Privacy Policy

01Data we process

When you use Riwaq PMS we process the following categories of data:

• Account data: email, name and sign-in provider (email and password, Google, or Apple). Apple may share a masked email if you choose “Hide My Email”.
• Property data you and your team enter: units and rates, bookings, guests and companions (name, phone, nationality, ID type and number), invoices, vouchers, expenses and settings.
• Team data: the emails of members you invite, their roles and the properties they may access.
• Calendar links (iCal) you connect from channels such as Airbnb and Booking, and the blocked dates imported from them.
• Basic technical data: operating system, app version and last sign-in, for support and updates.

02Where your data is stored

Your data is stored in Google Cloud (Firebase / Cloud Firestore) and syncs in real time between your devices and your team’s. You are the sole owner of your property data; only team members you authorise inside the app can access it.

The app may keep a temporary copy on your device to speed things up; the cloud remains the source of truth.

03How we use data

• To sign you in and run the system: bookings, room board, invoices, vouchers and reports.
• To sync data across your devices and team, and to enforce role-based permissions.
• To issue tax invoices (including the ZATCA-compliant QR for properties in Saudi Arabia) and print contracts.
• Scheduled backups and restore.
• Update notices and technical support.
• AI monthly summary: when you request it, only aggregated figures from your reports (revenue, occupancy, booking sources) are sent to the AI provider to generate a short read — never guest personal data.

04Sharing with third parties

We do not sell your data or share it for marketing. We rely on service providers only to run the system:

• Google Firebase: authentication, cloud database, storage and hosting.
• Sign in with Apple and Google: sign-in only.
• Apple App Store: when you install or purchase through the store, Apple’s privacy policy applies to the purchase.
• AI provider: aggregated figures only for the monthly summary, as described above.
• Booking channels (Airbnb/Booking): we read the iCal links you provide and never send your guests’ data to them.

05Security

• All connections are encrypted over HTTPS.
• Server-side access rules: each account sees only its own properties, and reception staff cannot access reports or administrative finance.
• Scheduled backups of account data and an activity log for important actions.
• You can use Apple or Google sign-in and change your password from inside the app.

06Retention and deletion

We keep your data for as long as your account is active. You can delete your account at any time inside the app: Settings → Account → Delete account. Your account, property data and backups are permanently deleted and cannot be recovered.

If you are a team member of a property owned by someone else, that property’s data remains with the account owner after your membership is removed.

07Your rights

• Access and export your data (Excel reports, CSV guest registry, PDF invoices).
• Correct your data and your guests’ data inside the app.
• Delete your account and data permanently.
• Contact us with any privacy question.

08Guest data and your responsibility

As the property operator you control the guest data you enter into Riwaq PMS, and we process it on your behalf. You are responsible for informing your guests as required by the laws that apply to you (such as guest registration and data protection rules) and for collecting only what you need.

09Children

Riwaq PMS is intended for property operators and is not offered to anyone under 18.

10Changes to this policy

We may update this policy when we add features. The last-updated date appears at the top of this page, and we notify users inside the app of material changes.