Privacy Policy — English

Effective Date: August 18, 2025

This Privacy Policy explains how we collect, use, and protect your information when you use our mobile app (HeloStays) and related services.

1. Information We Collect

We may collect the following personal data:

• Account Information: Email, password, first and last name, phone number, country, and gender (gender is used to comply with Iraq strict hospitality laws regarding marital status for male/female guests living in the same property).
• Identity Verification: Government-issued ID (e.g., passport, driver’s license, or national ID) and a recent profile photo.
• Payment Information: PayPal account information.
• Device Information: Device operating system (iOS or Android).
• Location Information: Device location (while using the app only).
• Profile Photo: Used during account creation and for identity verification.

2. Purpose of Data Collection

We collect and process information in order to:

• Create and manage user accounts.
• Confirm user identity (by matching ID with profile photo), which requires access to photos and/or camera.
• Comply with applicable gender-based rental laws.
• Process payments via PayPal.
• Help users manage registered devices.
• Show relevant nearby listings.

3. Third-Party Services

We rely on the following services, which may process data under their own privacy terms:

• Firebase — Authentication, database, and media storage.
• PayPal — Payment processing.
• Google Maps — Map view and location services.

4. Data Storage and Security

All data—including profile photos and ID documents—is stored securely in Google Firestore and Firebase Storage. Data is encrypted in transit and at rest. Access to sensitive data is limited to authorized personnel with a need to know.

5. Data Retention and Deletion

We retain your personal data only as long as necessary to provide our services and comply with legal obligations.

• Identity documents: Deleted after successful verification unless retention is required by law (e.g., compliance or fraud prevention). If retained, we minimize access and scope.
• Account information: Stored while your account is active. Deleted within 30 days of confirmed account deletion.
• Payment information: Retained only as needed for transactions, chargebacks, and refunds, then deleted or anonymized.
• Location data: Used only while the app is active; not stored persistently for profiling.
• Backups: Data may persist in encrypted backups for up to 90 days, after which it is purged on a rolling basis.

Deletion Requests: You may request deletion of your account and associated personal data directly in the HeloStays app via Account > Account and data management > Delete My Account, or by contacting support@helostays.com. Once your request is verified, we will delete your data from our systems (including Firebase) within 30 days unless retention is required by law.

6. Data Sharing

We do not sell your personal data. We share data only in these cases:

• When required by law.
• To process payments via PayPal.
• With service providers (e.g., Firebase/Google) strictly to operate the app, under contractual safeguards.
• With your consent, when you ask us to share information (e.g., with a host or co-traveler).

7. Children’s Privacy

You must be 18 years or older to use our app. We do not knowingly collect data from users under 18.

8. User Location

We access your device location while using the app to show nearby listings. Location access is optional and can be disabled in your device settings at any time. If disabled, the app remains usable, but location-based features may be limited.

9. Contact Us

For questions or concerns, please contact: support@helostays.com.

10. Policy Changes

If we make significant updates to this policy, we will notify you via an in-app notice the next time you open the app and, where appropriate, by email to your registered address.

11. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Delete your personal data as described in Section 5.
• Manage consent and permissions (e.g., location, camera, photos) through your device settings.

You can exercise these rights in the app (Settings > Privacy) or by contacting support@helostays.com. We may need to verify your identity before fulfilling a request.

12. International Data Transfers

Our company is based in the UAE and our services are primarily offered in Iraq. Your data may be processed in these countries and in other locations where our service providers operate. We take steps to ensure transfers comply with applicable data protection laws.