Privacy Policy

Effective Date: April 5, 2026

Last Updated: September 25, 2026

Welcome to Hasio ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website Hasio (the "App"), your guide to travel and explore Saudi Arabia.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password.
• Phone Number: Signing in uses your phone number and a one-time code sent by SMS, so we collect and store the number as your account identifier. You can sign in with an email address instead if you prefer.
• Profile Information: Optional profile details such as your preferred language (English/Arabic).
• User Content: Photos, notes, reviews, and trip itineraries you create in the app.
• Photo Library Access: The App asks permission to access your photo library so you can attach pictures to listings, services, and verification documents. We receive only the images you actually select — never your whole library, and never access without your permission.
• Business/Service Provider Information: If you register as a business owner or service provider, we collect business documents, service descriptions, pricing, and portfolio images for verification and listing purposes.
• Booking Information: Details of the stays and services you book through the platform — dates, start times, number of people, and any note you add.

1.2 Information Collected Automatically

• Device Information: Device type, operating system version, and an app installation identifier used solely to deliver over-the-air app updates.
• Push Notification Token: Only if you turn on notifications, your device gives us a push token (issued through Expo, Apple Push Notification service or Firebase Cloud Messaging) so we can tell you about your bookings. It identifies the App on your device, not you. It is deleted when you sign out, when you delete your account, or when your device stops accepting notifications, and if someone else signs in on the same device it moves to their account so you stop receiving notices there.
• Usage Data: Basic technical logs generated when your device communicates with our backend, such as which features were requested and when.

We do not collect your device location. The App does not request location permission and contains no location tracking. Any place or city associated with a listing, trip, or travel moment is information you type or select yourself, not a reading taken from your device.

We do not track you across other apps or websites, and we do not use your data for advertising. The App contains no advertising SDKs and no third-party analytics.

1.3 Travel Moments (earlier versions)

Versions of the App before 1.1.0 let you save travel moments — a photo with a note and a place name. Those were stored in your account on our servers, visible only to you and never to other users or third parties, and they are deleted with your account. Version 1.1.0 no longer offers travel moments.

Photos you attach to a listing, a service, or a verification document are uploaded to our servers so they can be reviewed and, for listings and services, displayed.

2. How We Use Your Information

• To provide and maintain the App's features and functionality
• To process AI-powered travel planning queries and provide recommendations
• To save your favorite places, travel moments, and trip itineraries
• To process bookings and reservations of stays and services
• To notify you about your bookings, and about your listings, services and account — in the App, and by push notification if you allow it
• To authenticate your account and provide personalized experiences
• To verify business owner and service provider accounts
• To display listings and services to users
• To communicate with you about app updates and features
• To improve our services and user experience

3. Information Shared With Other Users

Some of your information is visible to other people using Hasio. This is a necessary part of how the platform works, and we want to be explicit about it:

• When you make a booking: the business owner or service provider you booked with can see your first name, last name, email address, and phone number, together with the details of the booking. They need this to contact you and honour the reservation. They cannot see any of your other data — not your other bookings, your trips, your favourites, or your travel plans.
• When you post a listing or a freelancer service: everything in that listing — including the contact details and pricing you enter and the photos you upload — is shown publicly to all users once approved.
• When you write a review: your review is shown publicly on the listing you reviewed, along with your first and last name. If you mark the review as anonymous, your name is not attached to it.

Making a booking requires a verified phone number, because the business or service provider you book needs to be able to reach you — a host expecting you late, or a guide waiting at a meeting point. Your number is shown only to the business or provider of a booking you make, never publicly.

4. Third-Party Services

We use the following third-party services to operate the App:

• Convex: For real-time backend database and serverless functions
• Better Auth: For secure user authentication and session management
• OpenRouter (Claude AI): For AI-powered travel planning and recommendations
• SMS providers (Taqnyat, Infobip or Twilio): To text you one-time sign-in codes. They receive your phone number and the code, nothing else.
• Expo (EAS): For mobile app builds, over-the-air updates, and relaying push notifications
• Apple Push Notification service and Firebase Cloud Messaging: To deliver the push notifications you allow. They receive your device's push token and the text of the notification.
• Resend: To email booking updates, when email is enabled. It receives your email address and the booking details in the message.
• Cloudflare and Vercel: For website hosting

These services have their own privacy policies, and we encourage you to review them.

5. AI Travel Planner

When you use the AI travel planner:

• Your travel queries are sent to a third-party AI service (OpenRouter) for processing
• Conversation history is maintained to provide contextual follow-up responses
• Generated travel plans are stored in your account for future reference
• We do not use your queries to train AI models

6. Data Storage and Security

• Your data is stored securely using Convex with encryption at rest and in transit
• Authentication tokens and sessions are managed securely via Better Auth
• User-uploaded photos are stored in secure cloud storage
• We implement industry-standard security measures to protect your information
• We do not sell your personal information to third parties

7. Data Retention

• Account data is retained while your account is active
• You can delete your account and its data yourself at any time from inside the app, or ask us to do it for you — see Section 8, Account Deletion, below
• Booking records may be retained for legal and business purposes
• Business documents submitted for verification are retained while the account is active
• Travel moments saved with earlier versions of the App are deleted with your account (see Section 1.3)

8. Account Deletion

You can delete your account and all associated data at any time:

• In-App: Go to Settings > Delete Account. This permanently removes your profile, listings, services, bookings, trips, travel plans, reviews, notifications, device push tokens, and uploaded files from our servers, and deletes your login credentials so the email address or phone number can be registered again. Open bookings that other people made with your listings or services are cancelled first, and those travellers are told.
• By Request: Email support@hasio.net to request account deletion.

Please note that data previously shared with third-party services (Convex, OpenRouter) is subject to their respective retention policies.

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your account and data
• Export your data
• Withdraw consent for optional features

10. Children's Privacy

The App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

11. Saudi Arabia Compliance

This app complies with the Saudi Arabia Personal Data Protection Law (PDPL). We process your data in accordance with applicable Saudi regulations.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

13. Contact Us