Privacy policy

1. What we collect

For an account: name, email, mobile number if added, interface language, and gender (male or female) as you choose it at sign-up. Gender is used only to organise women-only tours: who offers them and who can ask to join. It isn’t shown to others, the platform does not verify it, and it is never inferred from a name or photo. When you ask to join a women-only tour we keep the time you confirmed that every participant is a woman.

For guides: page details (display name, bio, cities, languages, specialities, photos, experiences, the contact channels they choose to publish with consent), licence number, licence file and expiry date, the results of checking it and its decision record, and subscription status and history.

When you use the platform’s smart assistant while signed in: your messages to it and its answers, and the platform team’s messages if you ask to talk to them. Nothing is kept from the conversation of a visitor who isn’t signed in.

For contact: inquiries and their messages, reviews, replies and appeals, reports, and saved guides.

For appointments: when you ask to join an appointment we keep the number of people, the language, your note, the meeting place if you enter one, a copy of the appointment’s details and approximate price at the time, the request’s status and the attendance record.

For identity verification, when you ask for it: the name as on the document, its type, issuing country, expiry date and the last 4 characters of its number, and a photo of the document’s front. We never keep the number itself — only a keyed fingerprint of it, so one document can’t verify more than one account and a ban can be applied. With the automatic check we keep the result of each check (passed or not, and why), never what the system read from the document.

2. Statistics and security

We count visits to guide pages and contact clicks to show them to the guide. Statistics store no raw IP address, browser details or referring URL — only a source category (search, social, direct…). We use a daily keyed fingerprint to limit repeated requests to analytics.

To count visitors once a day we use a random cookie that expires at the end of the day, and store a keyed hash of it that is deleted after two days.

To protect sign-in and forms from abuse, an IP address may be held temporarily in rate-limit records separate from analytics. Records older than 24 hours are deleted when automatic cleanup runs while processing requests. Guides cannot see these records, and they are not used for advertising.

3. Who sees your data

Only what a guide publishes on their page is public. In an inquiry the guide sees the tourist’s first name and messages. A review shows the first name.

For an appointment, the guide who owns the experience sees your request, note and meeting place, and so do the co-guides they add to that appointment, as far as the permissions they give them. None of it is public.

A licence file is never published. It is kept in private storage and opened only by authorised platform staff through a short-lived link, and every opening is logged.

Identity document photos are never published. They are kept in private storage and seen only by authorised platform staff for review, and every opening is logged. Others see a “Verified identity” badge only.

Platform staff do not read inquiry conversations. We do not sell personal data; we may disclose it to meet a legal obligation.

The platform’s smart assistant is an in-house engine: it sends your messages to no outside AI provider, and your conversations train no model. It answers from published data and the platform’s knowledge base, and sees only your own account’s status. If you ask to talk to the team, authorised staff read the conversation to answer you. If a guide chooses it, the assistant may answer common questions in your inquiry to them with what their page publishes, clearly labelled as an automatic reply, not the guide’s.

To check a guide’s licence we may send the licence number alone to the Ministry of Tourism’s verification service when that is connected and switched on, and keep only the field names of its answer and a fingerprint of it. We may read the text of a licence file (PDF) inside the platform to compare it with what the guide entered. That internal check alone does not send it elsewhere. Sending it for an automatic Cloudflare Workers AI check requires that feature to be switched on and the consent described below.

Identity photos may get an automatic first look inside the platform (image size and digital fingerprint) to ask for a clearer photo or alert the reviewer; this first look reads neither the face nor the document, and never verifies or refuses anyone.

Automatic identity and licence checks: when switched on, a photo of the identity document’s front, and a licence photo or text extracted from its PDF, are sent directly to Cloudflare Workers AI to read the printed information. This path sends them to no other AI provider. Cloudflare states that it does not use request content to train models or make it available to its other customers, and that it does not retain inputs or outputs from inference requests that use no stateful feature beyond the time needed to process the request and deliver the response, subject to the safety, security and legal exceptions in its agreements and policies. This differs from keeping attachments in the platform’s private storage, including Cloudflare R2, for the retention periods described below. We do not keep the full text read by the model. We keep check results, reasons and execution details, including the model and check time, and also the last four characters of the licence number it read. Fixed rules compare the reading with what you entered and, where relevant to the check, with your verified identity. A request that passes every check is approved automatically; anything else is reviewed by the platform team. No one is refused automatically. This processing rests on the explicit consent you give when you send a verification request — no document is sent without it — and you can withdraw a request before the decision, which deletes its photos at once.

4. Operator and service providers

Luxday is operated under freelance document no. FL-197817387 and is responsible for processing your data. For anything about your data: the contact page or Luxday203@gmail.com.

The platform, its database and files are hosted by Cloudflare; processing may include locations outside the Kingdom under the legal rules on data transfer. Cloudflare keeps technical request logs for a limited time to diagnose faults.

Sign-in codes are sent to your mobile or email and checked through Authentica. Guides pay their subscription through the Moyasar payment gateway; card details are entered in Moyasar’s form directly and never reach us.

When the automatic check is on, verification photos and the licence file are processed by Cloudflare Workers AI, which doesn’t use them to train its models.

5. Cookies

A session cookie for sign-in (up to 30 days), a language cookie, and the daily visitor-count cookie. No advertising or third-party tracking cookies.

6. Retention and deletion

We keep data while the account exists and as long as needed for the purposes above and legal obligations.

When an account is deleted, the guide page is withdrawn (name, bio, photos, contact channels), the licence file and photos are deleted from storage, open inquiries are closed and the subscription ends. Reviews remain as records tied to an anonymised account; administrative logs remain for security.

Identity photos and their fingerprints are deleted 30 days after the review decision (the decision record stays), and at once — with the name and last characters — when the account is deleted. If an account is banned we keep keyed fingerprints of its document, mobile number and email so it can’t come back with them; none of them can be read back.

Assistant conversations are deleted 180 days after their last message (a period set by the platform’s administrators), and at once when the account is deleted. The licence decision record stays for integrity and review; it holds no licence file.

7. Your rights

You can download a copy of your data and delete your account from “My account”. You can ask to correct your data or about its processing through the contact page. We may verify your identity first, and you may complain to the personal data protection authority.

You may object to any automatic decision and ask the platform team to review it through the contact page, and you can withdraw your consent to the automatic check by withdrawing your verification request before the decision.