Protecting your data is a priority. We comply with Saudi Arabia's Personal Data Protection Law (PDPL) and Kuwaiti privacy regulations.
Last updated: 27 May 2026
Only what we need to deliver the service: your name and email at signup, your phone number if you choose to enter it, your preferences (country, city, preferred language), your favourited places, check-ins, reviews and photos you publish, and your Firebase device token for notifications. We never ask for card numbers — subscription payments go through Tap Payments.
To deliver better recommendations, show places near you, sync favourites across devices, send event notifications for your city, improve the product with anonymised analytics, and meet tax / accounting requirements on paid subscriptions. We do not use your data for third-party advertising.
Under PDPL and Kuwaiti regulations you have the right to: access a full copy of your data (mobile app → Profile → Export my data), correct inaccurate information, permanently delete your account (mobile app → Profile → Delete account — completes within 30 days), withdraw consent for notifications at any time, and file a complaint with the Saudi Data & AI Authority (SDAIA) or the Kuwaiti Consumer Protection Agency.
Account data: while you use the service, and deleted within 30 days of an account-deletion request. Reviews: stay published under a pseudonym even after account deletion. Technical logs: 90 days. Billing records: 5 years (tax requirement).
Service providers only, each for a defined technical purpose: DigitalOcean (hosting, Frankfurt), SendGrid (transactional email), Firebase Cloud Messaging (push), Anthropic Claude (smart search — we send your question and a shortlist of candidate places, no personal information), Tap Payments (subscription charges). We never sell your data.
We use only strictly necessary cookies (session, language preference). We do not use advertising trackers. Manage these via the consent bar at the bottom of the site.
For any privacy request: privacy@wheretogoo.com — we commit to respond within 15 working days as required by PDPL.