Privacy Policy

This policy explains what personal data Dayf collects when you use this website or stay in one of our homes, why, who we share it with, and your rights.

Who is responsible

The company that handles your booking is responsible for your data: Dayf Hub Vacation Homes Rental L.L.C for homes in the UAE, Dayf S.A.L for homes in Lebanon (addresses in the Terms of Service). Contact us about privacy at hello@dayf.homes.

What we collect

• Name, phone number, email, when you create an account: to sign you in, confirm bookings and send receipts.
• Booking details (home, dates, guests, extras, notes, messages), when you book or contact us: to provide your stay and support you.
• Payment details (card brand, last 4 digits, amounts, payment status), when you pay: to take payment, refund and keep financial records. Your full card number goes only to the bank or card processor. Dayf never sees or stores it.
• Identity documents of guests, before check-in: required by law in the country of the home (see Guest Identification).
• Trip Builder answers and saved plans, when you use Trip Builder: to build and save your plan.
• Owner details and property information, when you ask about listing a home: to reply and prepare an offer.
• Device and usage data (IP address, browser, pages viewed, searches), when you browse: to keep the site secure, prevent abuse and understand demand. Search and page view data is recorded without your name.

Legal basis

We use your data to perform your booking (contract), to meet legal duties such as guest registration, tax and accounting, for our legitimate interests in running a secure and useful service, and with your consent where we ask for it. For guests in the EU or UK, these are the bases under the GDPR.

Messages

We send booking messages by email, SMS and WhatsApp: sign-in codes, confirmations, arrival details and replies from our team. We do not send marketing without your consent, and you can stop it at any time.

Who we share data with

We share only what each provider needs to do its job:

• The home's owner: guest name, dates and number of guests.
• Property management system: Hostaway, which holds our reservations and calendars.
• Payments: Network International (cards for UAE homes), Mastercard Payment Gateway through Bank of Beirut (cards for Lebanon homes), Whish Money (Lebanon).
• Messaging: respond.io (our team inbox), WhatsApp (Meta), Twilio (sign-in codes by SMS and voice call), Resend (emails).
• Hosting and database: Vercel (website hosting) and Supabase (database). Both run in India (Mumbai).
• Maps and places: Google Maps, Google Places and Google Fonts, which load from Google's servers when you view a page.
• Trip Builder: Anthropic, whose AI turns your answers into a plan. We send your trip answers, not your name or contact details. Anything you type in the free text box is sent as written, so please do not include personal details there.
• Authorities: where the law requires, for example guest registration with tourism or security authorities.

We do not sell your data. Your data is stored outside the UAE and Lebanon: our database and website servers are in India, and some providers process data in the EU and the US. We use providers that commit to protect it.

Security

Access to guest data is limited to staff who need it, protected by two-step sign-in. Door codes and identity documents are shown only to the people who need them.

How long we keep data

We keep booking and payment records for as long as tax and accounting laws require: at least five years for bookings with our UAE company, and as long as Lebanese law requires for bookings with our Lebanese company. Identity documents are kept only as long as the guest registration rules require. Account data is kept until you delete your account, then removed except what we must keep by law.

Your rights

You can ask to see, correct or delete your data, ask us to stop a use, or ask for a copy. You can delete your account from Your account on the website. EU and UK guests may also complain to their data protection authority. Contact us first and we will reply within 30 days.

Children

Bookings are made by adults. We collect children's details only when the law requires them for guest registration.

Changes

We may update this policy. The date at the top shows the latest version.