Legal
Privacy policy
What we collect, why, and the choices you have — in plain language, under the Saudi Personal Data Protection Law (PDPL). Last updated 6 July 2026.
What we collect
Account details you give us: your name, phone number, and email address. Booking details: the experience, date, group size, and any notes you share with a host.
Payment is handled by our licensed payment provider — your card details go directly to them, and Gharmish never stores your full card number. We also keep technical records such as sign-in events and error logs to keep the platform secure and working.
How we use it
To run your bookings and payments, send confirmations, reminders, payment links, and status updates by email or SMS, answer support requests, prevent fraud and abuse, and meet our legal obligations. We don't sell your personal data.
Who we share it with
Your host sees what they need to run the experience: your name, group size, and — once a booking is confirmed — a way to coordinate with you. Hosts never see your payment details.
We use trusted service providers to operate the platform — payment processing, hosting, databases, email and SMS delivery, and error monitoring — and they process data on our instructions only. We disclose data to authorities when Saudi law requires it.
Where your data lives
Our databases are hosted with international cloud providers, including in the European Union. Wherever data is processed, we apply the same safeguards and handle cross-border transfers in line with the PDPL.
How long we keep it
We keep booking and payment records for as long as needed to run your account and to meet Saudi tax and commercial record-keeping requirements. Data with no remaining purpose is deleted or anonymised.
Your rights
Under the PDPL you can ask what personal data we hold about you, request a copy, ask us to correct it, or ask us to delete what we're not legally required to keep.
To exercise any of these rights, write to us at hello@gharmish.com
Cookies
We use only the cookies the platform needs to work: keeping you signed in and remembering your language. No advertising or cross-site tracking cookies.
Changes to this policy
If we change how we handle personal data, we'll update this page and revise the date at the top. Significant changes will be flagged more prominently.