Privacy policy

Who we are

Rehlatak operates this site. This policy explains what personal data we collect, why, who processes it for us, and your choices.

What we collect

Your email address, to sign you in by code or with Google, and to send your receipts and report notices.

Your first name, only if you add it.

Your WhatsApp number, only if you add it, verify it and consent to messages.

Your trip and traveller profile: destination, dates, departure city, nationality or passport, residence, trip type, number of travellers and children’s ages, spending level and interests, to write your report.

Your orders and payments. Card details are entered in our payment provider’s form and never reach our servers; we keep only the payment reference, and for an agency’s renewals the provider’s card token.

What you write in a wrong-information report or a support message.

To stop self-referral, a keyed hash of your device identifier and network address, never the values themselves.

Usage events that carry no personal data: identifiers, codes, counts and amounts.

Your consent

When you continue at sign-up, or at checkout without an account, you accept the terms and this policy. We record the versions you accepted and the time.

WhatsApp messages need a separate, explicit consent after your number is verified. WhatsApp is used for individuals only, never for agencies or their clients.

AI model providers

To write a report we send trip details to AI model providers. We never send them your name, email address or phone number.

Who processes your data

Moyasar processes payments. Its official payment form loads on the payment step only, and it sends its own errors to AppSignal, Moyasar’s error-monitoring tool. It runs on no other page.

Google provides sign-in with Google on the sign-in page only, and Google Maps for places chosen on Google Maps.

Resend sends our emails.

Meta delivers WhatsApp messages to individuals who consent.

Google Cloud hosts the site and its database in St. Ghislain, Belgium (region europe-west1).

AI model providers write reports from trip details, without personal data.

[To be confirmed by legal review: the legal basis for storing and processing personal data outside the Kingdom under the Personal Data Protection Law.]

Cookies and visitor identifier

We use first-party cookies only: a session cookie that keeps you signed in, a security cookie against forged requests, an order cookie that lets a guest open their order, a visitor identifier named rv (one year), the visit tags of the landing link named rutm (the first and the latest, one year), and the invitation code of an invitation link named rref (a short time, currently a week).

The visitor identifier is a random number kept for one year, to count visits and link them to an account if you sign up. It involves no third-party tracking. No analytics, advertising or tracking tool of a third party runs on our pages, and there is no cookie banner.

Sharing a report

If you turn on a report’s share link, anyone who opens it sees the report as you see it: the trip header with your departure city, passport and the lodging you entered, the questions that were counted with their answers, your packing list, and the first names in the budget split. Questions that were not counted are not shown. Visitors cannot change anything, and you can turn the link off at any time.

Keeping and deleting data

You can delete your account from your account page. Your personal data is removed within 30 days; the payment records the law requires are kept without your name. Credits are lost when the account is deleted.

Data about an agency’s clients belongs to the agency and is deleted at its request.

If a breach happens

If personal data is breached, we follow our published breach procedure, which includes telling the people affected.

• The breach procedure

Contact

Contact us through the contact form on this site.

• The contact form