Privacy policy
Last updated 1 August 2026
This policy explains what personal data we collect, why we collect it, and the rights you have over it under the Saudi PDPL and, where applicable, the GDPR.
1. What we collect
Account data: name, email, phone, password hash, and your language and currency preferences.
Booking data: guest names, travel dates, party composition, special requests and arrival time.
Payment data: we never store card numbers. Payments are handled on the gateway's hosted form; we retain only a token, the last four digits and the transaction reference.
Usage data: pages viewed, searches performed and device information, used to improve the product.
2. Why we use it
To create and manage your booking, issue vouchers and invoices, and pass the details the property needs to host you.
To provide customer support and resolve disputes.
To send transactional messages. Marketing email is sent only with your consent and every message carries an unsubscribe link.
3. Who we share it with
The accommodation provider for your booking, limited to what they need to host you.
Payment processors, and our email and SMS providers, acting on our instructions.
Authorities where we are legally required to disclose.
4. Where it is stored
Personal data of customers in Saudi Arabia is stored in-region where required by the PDPL. Backups are encrypted at rest.
5. Your rights
You can access, correct, export or delete your data from your account settings, or by emailing privacy@aalmitravel.com.
We retain booking records for the period required by tax and accounting law, after which they are deleted.