1. Scope and age

This policy applies to the Maraheb app and its services for users in Syria. Account creation and booking requests require the user to be at least 18. We do not ask for a date of birth; we record an age declaration.

2. Data we process

• Account data: display name, email address, hashed password and session data.
• Usage data: travel preferences, saved places, notification choices, reviews and information reports.
• Chats: user questions, AI replies and conversation history linked to a session or account.
• Bookings when activated: booking requests, request status, payment and refund references. We do not store card numbers or wallet credentials.
• Limited technical data: security and error logs plus identifiers used to limit misuse. The public website uses no advertising cookies or analytics.

3. How we use data

We use data to create and protect accounts, save choices, operate the AI companion, show relevant content, process information reports, provide support, manage bookings when activated, protect the service and meet approved legal and accounting duties.

4. AI companion

When the AI companion is used, Maraheb's server sends the question, a limited recent conversation history and relevant public travel records to DeepSeek to produce a reply. A pseudonymous identifier is sent instead of the user's email address. Users should not enter sensitive personal information in chat.

5. Service providers

• Supabase: authentication, database, storage and server functions.
• DeepSeek: AI companion replies.
• Zoho Mail: account codes and service email.
• hCaptcha: human verification and misuse reduction.
• Cloudflare: hosting for the public policy and support pages.
• Apple Maps or the selected maps app: opened at the user's request and governed by the selected service's policy.

These providers process data within their service role and under their applicable policies and agreements.

6. Retention

• Guest sessions and chats: 30 days after last use.
• Account chats: 12 months after last activity.
• Reports and support records: 24 months after closure.
• Booking, payment and refund data: 7 years for accounting and dispute handling, with personal data kept to a minimum.

7. Sharing and sale

We do not sell personal data. Data may be shared with the service providers named above, when required by law, or to protect users and the service from fraud and misuse.

8. User choices

Users can change their email and preferences or delete their account inside the app. Access, correction and deletion requests can be sent to the email on this page. We may verify account ownership before processing a request.

9. Account deletion

Accounts with no booking or payment records are deleted after verification. Requests linked to records that must be retained enter review, and data that does not need to be kept is deleted. Full steps are on the Delete Account page.

10. Security and changes

We use access controls, encryption in transit and usage limits to protect data. No service is completely free of risk. Updates to this policy will show a new version number and effective date.

11. Contact

For privacy questions or data requests, contact Ashraf Saleem at ashraf-saleem@outlook.com.