Privacy notice

What NIYA collects

• Account: your email address and password. Sign-in is handled by our authentication provider, Supabase. Passwords are securely transmitted to the sign-in service and are not stored in NIYA profiles or logged by NIYA.
• Profile: name, phone number and adult-eligibility confirmation. Age, sex, nationality and passport issuing country are optional. NIYA does not collect passport numbers or passport images.
• Browser-saved planning: journey and service preferences, including pickup/drop-off addresses and any text entered in service fields, are kept in this browser tab until it closes. If you explicitly choose to keep your plan on this device, these details are stored for up to 14 days. Contact details, the separate private notes field, passwords and documents are excluded. Saved drafts are associated with the verified account after sign-in and are removed on account changes or sign-out. Remove the saved plan from the Plan your journey page. The public visa checker does not save your answers.
• Travel requests: the details you enter, such as dates, destinations, travellers, hotel, flight, transfer and guide preferences.
• Merchandise requests: products, quantities and options, and your delivery city and address.
• Partner applications: business and contact details, and private business documents (Commercial Registration, VAT registration certificate, bank account/IBAN confirmation, applicable supplier licences, insurance and authority to supply) with extracted validity information and review results.
• Security: temporary rate-limit counters use hashed identifiers to limit abusive account and purchase attempts. They are deleted after their expiry retention window.
• Terms acceptance records: which policy version you accepted, when, and for which action (for example sign-up or a travel request).

Why NIYA uses it

• To create and secure your account and send account emails (such as sign-up and password reset).
• To verify your requests with suppliers and sellers, send you quotes and confirm bookings and orders.
• To contact you about your requests.
• To review partner applications and keep partner verification current.
• To keep records of what you accepted, and to meet legal, tax and dispute-handling needs.
• To keep the platform secure and prevent misuse.

Who receives your data

Service providers that process data for NIYA

• Cloudflare — website hosting, database (D1) and file storage (R2).
• Supabase — authentication. Resend delivers account confirmation and password-reset emails through the configured account email service. When enabled, Resend also processes operational email addresses, request references and brief update messages. Private supplier notes and uploaded documents are not included in these messages.

Suppliers and sellers

Airlines, hotels, transport operators, guides and sellers receive only what they need to verify and fulfil your request. Merchandise sellers see limited order details — product, quantity, option, delivery city and status. Your contact and address details are shared with a seller only as needed after your order is confirmed.

Others

NIYA does not sell personal data or share it for advertising. NIYA may disclose data where required by law or by a competent authority.

Partner business documents

Documents uploaded with a partner application are stored in private Cloudflare R2 storage. They can be downloaded only by the applicant and by authorised NIYA reviewers. Embedded PDF text is extracted privately within NIYA hosting for conservative expiry checks. Images, scans, commercial-registration status and unclear dates require human review. An automatic result can be challenged through the partner dashboard. Files are not sent to a new external AI or OCR provider. We retain bounded date evidence and the review audit, rather than publishing extracted financial text.

How long NIYA keeps data

NIYA keeps your data while your account is active and as needed for legal, tax and dispute purposes. After that it is deleted or anonymised.

Your rights

Subject to applicable law, you can ask NIYA to:

• give you access to the personal data NIYA holds about you;
• correct data that is wrong or incomplete;
• delete your data where NIYA no longer needs to keep it;
• withdraw consent you gave for processing that relies on consent.

To make a request, email info@niyatravels.com. NIYA may need to confirm your identity first.

If you are not satisfied with NIYA’s response, you can complain to the competent Saudi authority. The Saudi Data & AI Authority (SDAIA) is the competent authority for the Personal Data Protection Law.

Children

NIYA account holders must be 18 or older. If an adult includes a child as a traveller in a request, the adult is responsible for providing the child’s details.

Security

NIYA uses access controls, private storage for business documents and an established authentication provider. No system is perfectly secure; if NIYA becomes aware of a breach affecting your data, it will act as required by applicable law.

Changes to this notice

NIYA may update this notice. Each version has a date, and NIYA will ask you to review the new version when you next accept the NIYA terms.

Related official information

These official Saudi government pages are provided for reference only. They are not part of this policy, and NIYA does not summarise them here. Your rights come from the law itself.

• Personal Data Protection Law — official English text (PDF), Saudi Data & AI Authority (SDAIA)
• National Data Governance Platform — SDAIA (Arabic)

Contact NIYA

Questions, requests or complaints about this policy:

• Email: info@niyatravels.com
• WhatsApp: +966 50 006 7830

Open items for legal review