Privacy Policy

1. Controller

See also the legal notice.

2. Legal framework

Processing is designed under Algerian Law No. 18-07 on personal data protection, related rules, and app-store distribution requirements (Apple App Store, Google Play).

EU GDPR is not the primary operating framework in Algeria; some technical practices follow international security and transparency standards.

If an ANPDP declaration/notification applies to your entity, add status or reference once completed.

3. Data we collect (store categories)

• Contact info: name, email, phone, gender, date of birth (individuals).
• Identifiers: Firebase Auth user id, session tokens, FCM push tokens, device technical data.
• Pro account: business name, address, description, categories, verification documents.
• Bookings & transactions: order details, participants, amounts, wallet/ledger history, payment method where applicable.
• User content: messages, reviews, profile photos, booking supporting documents.
• Location: only if you grant permission, to find nearby activities (can be denied in system settings).
• Usage & diagnostics: preferences, search history, security/diagnostic logs.

4. Purposes and bases

• Accounts and authentication (email, SMS OTP, Google) — contract / pre-contract.
• Listings, bookings, messaging, support — contract.
• Pro verification, fraud and abuse prevention — legitimate interest / security.
• Service notifications — contract; marketing only with consent if introduced.
• Legal obligations and competent authorities.

5. Recipients and processors

• Google Firebase (Auth, Firestore, Storage, Functions, Messaging).
• Resend (or equivalent) for transactional email.
• SMS provider for OTP / transactional SMS.
• Payment provider when online payments are enabled.
• Pros — booking-necessary contact details, not the full private user file.
• Haya support / admin for reports and disputes.

Cross-border transfers may occur via cloud infrastructure. Reasonable technical and contractual safeguards are sought (TLS, access control, server secrets).

6. Retention

• Account: while active, then deletion/limited archiving as required.
• Pro KYC: during review and relationship, then limited retention or deletion.
• Booking documents: per booking lifecycle (cleanup after cancel/expiry where applicable).
• Security logs: limited period for incident detection.
• Financial records: as required by applicable accounting/tax rules.

7. Security

Reasonable measures: authentication, access control, public vs private profile separation, server-side sensitive operations, encryption in transit. No system is perfectly secure.

8. Your rights

Under applicable law (including Law 18-07), you may request access, rectification, update or deletion, and limitation of certain processing, subject to legal exceptions. Contact: [email protected].

9. Account deletion (store requirement)

Delete your account in-app: Profile → Delete my account. Associated data is cleaned per product rules and legal retention (e.g. minimal transaction history).

If you cannot access the app, email [email protected] or [email protected] from your account email.

10. Minors

Not intended for children under 13. Activities may require a higher age. Guardians remain responsible for authorised minor use.

11. Cookies / trackers

The mobile app mainly uses technical identifiers and SDKs (Firebase, notifications). These legal pages are static and do not use advertising cookies. Further notice will be added if a cookie-based marketing site is launched.

12. No sale of data

Haya does not sell personal data. Sharing is limited to the purposes above.

13. Changes

This Policy may change. The effective version is dated. Material updates may require in-app notice and/or renewed acceptance.