Privacy Policy & Data Protection

• Identity Verification Data: Full legal name, National ID or Iqama number, date of birth, and nationality authenticated through official channels (Elm Yaqeen and Nafath).
• Contact & Account Details: Verified Saudi/international mobile number (confirmed via OTP), email address, preferred language, and national city/district details.
• Host & Listing Records: Property title, address details, Ministry of Tourism license numbers, ownership or sublease authorization proofs, photos, and bank IBAN / payout preferences.
• Booking, Communication & Access Logs: Stay dates, guest counts, support inquiries, Host Protection claims, and check-in / manual Smart Lock instructions.
• Payment & Transaction Records: Payment confirmation IDs, SADAD references, refund adjustments, and ZATCA Phase-2 tax invoices. Raw credit card numbers are never stored on QafNest servers and are processed solely via SAMA-regulated PCI-DSS gateways.
• Device, Technical & Location Data: IP address, browser/OS metadata, diagnostics, cookies, and approximate map coordinates where enabled to show nearby accommodations.

We process personal data lawfully to execute accommodation contracts between Guests and Hosts, validate mandatory guest and property permits under Ministry of Tourism bylaws, disburse host earnings and maintain ZATCA tax ledgers, investigate disputes or Host Protection claims, prevent fraud, and improve platform reliability. Promotional messages are sent only with prior consent and can be opted out of anytime.

QafNest never sells or trades your personal data. Disclosure is strictly limited to:

• Confirmed Stay Counterparty: Sharing verified Guest name and contact phone with the Host (and property location/Host contact with the Guest) strictly to coordinate arrival and check-in.
• Authorized Infrastructure & Financial Partners: Licensed Saudi payment processors (MyFatoorah/Mada), national identity providers (Elm/Nafath), and vetted cloud/SMS vendors under strict confidentiality agreements.
• Saudi Competent Authorities: Ministry of Tourism, ZATCA, SDAIA, security or judicial bodies where required by valid Saudi law or official request.

All platform databases are hosted in compliance with Kingdom data residency rules. Transmissions are secured via TLS 1.3 and sensitive fields via AES-256 encryption with strict role-based access controls.

Retention Period: Personal data is retained only as long as needed to deliver bookings, manage Host Protection disputes, and comply with statutory Saudi accounting, ZATCA tax (minimum 5–6 years), and Ministry of Tourism record obligations, after which it is securely destroyed or anonymized.

QafNest uses essential authentication cookies, localization preferences (Arabic/English & theme), and aggregated analytics to keep sessions secure and fast across web and mobile. Full details and browser controls are provided in our Cookies Policy.

Under the Saudi Personal Data Protection Law, you enjoy the following statutory rights:

• Right to Be Informed & Access: Know the legal basis for collecting your data and request a readable copy of your stored records.
• Right to Rectification & Updating: Correct or complete inaccurate personal information via your account profile or DPO request.
• Right to Erasure & Withdraw Consent: Request destruction of personal data once mandatory retention windows expire, and withdraw marketing consent anytime.

Response SLA & Escalation: Our Data Protection Officer responds to verified rights requests within 30 days. If you remain dissatisfied with how your privacy inquiry or complaint was handled, you retain the right to lodge a complaint with SDAIA or the National Data Governance Platform (DGP).

We may revise this Privacy Policy periodically as regulations or platform features evolve, with changes taking effect upon publication. For inquiries, consent withdrawal, or PDPL requests, contact our Data Protection Office: