Privacy Policy

Last updated: 22 October 2026. "Smart Trip" (smarttrip.uk) is a trip-planning site owned and operated by Dheiab Alawfi, United Arab Emirates, who is responsible for processing your data. We follow the principles of UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.

1. Data we collect

• Account data: email, username, display name, password (stored hashed by the authentication provider; we cannot see it), member number and tier, and the date and time you accepted this policy.
• Your content: trips, itineraries and favorites you save, and messages between you and the site team or other members.
• Usage data: your daily AI request count, anonymous search statistics (destination name, number of days, month and class) not linked to your account, and an anonymous visit counter: a random identifier stored only on your device to count daily visitors (members and guests), without your email, name or IP address, visible only to the management team.
• Technical data: IP address and browser type are visible to hosting and map providers when your browser connects to them.

We do not collect payment data or sensitive data, we never sell your data, and we do not use it for advertising.

2. Why we process it (legal basis)

We process your data with your consent when you create an account, and as needed to provide the service: running your account, saving trips, enforcing daily AI limits, sending account notices (such as membership tier changes), preventing abuse and improving suggestions. We do not use your data for any other purpose without informing you and obtaining your consent.

Legal reference: Article 6 of UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection: consent must be clear, simple, unambiguous and easily accessible, and the data subject may withdraw it at any time, easily, without affecting the lawfulness of processing before withdrawal.

3. Who processes data for us

• Supabase: accounts, database and backend functions.
• Cloudflare: hosting, domain and visit analytics.
• Anthropic (Claude): AI; only your request text and trip details are sent, not your email or name.
• Resend: account emails.
• Wikipedia, Wikimedia, OpenStreetMap (Nominatim, Overpass, Photon), Open-Meteo, Unsplash and Pexels: place, map, climate and photo data; the destination name or approximate coordinates are sent, and they may see your IP address.

When you tap links to maps (Google Maps), booking sites or our other site "Tales Story", you go to external sites under their own policies; we do not send them your account data.

4. Transfers outside the UAE

The providers above may host data outside the UAE (such as the EU or the US). We transfer data only as needed to run the service, choose well-known providers with contractual and security safeguards, and you agree to this transfer when creating your account.

Legal reference: Articles 22 and 23: personal data may be transferred outside the UAE to a destination with adequate protection, or in specified cases including the data subject's explicit consent or a binding contract.

5. Retention

We keep your account data while your account exists. It is permanently deleted when you delete your account (encrypted backups may remain for a short period and are then erased). Anonymous statistics and temporarily cached public place lists do not identify you and may be kept to improve the site.

Legal reference: Article 5(7): data is not kept after its processing purpose is exhausted unless the owner is anonymized; Article 8(4): a processor deletes data when processing ends or returns it to the controller.

6. Your rights

By law you may: know what data we hold, why, and who it is shared with; get a copy in a readable format; correct it; delete it ("right to be forgotten"); restrict or object to processing; withdraw your consent at any time; and object to automated decisions. AI suggestions are advisory and are not used to make decisions that legally affect you.

How to exercise them: sign in, open "My card", then "Download my data" or "Delete my account permanently". Or email DHEIAB.ALAWFI@GMAIL.COM; we usually reply within 30 days.

Legal reference for your rights: Article 13 (right to obtain information); Article 14 (data portability in a structured, machine-readable format); Article 15 (correction of inaccurate data, and erasure when no longer necessary for the original purposes); Article 16 (restriction of processing); Article 17 (objection and stopping processing); Article 18 (objection to automated processing decisions).

7. Security and breach notice

We use encrypted connections (HTTPS) and restricted database access rules, and limit team access to those who need it. If a breach affecting your data occurs, we will notify you and the competent authorities as required by law.

Legal reference: Article 7: appropriate technical and organizational measures; Article 20: information security proportionate to the risks, including encryption; Article 9: notify the Data Office as soon as a breach is known, and notify the data subject if it may affect their privacy.

8. Browser storage

We store language, currency, trip drafts and temporary cached results on your device to speed things up. We use no advertising cookies or third-party tracking. You can clear them in your browser settings.

9. Children

The site is not directed to children under 13; users under 18 should use it under a parent or guardian's supervision.

10. Changes and complaints

We may update this policy and will announce material changes on the site. If we cannot resolve your complaint, you may contact the UAE Data Office.

Source: UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE Legislation portal). The above are excerpts and summaries for clarity; the full official text prevails in case of difference.

Contact

DHEIAB.ALAWFI@GMAIL.COM