Privacy Policy

1. Who is responsible

Umrachi is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], which is responsible for the personal data processed on the platform. Contact us at support@umrachi.com.

When you book, the travel agency receives your booking details and is separately responsible for how it uses them to deliver your trip.

2. What we collect

• Contact and account: name, mobile number, email address if you give one, password (stored only as a secure hash) and language.
• Travellers: names, dates of birth, gender, passport numbers and expiry dates, and passport scans you or the agency upload.
• Bookings and payments: the package, departure, rooms and options, prices, amounts paid or refunded, receipts, and who recorded each entry and when.
• What you send us: messages, disputes and reviews.
• Technical: IP address, device and browser, sign-in history, pages visited on our public pages and error reports.
• Agencies: business and licence details and documents, and the names and contact details of applicants and staff.

3. Why we use it

• To take and manage your booking — verify your phone, hold seats, pass your booking to the agency, record payments and send confirmations. Basis: performing our contract with you.
• To let the agency arrange visas through the official Saudi channels (such as Nusuk) and to keep accounting records. Basis: legal obligations and performing the contract.
• To keep Umrachi secure, prevent fraud, fix errors and improve the service. Basis: our legitimate interests.
• To measure how our public pages are used. Basis: your consent where the law requires it, otherwise our legitimate interests.

4. Who we share it with

The agency you book with receives the details it needs for your trip, including travellers’ passport details. Umrachi staff see data only as needed to run and support the service. We share data with authorities only when the law requires it. We do not sell personal data or use it for advertising.

These providers process data on our behalf:

• Vercel — website hosting — USA and EU
• Neon — database — EU (Frankfurt)
• Cloudflare R2 — file storage, including passport scans — EU
• OTPIQ — SMS and WhatsApp messages — Iraq
• Plunk — email, sent through Amazon SES — EU
• Google Analytics — usage statistics — USA
• Sentry — error monitoring — USA

5. Transfers outside Iraq

Most of these providers store or process data outside Iraq, in the European Union and the United States. We use providers that commit by contract to protect it. By using Umrachi you understand that your data is transferred to these countries.

6. How we protect it

Data is encrypted in transit. Passport scans are kept in private storage, encrypted at rest and never available at a public link; only the agency handling the booking and our authorised staff can open them. Access inside each agency is limited by staff role.

7. How long we keep it

Proposed periods, to be confirmed in legal review:

• Account data: while your account is active; deleted or anonymised after you delete it, except records we must keep.
• Booking and payment records: 5 years after the trip, for accounting.
• Passport numbers and scans: deleted 12 months after the trip returns, unless the law requires longer.
• Verification codes: they expire within minutes.

8. Your rights

You can ask to see, correct or delete your personal data, object to how we use it, or withdraw consent. You can delete your account in your account settings. For anything else write to support@umrachi.com; we reply within 30 days and may need to confirm your identity first. We may keep data the law requires us to keep, and data needed for an open booking or dispute.

9. Cookies

We use essential cookies to keep you signed in and to remember your language, market and checkout. On our public pages we use Google Analytics, with advertising features and Google signals turned off. We use no advertising cookies.

You can block or delete cookies in your browser, or use Google’s opt-out add-on for Analytics. Blocking essential cookies stops sign-in from working.

10. Children

Umrachi is for adults. Children’s details are given by the parent or guardian booking for them.

11. Changes and contact

We publish any update here with its date and tell account holders about important changes. Questions or requests: support@umrachi.com, or [COMPANY LEGAL NAME], [REGISTERED ADDRESS].