Privacy Policy & Terms of Use سياسة الخصوصية وشروط الاستخدام

Welcome to Zawaya AI. We are committed to protecting your privacy and the confidentiality of your data. This policy explains how we collect, use, and protect data while you use our intelligent assistant inside the hotel, with reference to the Saudi Personal Data Protection Law (PDPL).

Who is responsible for your data

Two parties are involved, with different roles under the PDPL:

To exercise any right below, contact the hotel — at reception or on the details above. You may also write to us at info@zawayapp.com and we will route your request to the hotel and support it technically.

In line with the PDPL's data-minimisation principle, we limit collection to what is needed to verify your stay, operate the assistant, protect the service, and provide features you choose. Consent is recorded for the current verified stay and policy version. The data collected is limited to:

Your data is used exclusively for the following purposes:

• Hotel Concierge: Answering hotel questions, handling approved service requests, and processing complaints.
• Improving AI Quality: Enhancing the accuracy and relevance of our intelligent assistant.
• Aggregated Analytics: Fully anonymised, aggregate-level insights to help our hotel partners understand general guest needs — never linked to any individual.
• Prayer Times & Weather: Providing local prayer, UV, rain, air-quality, and weather context for the hotel.
• Accessibility & Stay Preferences: Applying your current-stay display and assistance preferences.
• Currency Conversion: Showing indicative reference conversions, not payment or financial advice.
• Curated Guidebook: Showing hotel-reviewed listings, clearly labelled promotions, and aggregate helpfulness feedback without behavioural profiling.

Our legal ground for each use

• Running your stay services (verifying your stay, filing and tracking requests and complaints, reminders): necessary to perform the accommodation service you asked the hotel for.
• Chat history, precise location, and the Guidebook map: your consent, given in the app and withdrawable at any time from Settings without affecting the rest of the service.
• Service security and abuse prevention (rate limits, security logs): the hotel's legitimate interest in keeping the service safe, balanced against your privacy.
• Retention periods and legal records: compliance with obligations that apply to the hotel.

Children and guests under 18

This assistant is meant for the adult guest named on the booking. We do not knowingly collect data from a child. If a young family member uses the in-room device, the booking guest remains responsible for that use, and consent for a minor must be given by their parent or guardian. If you believe a child's data reached us, tell reception or write to us and we will delete it.

Application records are stored by the hotel's configured hosting provider. External AI, Mapbox, weather, prayer-time, air-quality, reference-rate, or optional Platinumlist providers may process the minimum data needed outside Saudi Arabia as described below. Guidebook places and promotions are curated by Zawaya or the hotel; optional live event records are supplied by Platinumlist and are labelled as provider content. Event artwork may load from the provider's CDN. Zawaya does not send room numbers, guest names, chat history, or stay tokens to Platinumlist. Ticket links open on the provider's site and are subject to its terms and privacy notice. The Free tier does not send live place-search queries to Mapbox. Prayer calculations can fall back locally when a provider is unavailable.

Some third-party service providers operate outside the Kingdom of Saudi Arabia. When data is transferred internationally, we ensure:

• Data is limited to the bare minimum necessary for the service to function
• Transfers must be assessed and managed under applicable PDPL cross-border transfer requirements, including Article 29
• Automated redaction is applied to chat messages before external AI processing to minimise common personal identifiers; the remaining message text needed to answer may still be transferred. Text sent for translation (your request or complaint, and staff notes on it) is transferred as written — see Section 04
• The hotel operator is responsible for selecting providers and maintaining appropriate contractual and technical safeguards

We implement multiple layers of security to protect your data:

• HTTPS/TLS Encryption: Data in transit between your browser and our service is encrypted when the service is deployed over HTTPS
• Browser-first Storage: Most user preferences and session data reside only in your device — not on our servers
• Secure Authentication: Token-based session management with automatic expiry
• Rate Limiting: Protection against automated abuse and brute-force attacks
• Input Sanitisation: All user inputs are validated and sanitised to prevent injection attacks
• Access Controls: Strict role-based access controls on all server-side data

As a user, under the Saudi Personal Data Protection Law, you have the right at any time to:

• Chat history: If you consent to history, a per-stay copy is stored in your browser and can be cleared in Settings; conversation data processed by the server is retained for up to 30 days
• Location data: Not stored permanently — used only for current session requests
• Service requests and complaints: Kept for the hotel's operational window — 35 days by default — then deleted automatically. The staff dashboard shows this window on the operations board
• Preferences: Your accessibility and stay preferences are stored on our servers against your current stay (so the hotel can serve you accordingly) and mirrored in your browser. Both copies are removed when your stay record is deleted, and you can clear them at any time from Settings
• Guidebook feedback and analytics: Stay-linked records use the configured application retention window (30 days by default) and are included in guest deletion
• Operational and security logs: Retention is controlled by the hotel’s deployment and hosting provider. The hotel must publish the exact period and align automated deletion before commercial launch; this Starter does not claim that every infrastructure or cost-telemetry store is already purged automatically

By using Zawaya AI, you agree to these Terms of Use and Privacy Policy. If you do not agree, please stop using the service. Use of the service implies acceptance of all terms stated herein.

Zawaya is a virtual assistant powered by generative AI. While we use verified databases to reduce errors, responses are generated algorithmically and may occasionally contain inaccurate information.

Zawaya AI and the host hotel shall not be held legally or financially responsible for any direct or indirect damages arising from your use of the recommendations or information provided by the AI assistant. Decisions to visit places or use services are made at your own risk and discretion.

You agree to use the system for exploratory and service purposes only. The following are strictly prohibited:

• Entering sensitive personal or banking information into the chat box
• Using offensive language or asking questions that violate the laws and regulations of the Kingdom of Saudi Arabia
• Attempting to breach the system or perform reverse engineering of the software
• Using the service for automated scraping, spamming, or any commercial purpose without written authorisation

We reserve the right to update these Terms of Use and Privacy Policy at any time. Changes will be published on this page with an updated "Last Updated" date. We encourage you to review this policy periodically. Continued use of the system after any modification constitutes acceptance of those changes.