Privacy Policy

AL-Taj is operated by MYZ for Trading and Technology Services Company, registered in Saudi Arabia. The service is offered internationally for individual travelers, companies booking for employees, and travel agents.

For privacy or support requests, contact us at support@altajtours.com.

We store only the information needed to operate bookings, support customers, and maintain booking records:

• Name
• Email address
• Mobile number
• Payment provider references and payment status
• Booking history, booking reference, PNR, itinerary, fare, and ticketing status

Some travel and payment information is required to complete a booking, but it is processed for ticketing or payment and is not permanently stored in our backend as part of the customer record:

• Passenger date of birth
• Passport or identity document number
• Passport issue and expiry dates
• Nationality
• Uploaded passport or document images used for extraction
• Card or wallet details entered in a payment checkout

Passport or document images are used for OCR extraction and field mapping. They are not stored as permanent files. Extracted document data may remain temporarily in Redis/cache during the active booking and ticketing process, and is then erased.

We do not store card numbers, CVV, or full payment instrument details. Payments are handled by Razorpay today, and future payment options may include other providers such as mada Pay, Apple Pay, or similar gateways.

We use information to:

• Search, hold, book, ticket, cancel, reissue, and manage flights
• Create and track booking references and PNRs
• Process payment, payment verification, refunds, and payment disputes
• Support guest bookings and signed-in customer accounts
• Provide customer support and operational troubleshooting
• Improve reliability, product experience, and fraud prevention

We do not sell customer data and we do not share customer data for unrelated commercial benefit. To provide the booking service, we integrate with external platforms and service providers such as flight suppliers, airlines, payment gateways, OTP or communication providers, OCR infrastructure, email services, analytics tools, and support tools.

These providers process data only as needed for the relevant service, such as searching fares, creating or ticketing bookings, verifying payments, sending OTPs, or providing support. Their handling of data is also governed by their own platform terms and privacy policies.

Users may book as guests or through an account. Guest bookings can still be tracked using the booking reference and PNR. Signed-in users can access a more persistent booking history across sessions and devices.

We use cookies and browser storage to operate the booking platform:

• Session storage keeps booking-flow progress during a browser session, including search criteria, selected itinerary, passenger/contact details, selected extras, held booking details, guest session state, and idempotency keys.
• Local storage is used to remember language preference, currently English or Arabic.
• A secure httpOnly refresh cookie is used for signed-in account sessions.
• Razorpay or future payment providers may use their own cookies or similar technologies during payment checkout.

We may use analytics to understand product performance, booking conversion, payment drop-offs, hold usage, provider reliability, and post-booking service usage. Analytics must be configured to avoid personal, passport, payment, and supplier-sensitive data.

We do not send the following information to analytics tools:

• Passenger names
• Email addresses or mobile numbers
• Passport or identity document details
• Dates of birth
• PNRs, ticket numbers, or customer booking references
• Raw payment identifiers
• Raw airline, Tripjack, or payment-provider request and response payloads

Booked flight records are retained for up to 2 years for customer support, accounting, audit, and travel-service obligations. Passport images and passport/document details are processed for ticketing and are not retained as permanent backend records.

You may contact us to request access, correction, or deletion of your personal data, subject to legal, accounting, fraud-prevention, and travel-record obligations. Send requests to support@altajtours.com.

The platform serves international customers. By using the service, your data may be processed in countries where our systems, suppliers, airlines, payment gateways, or service providers operate, as required to deliver booking and support services.

We may update this Privacy Policy as the platform, providers, payment methods, analytics setup, or legal requirements change. The updated date above will show when the policy was last revised.