Privacy Policy

1. Who is responsible for your data

Side Quest is the party responsible for deciding how and why your personal data is processed (the “data controller” under applicable law).

Note to finalize: Side Quest is not yet incorporated as a registered legal entity. Until it is, the founder operates as a sole proprietor and is personally responsible as data controller. Once you register a company, replace this section with the legal name, registration number, and registered address.

We aim to comply with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, overseen by the Saudi Data & AI Authority (SDAIA). If you contact us from outside Saudi Arabia (for example, the United States), additional local rights may apply. See Section 10.

2. The information we collect

2.1 Information you give us

When you fill out the inquiry form, take the intro call, or correspond with us, we may collect:

• Identity and contact details: your name, email address, phone number or messaging handle.
• Trip details and preferences: travel dates, budget, climate preferences, places you've already been, and things you actively don't want.
• Dietary needs (which may reveal information about your health or religious beliefs (treated as sensitive data; see Section 3).
• Companion information: if you travel with others, the names and relevant details of the people in your party. If you give us information about other people, you confirm they're aware and agree to this policy.
• Travel documents: passport details, date of birth, nationality, and passport numbers, where these are needed to book flights or arrange visas (for example, an electronic travel authorization). This is sensitive data; see Section 3.
• Payment information: processed through a third-party payment provider. We do not store your full card details on our own systems.

2.2 Information from your intro call

Your 20-minute intro call takes place over Google Meet. We may take written notes during or after the call. We do not record calls unless we tell you in advance and you agree.

2.3 Information we collect automatically

When you use the Site, we and our providers collect technical data automatically:

• Device and browser type, IP address, and approximate location.
• Pages viewed, links clicked, and how you move through the Site.
• This is gathered through our hosting provider (Vercel) and our product-analytics provider (PostHog). See Section 7.

2.4 Information from third parties

We may receive information about you from our payment processor (confirmation that a payment succeeded), and from travel partners when we book on your behalf (booking confirmations, reference numbers).

3. Sensitive personal data: passports, dietary, and health-related details

Some of what we handle is sensitive personal data, and we treat it with extra care. This includes your passport and travel-document details and dietary needs (which can indirectly reveal health or religious information).

Our commitments:

• We only collect it when there's a genuine need, for example, a passport is only requested when we need it to book a flight or arrange a visa for you.
• We ask for your explicit consent before collecting and using sensitive data for these purposes.
• We use it only for your trip. Passport details are used to make bookings and visa arrangements and for nothing else.
• We share it only with the specific partner that needs it , such as the relevant airline, hotel, visa authority, or experience provider, and only the minimum required.
• We store it securely and delete or anonymize it once it is no longer needed (see Section 8).
• We never sell it, and we never use it for advertising.

You can ask us to delete your travel documents at any time after your trip is complete.

4. How and why we use your data

We do not use your information for automated decision-making or profiling that produces legal effects, and we do not sell your personal data.

5. How we share your data

We share personal data only with parties who help us run the Services, and only as needed:

• Travel and experience partners: airlines, hotels, tour and activity providers, and visa or government authorities, in order to make your bookings.
• Payment processor: a third-party provider to handle payments securely (for example, payment links or bank transfers).
• Technology providers: Vercel (website hosting), Supabase (database and secure storage for your inquiry and trip details, including travel documents), PostHog (analytics), Google Meet (intro video calls), and Google Workspace / Gmail (sending your reveal, packing note, and itinerary by email).
• Professional advisers: accountants or legal advisers where reasonably necessary.
• Authorities: if required by law, court order, or to protect our rights or someone's safety.

We require these parties to protect your data and to use it only for the purposes we specify. We do not allow them to use it for their own marketing.

6. International transfers

Side Quest is based in Saudi Arabia / the GCC, but planning a trip almost always involves sending data outside the Kingdom, for example, to a hotel abroad, an airline, or a visa system in your destination country. Some of our technology providers (such as Vercel and PostHog) also process data outside Saudi Arabia.

When we transfer your data internationally, we do so in line with the PDPL's rules on cross-border transfers and take reasonable steps to ensure your data remains protected. By giving us your travel details, you understand that delivering your trip requires these transfers.

7. Cookies and analytics

The Site uses cookies and similar technologies to function and to understand how visitors use it.

• Essential cookies / hosting: set by Vercel so the Site loads and works correctly.
• Analytics: we use PostHog to see which pages are visited and how the Site is used, so we can improve it. This may involve cookies or similar identifiers.

You can control cookies through your browser settings; blocking some cookies may affect how the Site works. Where required, we will ask for your consent to non-essential analytics cookies.

8. How long we keep your data

We keep personal data only as long as we need it:

• Inquiries that don't become trips: kept for a limited period in case you come back, then deleted.
• Trip and booking records: kept for the duration of your trip and a reasonable period afterward to handle follow-ups, refunds, and disputes.
• Sensitive travel documents (passports, etc.): deleted or anonymized once your trip is complete and no longer needed for any related booking or refund.
• Financial records: kept for as long as accounting and tax rules require.

9. How we protect your data

We use reasonable technical and organizational measures to protect your personal data, including access controls, secure third-party providers, and limiting who can see sensitive documents. No method of transmission or storage is completely secure, but we work to protect your information and to respond quickly if a problem occurs. If a data breach affects your personal data, we will notify you and the relevant authority where the law requires.

10. Your rights

Under the Saudi PDPL, you have the right to:

• Be informed about how your data is collected and used.
• Access the personal data we hold about you.
• Request correction of data that is inaccurate or incomplete.
• Request destruction of your personal data when it is no longer needed.
• Withdraw consent at any time (this won't affect processing already carried out).

To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity first. If you believe we have mishandled your data, you can raise it with us, and you may also contact the Saudi Data & AI Authority (SDAIA).

If you are in the United States (e.g. California): depending on your state, you may have the right to know what personal information we collect, to request deletion, to correct it, and to opt out of any “sale” or “sharing” of personal information. We do not sell your personal information. To make a request, contact us at the email below; we will not discriminate against you for exercising these rights.

11. Children and family bookings

Our Services are intended for adults. Only someone 18 or older can submit an inquiry, pay, and enter into an agreement with us. We don't market to children or take inquiries directly from anyone under 18.

We understand that families travel together. If your trip includes a minor in your party (for example, your own children), the booking adult must be the minor's parent or legal guardian, or have their permission. In that case:

• You provide the minor's details on their behalf, and you confirm you're authorized to do so.
• We may need the minor's name, date of birth, nationality, and passport details to book flights and arrange any visas, exactly as we would for an adult traveller.
• We use a minor's information only to plan and book that trip, and we protect it with the same care as any sensitive data (see Section 3). We don't use it for analytics or marketing.

If you believe a child's data has been given to us by someone without the right to do so, contact us and we'll delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll change the “Last updated” date above, and for significant changes we'll take reasonable steps to let you know. Please check back occasionally.

13. Contact us

For any privacy question or to exercise your rights:

Side Quest
Email: Support@gosidequest.ai