Privacy Policy

SaltWater is an online marketplace operated by Company Name, commercial registration CR Number, registered at Registered Address. The data controller for this platform is Company Name, and privacy enquiries can be sent to privacy@exploresaltwater.com.

• Account data: name, email address, phone number, password hash and account role (guest, provider, administrator).
• Booking data: listings viewed and booked, trip dates, guest counts, booking references and QR check-in codes.
• Payment data: amount, currency and payment status. Full card numbers are not stored on our servers; card processing is handled by our payment processor Payment Processor.
• Communications: messages exchanged with providers or support, reviews, ratings and newsletter subscriptions.
• Device and usage data: pages viewed, searches, saved listings, approximate location when you use “Near me”, browser type and IP address.

Precise GPS location is only read when you explicitly tap “Near me” and is used for that search session only.

• To create your account, authenticate you and keep the platform secure.
• To process bookings and payments, issue e-tickets and share the details a provider needs to deliver your trip.
• To send service emails such as confirmations, reminders, cancellations and password resets.
• To provide support, resolve disputes and prevent fraud or abuse.
• To measure and improve the marketplace using aggregated analytics.
• To send marketing messages where you have subscribed; you can unsubscribe at any time.

We process personal data to perform the booking contract with you, to comply with legal obligations, to protect legitimate interests such as fraud prevention, and on the basis of your consent for marketing and optional analytics. Where GCC law requires explicit consent, we rely on the consent you give when creating an account or accepting cookies. Lawyer review: confirm consent wording against KSA PDPL.

• Providers (boat owners, villa hosts, activity operators) receive the booking details needed to serve you.
• Cloud hosting, database and storage: our managed backend provider.
• Email delivery: transactional and authentication emails are sent from notify.exploresaltwater.com through our email provider.
• Payments: Payment Processor processes card transactions and receives the data required for settlement.
• Authorities: where disclosure is required by applicable law or a valid legal order.

We do not sell personal data.

Our infrastructure may store or process data in Hosting Region(s), which may be outside your country of residence. Transfers are protected by contractual safeguards with our processors. Lawyer review: confirm cross-border transfer disclosure and any KSA data-residency requirement.

Booking, invoice and payment records are retained for Retention Period — accounting/tax to meet accounting and tax obligations. Account, message and analytics data are retained while your account is active and for Retention Period — account closure after closure, unless a longer period is legally required.

• Traffic is encrypted in transit over HTTPS/TLS.
• Database access is restricted by row-level security so records are only readable by their owner, the counterparty to a booking, or an administrator.
• Passwords are stored as salted hashes by our authentication provider and are never visible to staff.
• Access to administrative tools is limited to accounts with an administrator role.

No online service can guarantee absolute security. We do not claim any certification or audit outcome on this page.

Accounts are for adults aged 18 or over. Minors may join trips only under the responsibility of a booking adult. We do not knowingly create accounts for children.

You may request access to, correction of, or deletion of your personal data, withdraw consent, or object to certain processing. Submit a request through our Data Deletion & Privacy Request page or by emailing privacy@exploresaltwater.com. We aim to respond within Response SLA — e.g. 30 days.

We may update this policy. Material changes will be announced on this page and, where appropriate, by email. The Arabic and English versions are both official; in case of conflict, Governing Language prevails.