Privacy Policy

This Privacy Policy explains how Bayt Technologies LLC ("BaytTravel", "we", "us"), a company registered in the State of Qatar (CR No. [CR number], [registered address], Doha), collects, uses and protects your personal data when you use the BaytTravel website and Guest app as a guest. We are the controller of your personal data, as defined in Qatar Law No. 13 of 2016 on the Protection of Personal Data Privacy (PDPPL).

For questions about privacy, contact us at [privacy email].

Information you give us

• Account details: name, phone number, email address, profile photo (optional), preferred language, and password, or your Google or Apple sign-in identifier.
• Booking details: dates, number of guests, the property booked, special requests, and cancellation or change requests with their reasons.
• Messages: what you send to Hosts and to our support team through in-app chat or email.
• Reviews and other content you post.
• Identity verification: [Client to confirm: whether ID or passport details are collected from guests, and if so, why and for how long.]

Payment information

• Card payments are processed by Tap Payments. We receive limited details, such as the payment status, the amount, a transaction reference and possibly the card brand and last four digits. We do not receive or store your full card number or CVV.

Information collected automatically

• Device and usage data: device type, operating system, app version, IP address, pages and screens viewed, search filters, and crash or error logs.
• Location: if you allow it, your device location is used to show nearby properties and directions. You can turn this off in your device settings at any time.
• Cookies and similar technologies on the website (see section 10).
• Push notification token, if you allow notifications.

Information from others

• Hosts may give us information about your stay, for example reports of damage or rule breaches.
• Sign-in providers (Google, Apple) share your name and email address when you choose to sign in with them.

We use your personal data to:

• create and manage your account and verify your phone number or email;
• process bookings, take payments and issue refunds;
• share the details a Host needs to host you (see section 5);
• send booking confirmations, reminders, receipts and service messages by email, SMS, WhatsApp or push notification;
• enable chat between you and Hosts, and provide customer support;
• show maps, nearby properties and directions to your booked property;
• keep the Platform safe, including detecting and preventing fraud, abuse and security incidents;
• improve and fix the Platform, and understand how it is used;
• comply with the law, respond to lawful requests from authorities, and enforce our Terms of Use;
• send you marketing about offers and new properties, only where you have agreed. You can opt out at any time.

Under the PDPPL, we process your personal data:

• because it is necessary to provide the service you asked for, such as your account and your bookings;
• for our legitimate purposes, such as security, fraud prevention and improving the Platform, in a way that does not override your rights;
• to comply with legal obligations in Qatar;
• with your consent, for example for marketing, device location and push notifications. You can withdraw your consent at any time. This does not affect processing that already took place.

We do not sell your personal data. We share it only as follows:

• Hosts: when you book, the Host receives your name, booking details, number of guests, any special requests, and the messages you send them. [Client to confirm: whether the Host also sees your phone number.]
• Service providers who process data on our behalf under contract, and only for the purposes in this Policy:
  • Tap Payments: payment processing and refunds
  • Amazon Web Services (AWS): hosting our servers and database
  • Google / Firebase: account sign-in, phone verification, push notifications, and maps
  • Vercel: hosting our website
  • Brevo: sending emails
  • [SMS / WhatsApp provider, analytics or crash-reporting tools: client to confirm]
• Sign-in providers (Google, Apple), when you choose to use them.
• Authorities: when we are required by law, or to protect the rights, safety or property of our users, Hosts, the public or BaytTravel.
• Business transfers: to a buyer or successor if our business is merged, acquired or restructured, including within the Bayt Holdings group. Your data will remain protected under this Policy.

Some of our service providers store or process data outside Qatar. Our main servers are hosted by AWS in the United States, and Google, Brevo, Vercel and Tap may process data in other countries. When we transfer your data abroad, we do so as permitted by the PDPPL and take appropriate steps, such as contractual safeguards, to make sure it stays protected.

We keep your personal data only as long as we need it:

• Account data: while your account is open. After you close your account, we delete or anonymise it within [90 days], except where we must keep it longer.
• Booking and payment records: for [X years] after the booking, to meet accounting, tax and legal requirements and to handle disputes.
• Messages: for [X years] after the related booking, for support and dispute resolution.
• Logs and security data: for a limited period, usually no longer than [12 months].

We use technical and organisational measures to protect your personal data. These include encryption in transit (HTTPS), access controls that limit data to staff who need it, secure hosting, and payment processing through a PCI-DSS-compliant provider. No system is completely secure. If a data breach affects your personal data, we will notify you and the competent authority as required by the PDPPL.

Under the PDPPL, you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data, where we no longer need to keep it;
• withdraw consent at any time, for example for marketing, location or notifications;
• object to processing, including direct marketing;
• be informed before your data is processed and of any breach that affects you.

To use these rights, email [privacy email] or contact us through the app. We may need to verify your identity first. We will respond within [30 days]. If you are not satisfied, you can file a complaint with the competent authority in Qatar, the National Cyber Governance and Assurance Affairs (NCGAA) at the National Cyber Security Agency.

Our website uses cookies and similar technologies to:

• keep you signed in and remember your language;
• keep the site secure and working correctly;
• understand how the site is used so we can improve it [only if analytics are used: client to confirm].

You can control cookies in your browser settings. Blocking essential cookies may stop parts of the website from working.

The Platform is not intended for anyone under 18, and we do not knowingly collect personal data from children. Information about children travelling with an adult, such as the number of guests, is provided by the booking adult. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Policy from time to time. If we make a material change, we will notify you in the app, on the website or by email, and where required we will ask for your consent again. The date at the top shows when it was last updated.

Bayt Technologies LLC
[Registered address], Doha, Qatar
Privacy email: [privacy email]
Support: [support email] / [support phone]