Privacy policy

Gharmish — operated from Abha, Aseer region, Saudi Arabia, under commercial registration (CR) 7051409212 — is the controller of the personal data processed on this platform. For any privacy question or request, contact us at the address in "Your rights" below.

Account details you give us: your name, phone number, and email address. Booking details: the experience, date, group size, and any notes you share with a host. If you apply to host, we also collect identity-verification details — your legal name, national ID or commercial registration, date of birth, payout IBAN, and the documents you upload. They're used only to verify your application and pay your earnings, stored privately, and never shown to guests.

Payment is handled by our licensed payment provider — your card details go directly to them, and Gharmish never stores your full card number. We also keep technical records such as sign-in events and error logs to keep the platform secure and working.

To run your bookings and payments, send confirmations, reminders, payment links, and status updates by email or WhatsApp, answer support requests, prevent fraud and abuse, and meet our legal obligations. We don't sell your personal data. When you message our WhatsApp support line, your messages are stored so our team can help you; first replies may come from an automated assistant, and anything it can't resolve is passed to a person.

Your host sees what they need to run the experience: your name, group size, and — once a booking is confirmed — a way to coordinate with you. Hosts never see your payment details.

We use trusted service providers to operate the platform: payment processing (HyperPay), hosting (Vercel), databases and file storage (Supabase), email delivery (Resend), WhatsApp and SMS delivery (Twilio and Meta), error monitoring (Sentry), and — only if you consent in our cookie banner — site analytics (Google Analytics) and ad measurement (Snapchat and TikTok). They process data on our instructions only. We disclose data to authorities when Saudi law requires it.

Our databases are hosted with international cloud providers, including in the European Union. Wherever data is processed, we apply the same safeguards and handle cross-border transfers in line with the PDPL.

We keep booking and payment records for as long as needed to run your account and to meet Saudi tax and commercial record-keeping requirements. Data with no remaining purpose is deleted or anonymised. WhatsApp support conversations are deleted 12 months after the last message.

Under the PDPL you can ask what personal data we hold about you, request a copy, ask us to correct it, or ask us to delete what we're not legally required to keep.

To exercise any of these rights, write to us at hello@gharmish.com

We use the cookies the platform needs to work: keeping you signed in and remembering your language. If you choose "Accept all" in our cookie banner, we also set analytics cookies from Google Analytics to understand how the site is used, and marketing cookies from Snapchat and TikTok to measure how our ads perform; declining them changes nothing about how Gharmish works, and you can clear your browser cookies at any time to be asked again.

If we change how we handle personal data, we'll update this page and revise the date at the top. Significant changes will be flagged more prominently.