Privacy Policy · UMRA PILOT

1. What we collect

Account details: your name, email address, phone number, city and password (stored only in a protected, hashed form).
Journey details: the dates, number of travelers, service and notes you add to a request, and the status of your bookings and cancellations. Pilots you save to your list.
Pilot details: profile information, languages, home countries, where you live, rates, availability, profile photo and the documents uploaded for verification: passport, student ID, guide licence and, if you live in Saudi Arabia, your Iqama.
Payment details: for travelers, the status and amounts of your payments and refunds (your card details go straight to our payment processor, never to us); for Pilots, the name and IBAN of the bank account you are paid into, used only to pay you.
Reviews you write after a journey.
Messages you send us through the contact form: your name, email address and what you wrote.
Technical information: basic device and usage data, and error reports when something goes wrong, so we can keep the site fast and working.

2. Why we use it

to run your account and keep it secure;
to send, accept and manage requests and bookings, and to email you about them;
to verify Pilots before they are listed;
to apply the booking and cancellation rules fairly to everyone;
to take payments, send refunds and pay Pilots;
to answer your messages;
to fix problems and improve the service.

We never sell your information, and we do not use it for advertising.

3. Who can see it

Everyone can see a verified Pilot’s public profile: name, photo, city, languages, rates and reviews. Contact details are never public.
Your Pilot or traveler sees the request details, and each other’s phone number only once a booking is accepted.
Our team can see what is needed to verify Pilots and help with bookings. Verification documents are private and only opened by our team through short-lived secure links.
Service providers who run parts of UMRA PILOT for us, under contract and only for that purpose: Supabase (database, sign-in and file storage, hosted in London), Vercel (hosting and privacy-friendly analytics), STRATO (email), Sentry (error reports, with on-screen text masked), Moyasar (card payments, licensed by the Saudi Central Bank) and our bank, which receives a Pilot’s name and IBAN to send their payouts.
Authorities, only when the law requires it.

4. Cookies

We use only the cookies needed to keep you signed in and the site working. We do not use advertising or cross-site tracking cookies.

5. How long we keep it

We keep your information while your account is open. Booking and verification records may be kept for a limited time after that, where we need them to resolve disputes, keep the platform safe or meet legal obligations. After that, it is deleted or anonymised.

6. Your choices and rights

Depending on where you live, you can ask us to:

give you a copy of the information we hold about you;
correct anything that is wrong;
delete your account and information;
restrict or object to how we use it.

Email hello@umrapilot.com and we will reply within 30 days. You also have the right to complain to your local data protection authority.

7. Security

Your information is encrypted in transit, access is limited by strict database rules so each person sees only what they should, and documents are stored privately. No system is perfect, so please use a strong, unique password and tell us if you notice anything unusual.

8. Children

UMRA PILOT is for adults. Younger pilgrims can travel with a parent or guardian who holds the account. We do not knowingly collect information from children.

9. Changes and contact

We will update this policy as the service changes and tell you about anything important. For any privacy question, write to hello@umrapilot.com.