Privacy Policy

Sayyad is a travel metasearch platform serving the Middle East and North Africa (MENA), with its headquarters and initial operational base in Saudi Arabia, available in five languages (Arabic, English, French, Turkish, Urdu). The product is designed with relevant privacy principles in mind (including concepts associated with PDPL, GDPR, and KVKK). Legal compliance requires applicable legal review; this page is not an independent certification.

• Searches you run: the cities or airports, dates, number of travelers, cabin and currency are sent to our servers and to our price-data providers so they can return prices.
• Anonymous usage and diagnostics: which screens and features are used, a random identifier that lasts for one session, your language, device type, browser or app version, performance measurements and error reports. These are not linked to an account and contain no name or email. In the app they are collected only if you allow it when asked, and you can change your choice at any time at the bottom of any page.
• IP address: it reaches our hosting and network providers, as in any internet connection. We do not store it with your searches or your account; only a short hash derived from it is kept in abuse-prevention logs. The app does not read a device identifier or the advertising identifier.
• If you sign in: your email address (we email you a one-time code; there is no password) and, if you choose, a display name.
• Only if you choose to save them: saved searches, favorites, your search history, and saved traveler profiles (name, email, phone, nationality, date of birth, gender, passport number, expiry and country — all optional, kept for your reference). Sayyad does not transmit this traveler data to the partner on handoff; you enter details on the partner site when completing the booking if required.
• We do not collect your location, contacts, photos, camera or microphone, or payment card details.

• Show you flight and hotel prices and take you to the seller you choose.
• Run your account and keep the searches, favorites and travelers you ask us to save.
• Email you the one-time sign-in code you request.
• Measure and improve the product, detect errors, and prevent abuse and fraud.
• Meet legal and regulatory obligations.

We rely on service vendors to run the platform. Any partner link is opened only after you explicitly click 'Go to partner'. Naming a data provider is not by itself evidence of a direct brand partnership unless stated with supporting evidence.

• Supabase and Lovable Cloud — database, sign-in, hosting and delivery of the one-time code email.
• Cloudflare — edge hosting and network protection.
• Travelpayouts and SerpAPI — price-comparison data providers. They receive the search details (route, dates, travelers, cabin) but not your name, email or account. SerpAPI is a search-data provider and is not evidence of a partnership with Google Flights.
• Images and logos (airlines, hotels) load directly from their publishers' servers, such as Google, which can therefore see your IP address.
• The seller you choose: its page opens in your browser window with the offer details (route, dates, travelers, cabin). For some sellers the link passes through a Google redirect page first. The seller's own privacy policy applies from that point.

Sayyad does not track you across other companies' apps or websites for advertising, and the app contains no advertising SDK, so the iOS App Tracking Transparency prompt does not apply. The website can load referral-measurement scripts from affiliate networks (such as Travelpayouts or Awin) only after you accept a consent notice and only when such a network is configured; the Sayyad app does not load them. Internal identifiers are never shared with advertising networks for cross-app retargeting.

• Account data and what you saved: until you delete it or delete your account.
• Anonymous usage and diagnostic records: kept without a link to your identity, for analytics and error diagnosis.
• Deleting your account (from your account page, in the app or on the website) removes your account and everything saved in it from the live service immediately, and anonymizes records that referred to it. Copies in the hosting provider's rolling backups are overwritten as those backups expire.

• Access and export your saved data (traveler profiles can be exported from the account tools).
• Correct or delete saved items, including traveler records, in the app.
• Withdraw consent at any time.
• Delete your account in full from your account page in Sayyad, or by emailing hello@sayyad.travel.

Data is encrypted in transit over HTTPS. Database access is enforced through Row-Level Security so no user can read another user's data. In the app your sign-in session is kept in the iOS Keychain or the Android Keystore; on the website it is kept in the browser. Keep your device secure.

Sayyad is designed for adults. The app is rated 4+ and we do not knowingly collect personal data from children under 13.

We may update this policy. Material changes will be announced by email or an in-app notice.