymized statistics; and ensuring safety and legal compliance.
5. Future Commercial Uses
The Platform may in the future offer aggregated insight products or licensed APIs. Individual user data is never sold or shared under any circumstances; any use beyond the public display of the user's content is limited exclusively to aggregated, anonymized form.
6. User Rights under the Personal Data Protection Law
The user has the right, under the Saudi Personal Data Protection Law, to access their data, correct it, delete it, and withdraw consent to its processing. These rights are exercised through: the “Export My Data” button in profile settings, which generates an immediate copy of the data; the “Private Complaint” channel within the “Contribute to Rahhala” system, dedicated to privacy requests and routed directly to management; or via the privacy email published in the site footer.
7. Data Retention Periods
Account data is retained until the account deletion date, followed by a reasonable clearing window. Moderation logs are retained for accountability and compliance purposes. Public content integrated into the Platform's structure is governed by the license clause set out in the Terms of Use, whereby the content remains while its attribution to personal identity is removed.
8. Cross-Border Data Transfer
Data may be processed by processors located outside the Kingdom of Saudi Arabia, including: cloud hosting providers (European Union), file storage and content-delivery network providers (Cloudflare), and an AI processing provider (Anthropic, United States) used exclusively for moderation checks and automated summaries.
9. Breach Notification and Contact Point
In the event of any breach affecting user data, the Platform is committed to notifying the competent authorities and affected individuals as required by law. The designated privacy contact point is published in the site footer and via the Private Complaint channel.
10. Cookies, Storage, and Children's Data
The Platform uses only essential cookies required for it to function: a sign-in session cookie, a cookie that stores your own cookie-consent choice, and locally stored interface preferences. Aggregate visitor statistics (page counts and traffic sources) are collected without individual tracking. Through the “Cookie settings” control in the site footer, the Platform provides optional analytics and marketing cookie categories that are turned off by default and are used only after your prior, affirmative opt-in, which you may change or withdraw at any time — rejecting is as straightforward as accepting. No third-party analytics or marketing cookie is active at this time; these categories exist so that any such tool could be enabled only after consent, and this section will be updated to name the processor before any is enabled. The minimum age is as specified in the Terms of Use, and the Platform does not knowingly collect data from anyone below this age; if the Platform becomes aware of an account belonging to a minor, that account is deleted.