Privacy Policy

We collect the following categories of personal data: • Account Information: Full name (English and Arabic), email address, phone number, date of birth, gender, nationality • Identity Documents: ID type (National ID, Iqama, or Passport), ID number, and expiry date — required for maritime permit compliance • Diving Credentials: Certification agency, level, certification number, and card images • Booking Data: Trip selections, participant details, scheduling preferences, special requests • Payment Information: Processed securely through Moyasar; we do not store full card numbers • Location Data: Approximate location for showing nearby dive sites and centers • Dive Log Data: Dive records, depths, durations, marine life sightings, and site ratings • Usage Data: Pages visited, features used, device information, and browser type

We use your personal data for the following purposes: • Booking Management: Processing reservations, sending confirmations, and managing cancellations • Zawil Maritime Permits: Submitting required passenger information to the Saudi Coast Guard via the Zawil system for boat and liveaboard trips • Communications: Sending booking confirmations, reminders, and service updates via email (Resend) and SMS (Twilio) • Platform Improvement: Analyzing usage patterns to enhance features and user experience • Safety Compliance: Verifying diver certifications and medical screening responses • Customer Support: Responding to inquiries through our AI-powered support system (OpenClaw) and human agents

We share your information with the following trusted service providers, strictly for the purposes described: • Moyasar: Payment processing (credit cards, mada, bank transfers). Subject to Moyasar's privacy policy and SAMA regulations. • Twilio: SMS/OTP verification. Phone numbers are shared for authentication purposes only. • Resend: Email delivery for booking confirmations, reminders, and communications. • Zawil (ELM): Maritime sailing permit issuance. Passenger ID information is submitted to the Saudi Coast Guard as required by law. • Dive Centers: Booking details and participant information are shared with the dive center you book with. We do not sell your personal information to third parties.

We retain your personal data for as long as your account is active or as needed to provide our services. Specifically: • Account data: Retained until you request deletion • Booking records: Retained for 7 years for legal and tax compliance • Zawil permit data: Retained as required by Saudi maritime law • Dive log data: Retained until you request deletion You may request deletion of your account and personal data at any time by contacting info@ghaws.ai. We will process your request within 30 days, subject to legal retention requirements.

We use essential cookies to maintain your session and preferences (language, authentication). We do not use third-party advertising cookies or tracking pixels. Analytics data is collected anonymously to improve platform performance.

You have the right to: • Access your personal data and receive a copy • Correct inaccurate information • Request deletion of your data (subject to legal requirements) • Withdraw consent for optional data processing • Object to data processing for marketing purposes • Data portability — receive your data in a structured format To exercise any of these rights, contact us at info@ghaws.ai.

We comply with the Saudi Personal Data Protection Law (PDPL) issued by Royal Decree M/19. We process personal data based on legitimate interest (service delivery), contractual necessity (booking fulfillment), and legal obligation (Zawil maritime permits). The Saudi Data & Artificial Intelligence Authority (SDAIA) oversees our compliance.

For users in the European Economic Area (EEA), we process data under GDPR. Our legal bases include contract performance (bookings), legitimate interest (platform improvement), and consent (marketing communications). You may lodge complaints with your local supervisory authority. Data transfers outside the EEA are protected by appropriate safeguards.

Our platform is not intended for children under 14. Minors between 14-18 may use the platform with parental consent for diving activities, as required by diving certification standards. Guardian consent forms are collected for minor participants.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date. Continued use of the platform after changes constitutes acceptance of the updated policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: • Email: info@ghaws.ai • Platform: ghaws.ai/contact • WhatsApp: Available through our support widget