Privacy Policy

Last updated: July 31, 2026

1. Who we are

This Privacy Policy explains how Sehaab Service F.Z.E ("we," "us," "our"), a Free Zone Establishment (Limited Liability) registered with the Free Zones Authority of Ajman, United Arab Emirates, under Commercial Registry No. 56080, registered address Office C1, 1st Floor, SF7892, Ajman Free Zone C1 Building, Ajman Free Zone, United Arab Emirates, collects, uses, and protects your personal data when you use the Sehaab website, mobile app, and booking platform (the "Platform"). We are the data controller for the personal data described below. Contact us about privacy matters at support@sehaab.net or +971 50 293 6375.

2. What we collect

Account information: name, email address, phone number, and password (stored as a secure hash — we never store your password in plain text).

Booking and traveler information: for each Booking, the traveler's first and last name, nationality, gender, passport number and expiry, contact email and phone, and trip details (route, dates, offer selected, fare/room type, baggage preference).

Payment information: we do not collect or store your full card number, expiry date, or CVV. Card details are entered directly into our payment processor's secure fields and tokenized before reaching our servers — we only ever see a payment token and the last few digits/brand of your card, as provided back to us by the processor.

Verification data: when you check out, we send a one-time verification code to your email or phone and record whether it was successfully verified (not the code itself, once expired).

Technical data: IP address, browser/device information, and timestamps, collected automatically for security, fraud prevention, and rate-limiting purposes.

Support and refund requests: if you contact support or submit a cancellation/refund request, we collect the booking reference and any details you provide about the request.

3. How we use your data

• To create and manage your account.
• To search, price, and complete Bookings on your behalf, including sending the required data to airlines/hotels/other Suppliers to issue your booking.
• To verify it's really you before finalizing a Booking or a sensitive account action (the one-time code sent by email/SMS).
• To process payment through our payment processor and, where relevant, to pay Suppliers for the service you booked.
• To send Booking confirmations, and operational updates about a Booking you've made.
• To review and process cancellation, date-change, and refund requests.
• To detect and prevent fraud, abuse, and unauthorized access.
• To comply with legal obligations (e.g., financial record-keeping, responding to lawful requests from authorities).

We do not sell your personal data.

4. Who we share it with

• Travel Suppliers (airlines, hotels, GDS/booking systems) — the minimum traveler and trip data needed to issue and manage your actual booking.
• Our payment processor — payment tokenization and charge processing. They receive your card details directly; we do not.
• Email/SMS delivery providers — to send verification codes, confirmations, and account-related messages.
• Service providers who support our infrastructure (e.g., cloud hosting, database, error monitoring), under obligations to protect your data and use it only to provide services to us.
• Legal/regulatory authorities, where we're required to by law, or to protect our rights, users, or the public.

We do not share your data with third parties for their own marketing purposes.

5. International transfers

We're based in the UAE, and some of our service providers (hosting, payment processing, email/SMS delivery) may process data outside the UAE, including in jurisdictions with different data protection standards. Where required, we take reasonable steps to ensure such transfers are appropriately safeguarded.

6. How long we keep it

We retain account and Booking data for as long as your account is active, and for 10 to 15 years afterward to meet legal, tax, and dispute-resolution obligations. Verification codes expire and are deleted/invalidated shortly after use or expiry regardless of account status.

7. Your rights

Depending on where you live, you may have the right to: request a copy of the personal data we hold about you; ask us to correct inaccurate data; ask us to delete your data (subject to our legal retention obligations); and object to certain uses of your data. To exercise any of these, contact us at support@sehaab.net.

If you're in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority. If you're in the UAE, you may raise concerns with the relevant free zone or federal data protection authority.

8. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, tokenized payment data, rate limiting, and account lockouts after repeated failed login/verification attempts. No system is perfectly secure, and we can't guarantee absolute security.

9. Children

The Platform is not directed at children, and we don't knowingly collect personal data from anyone under 18 creating their own account.

10. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date, and where changes are material, we'll take reasonable steps to notify you.

11. Contact

Questions or requests about your data: support@sehaab.net.