Privacy policy

What we collect

We collect the least we need to run the service:

• Your account details: your name, your email address, your mobile number if you add one, your password (stored as a one-way hash, so we cannot read it), your language, time zone and notification preferences.
• Your mobile number is optional. If you add it when you create your account, or later on your account page, we keep it with your profile, and you can change or remove it there at any time. We do not use it for anything today: we do not send it text messages or WhatsApp messages, and we do not share it with any service provider.
• Sign-in records: the time and type of each sign-in attempt, the IP address and the device and browser type, to protect your account and alert you to sign-ins from a new device.
• The tickets you add: the airline, the booking reference, the flights and their dates, the seats and the status of each flight, including open tickets.
• The attachments you upload or forward to your private R7hlati address: boarding pass photos, booking confirmation emails and PDFs.
• Loyalty programmes: membership numbers only, and the miles claims we prepare for you. We never ask for loyalty programme passwords and never store them.
• Notifications: the push subscription for each device you turn notifications on for (its address, its keys and the browser type), and a record of the reminders sent to you.
• Your emails to us: if you write to one of our email addresses, we keep the message and its attachments. Only authorised members of our team can read them.
• We do not store payment card details in any form.

Why we collect it

• To show and compare flight search results.
• To show your tickets, bookings and open tickets in one place.
• To remind you before a flight, and before an open ticket expires.
• To find flights whose miles were never credited and prepare the claim for you — sending it is always your decision.
• To protect your account and the service from misuse.

Flight search

To show results, we send only the search details to two external flight data providers: Ignav, and SerpApi, which retrieves Google Flights data. The details are: the departure and arrival airport or city, the dates, the number of passengers in each category, the cabin class, the country and currency prices are shown in, and the number of stops if you set one. When you ask for booking options, we send the reference or details of the flight you picked (airline, flight number and date).

We do not send your name, your email address, your IP address or any other account data with a search.

If you search without signing in, we use your IP address temporarily, in server memory, to apply search limits and prevent misuse. We do not store it in our database.

We also record limited usage events about searches and booking options (such as the route, the number of passengers, the cabin class, and that a booking option was opened) to understand and improve the service. These events never include your name, email address, IP address, booking reference or full links, and your account ID is replaced with a fingerprint that does not reveal who you are. These events are deleted automatically after 180 days.

When we check the status of a flight on one of your tickets, we may send only the flight number and date to AirLabs, a flight schedule provider.

Booking and payment happen outside R7hlati

R7hlati does not sell tickets or take any payments. When you choose a booking option you move to the airline's or booking site's own website, and booking and payment happen there under that site's terms and privacy policy, not this one.

Any personal or payment details you enter on those sites do not reach us.

Smart reading through Claude

When you upload an image or a PDF of a ticket, we send the file itself to Anthropic's Claude service to extract the booking details. When an email you forwarded arrives at your private R7hlati address, we send its subject, the sender's address and its text, plus its first PDF or image attachment.

The ticket or email may contain details such as the passenger's name and the booking reference. We do not add any of your account data to it. It is sent from our server, and for that purpose only.

Anthropic is a US company, and these files and emails are processed on its servers outside Saudi Arabia.

The barcode on a boarding pass is read on your own device. If we find no valid barcode in the photo, the photo is uploaded and handled like any other file.

When the Claude service is not switched on, files are read automatically on our own server and are not sent anywhere.

Service providers we use

We share data with these providers only as far as needed to run the service:

• Ignav and SerpApi: flight search details and booking option requests, as described above.
• AirLabs: the flight number and date, when we check a flight's status.
• Cloudflare: every connection to our website passes through it. It receives emails forwarded to your private R7hlati address and emails sent to our own addresses, and routes them to us (Cloudflare Email Routing). We may also use its service to check that a visitor is not a bot, in which case it receives the IP address.
• Anthropic (Claude): reading files and emails to extract booking details, as described above.
• Email delivery: we send sign-in codes, alerts and reminders either directly from our server or through the email delivery provider Resend, which receives only your address and the message itself.
• Your browser's push services (Google, Apple and Mozilla): they deliver reminders to your device in encrypted form, if you turn on push notifications.
• Contabo: the hosting provider we rent our server from. The server holds the database, the attachments and the backups.
• Google: if you choose to sign in with Google, when that option is available, we receive your name, email address and profile picture from it.

Transfers outside Saudi Arabia

We use service providers outside Saudi Arabia, and our own server is rented from a foreign hosting provider (Contabo). So some of your data is transferred, stored and processed outside the Kingdom.

The clearest examples: the ticket and email content we send to Anthropic to extract details, and the search details we send to Ignav and SerpApi.

We send each provider only what it needs for the purpose described on this page.

Where your data lives

On a server we rent from Contabo, reached over an encrypted connection. Attachments sit in isolated storage that nobody but you can reach, and are served over links that expire quickly. Every query against your data is limited to your account, so no other user can reach it.

We take a daily backup of the database and the attachments so we can restore the service after a failure, and keep it on the same server. Daily backups are deleted automatically after 14 days, and we keep one backup from each week for up to 8 weeks.

How long we keep it

• Your account, tickets, attachments and membership numbers: for as long as your account exists, or until you delete them. A ticket you delete is removed at once, with its attachments.
• Sign-in records: for as long as your account exists. They are deleted with the account.
• Usage events: 180 days.
• Emails forwarded to your private address: we do not keep the original email. We keep the ticket extracted from it, its attachments (up to 5), the sender's address and the subject. If we find no booking in it, we keep a short record of the reason for 30 days.
• Sign-in codes are valid for 10 minutes, and a session lasts up to 30 days.
• Counters that protect against repeated attempts (tied to your email or network address): deleted once their window ends.
• Emails sent to our own addresses: there is no automatic deletion period at present, except that anything moved to Trash is permanently deleted after 30 days.
• Backups: 14 days for daily backups, and up to 8 weeks for the weekly one.

Deletion

The "Delete my account" button in Settings really does delete your account, tickets, attachments, loyalty programmes, miles claims, notification subscriptions and sign-in records. No email request, no waiting period.

A copy may remain in our backups until they are deleted automatically, within 8 weeks at most.

Emails you sent to our own addresses are not deleted with your account. Write to us if you want them deleted.

Export

Your data is yours. From Settings you can export a copy of your data as JSON, and import it again whenever you like.

The file holds your email, name and preferences, your tickets and their change history, your loyalty membership numbers and your miles claims. It does not hold the attached files themselves (only their names), your mobile number or your sign-in records. You can ask us for those by email.

Cookies

We use only the cookies the service needs: to keep you signed in, to remember your language, and to complete sign-up. We do not use advertising trackers or third-party analytics tools.

We don't sell your data

We do not sell your data or use it for advertising. We share it only with the service providers listed above, as far as needed to run the service, or when the law requires us to.

The legal framework and contact

We work under the Saudi Personal Data Protection Law (PDPL). You can view, correct and export your data, and delete your account, directly from Settings.

For any other question or request about your data, write to support@r7hlati.com.