Privacy Policy

Last updated: 15 October 2026

Overview

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

Scope of this Policy

This Privacy Policy applies to the Ziyara.io website (ziyara.io), the Ziyara.io mobile application available on Google Play and the Apple App Store, and any related services (collectively, the "Services"). By using our Services you agree to the collection and use of information as described in this policy.

Who is responsible for your data (controller vs. processor)

Ziyara.io is the data controller for the personal data of our own customers and website visitors (agency accounts, staff users, billing, support, website usage). For pilgrim data entered by travel agencies (names, passports, travel documents, payments), the agency is the controller and Ziyara.io acts as a data processor on the agency's instructions under our Data Processing Agreement. If you are a pilgrim, please direct privacy requests to your travel agency first — we assist agencies in fulfilling them. See our GDPR & Data Protection page for details.

Information we collect

We may collect the following types of information:

Account information – name, email address, phone number, and organization details provided during registration.
Pilgrim data – personal details, passport information, travel documents, and related data entered by authorized agency users.
Camera – used locally to scan login and attendance QR codes; the current mobile app does not upload camera images.
Location data – your GPS coordinates when you send an SOS alert or explicitly choose to share your location with your guide. Location is not collected in the background.
Usage data – device type, operating system, browser, IP address, and interaction logs collected automatically.
Registration IP address – the IP address used when an account is created, stored for up to 12 months to detect fraudulent or duplicate free-trial sign-ups (legitimate interest, Art. 6(1)(f) GDPR). It is never used on its own to make an automated decision about your account.
Contact form – the name, email address, agency name (optional) and message you send us through the contact form, together with the IP address the form was submitted from. We use them to answer your enquiry and to protect the form against spam (steps taken at your request before entering into a contract, and our legitimate interest, Art. 6(1)(b) and (f) GDPR).
Payment data – processed securely by our payment provider (see below); we do not store full card details.

Mobile application & device permissions

Our mobile application may request the following device permissions:

Camera (android.permission.CAMERA) – Used to scan login and attendance QR codes. QR scanning is activated only when you choose it; camera images are not uploaded by the current mobile app.
Location (approximate and precise) – Used when you send an SOS alert or explicitly share your location with your guide. The app sends your current GPS coordinates to our server and makes them available to your assigned guide and agency for assistance. An SOS can still be sent when GPS is unavailable. Location is not collected in the background or used for advertising or analytics.
Notifications (android.permission.POST_NOTIFICATIONS) – Used to deliver agency announcements and emergency alerts through Google Firebase Cloud Messaging. SOS push notifications contain a generic alert and identifier; the pilgrim's details are retrieved only after an authorized user opens the app.
Internet – Required to communicate with our servers and synchronize data.

You can revoke any permission at any time through your device's settings. Revoking camera permission disables QR scanning; revoking location prevents location sharing but still allows an SOS without GPS; revoking notifications stops agency announcements and emergency alerts from reaching you.

How we use your information

We use collected information to provide and improve our Services, process bookings and payments, communicate with you, ensure security, and comply with legal obligations. We do not sell your personal information to third parties.

Payment processing

We use Paddle for payment processing. Paddle handles billing, invoices and payment authorization on our behalf. We do not store full payment card details on our servers. For more information, see Paddle's Privacy Policy and Paddle's Terms.

Where we store your data

The application and database are hosted in the European Union — Hetzner Online GmbH, Germany. Uploaded files (documents, passport scans, photos) are stored on Amazon Web Services S3 in the EU region (Frankfurt, eu-central-1). Access to stored files is restricted and short-lived signed URLs are used for temporary access when necessary. Backups are encrypted and kept with a defined retention period.

Data retention

We retain personal data as long as necessary to provide our services or as required by law. If you wish to request deletion of your data, contact us at info@ziyara.io.

Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on your consent (for example analytics cookies), you can withdraw that consent at any time; this does not affect processing carried out before the withdrawal. To exercise these rights contact us at info@ziyara.io — we reply within 30 days. You also have the right to lodge a complaint with the data protection authority of your country.

International transfers & processors

We use a small number of vetted service providers to operate the Services:

Hetzner Online GmbH — application and database hosting (Germany, EU)
Amazon Web Services — file storage on S3 (Frankfurt, EU)
Brevo (Sendinblue SAS) — transactional and campaign e-mail (France, EU)
Infobip Ltd. — SMS and WhatsApp delivery (EU, with a global carrier network)
Google Ireland Ltd. — push notifications via Firebase Cloud Messaging, and website analytics via Google Analytics (loaded only after cookie consent)
Functional Software, Inc. (Sentry) — error monitoring (US)
Cloudflare, Inc. — bot protection on public forms (Turnstile)
Paddle.com Market Limited — payments, acting as an independent controller (Paddle never receives pilgrim data)

The full list, including the data each provider processes, its location and the applicable transfer safeguard, is published at ziyara.io/subprocessors. Where a provider processes personal data outside the EEA/UK/Türkiye, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, adequacy decisions where applicable, or the EU–US Data Privacy Framework.

GDPR / UK GDPR (EU & UK residents)

If you are located in the EU or the UK, you have the rights listed above and the right to lodge a complaint with your local supervisory authority. The legal bases for processing personal data include contract performance, legitimate interests, and consent where required (for example for non-essential cookies).

Bosnia and Herzegovina

If you are located in Bosnia and Herzegovina, the Law on Personal Data Protection (Official Gazette of BiH, No. 12/25) applies. You have the rights listed above and the right to lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina (azlp.ba).

CCPA / CPRA (California residents)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), including the right to request disclosure of categories of personal information collected, the purposes for which it is used, and the right to request deletion. We do not sell personal information. To exercise your rights under CCPA/CPRA, contact info@ziyara.io and specify your request.

KVKK (Türkiye)

If you are a resident of Türkiye, you have rights under the Turkish Data Protection Law (KVKK) including access, correction, deletion, and objection. To exercise those rights, contact info@ziyara.io. For international transfers from Türkiye, we will rely on appropriate safeguards and provide information upon request.

Security measures

Encryption in transit (TLS) for all connections; sensitive identity fields such as passport numbers and national IDs are encrypted at rest with AES-256.
Files stored privately on AWS S3, retrieved through short-lived signed URLs.
Strict multi-tenant isolation: each agency's data is scoped to that agency.
Role-based access control, two-factor authentication, and audit logging of data changes.
Encrypted backups with a defined retention period.

Note that we do not offer end-to-end encryption: to operate the Service, our systems and the sub-processors listed above necessarily process data in a readable form.

Data Protection Contact

For data protection questions or privacy requests, contact info@ziyara.io. Requests are handled through this address.

Contact

If you have questions about this policy, please contact: info@ziyara.io