Privacy

1. Data we may process

This can include service and order details, contact information you choose to provide, uploaded files, order and invoice identifiers, support messages, delivery status, payment-verification references such as a transaction hash, and limited security metadata such as hashed IP information in selected workflows. The free starter trial uses a random device identifier whose hash is stored server-side to help prevent abuse.

2. Why we use data

We use data to quote, create and execute orders, upload files, verify entitlement and payment, deliver results, provide support, prevent fraud and spam, diagnose failures, improve reliability, and meet accounting or legal obligations where required. We do not sell customer data to advertisers.

3. Local storage and analytics

Your browser may store language settings and a random free-trial identifier in Local Storage. The identifier itself does not contain your name or email. Limited operational analytics may be used to understand website performance and prevent abuse. Workflows designed for analytics respect Do Not Track / Global Privacy Control signals, and analytics are not intended to store order content or complete transaction hashes.

4. Files

Customer files are stored in private storage, not a public bucket. Delivery links, when issued, are temporary signed links restricted by order entitlement. Unattached uploads are eligible for cleanup; automatic deletion at a fixed deadline is not guaranteed. Files attached to an order are kept only as reasonably needed for delivery, support, security, and legal obligations and may then be deleted. Customers should retain their own originals and delivered copies.

5. Large files and security

Large files may upload directly through a temporary signed upload URL into private storage or quarantine before processing. We apply format, MIME, signature, structural, archive, and active-content checks and may hold complex files for additional review. These controls are risk-reduction measures, not a guarantee that every form of malware can be detected.

6. Payments and public blockchains

For cryptocurrency payments, transaction hashes and transaction details exist on a public blockchain by design. We use the full reference only where operationally required for verification and reduce unnecessary duplication in audit records through shortened fingerprints where feasible. We never ask for CVV, PIN, OTP, seed phrases, or private keys.

7. Infrastructure and processors

The service may rely on hosting, database, storage, blockchain/payment infrastructure, OCR, or AI providers where needed for a particular order. Only data reasonably necessary for the relevant task is shared with those providers, subject to their terms and safeguards. Infrastructure may be located in different countries, so cross-border processing can occur depending on the service and provider.

8. Legal disclosure and third parties

We may disclose the minimum necessary information where legally required, to protect rights, prevent fraud, or handle a dispute. Where ALFITOURI makes a referral, the customer deals directly with the original provider and information given to that provider is also governed by the provider's privacy policy.

9. Retention

We do not intentionally retain data longer than reasonably needed for service delivery, support, fraud prevention, accounting, security, and legal obligations. Limited audit records may remain after file deletion where needed to prove payment, approval, or prevent abuse. You may request deletion of files or correction of contact information, subject to records that must or may lawfully be retained.

10. Your rights

Depending on applicable law, you may have rights to access, correction, deletion, objection, or restriction of certain processing. Use the Support section and include the order code where available. We may request enough information to verify that you control the relevant order before acting on a privacy request.

11. Security

We use private storage, row-level security and least privilege, randomized tracking capabilities, expiring links, rate limits, on-chain payment verification, and file validation. No internet service can truthfully promise absolute security, so our approach is to layer controls and minimize retained data.

12. Eligibility and updates

You must have legal capacity and authority to submit materials and request the service. This policy may be updated as the service evolves. The displayed version and effective date identify the applicable policy. Contact us through the Support section on alfitouri.com.

13. Sensitive-data minimization

Do not upload passwords, seed phrases, private keys, CVV, PIN, OTP codes, unnecessary government identifiers, or unrelated sensitive personal data. If a lawful service genuinely requires sensitive or regulated information, provide only the minimum required and use an appropriate secure channel if offered. ALFITOURI may delete or refuse information that is not necessary for the service.

14. Confidentiality and access control

Non-public customer materials are treated as confidential. Access is restricted by technical and operational controls to people or systems with a service, support, security, compliance or legal need. We do not authorize unrelated use of customer materials through ALFITOURI.

15. Bank-transfer and KYC data

Bank or commission transactions may involve beneficiary name, IBAN, SWIFT/BIC, invoice, commission statement, remittance advice or KYC/source-of-funds records where lawfully required. These data are used only for payment, compliance, accounting and legitimate dispute purposes, and bank details are not requested before there is a reasonable operational need.

16. Security incidents

If ALFITOURI becomes aware of a confirmed personal-data breach that creates a notification duty under applicable law, it will investigate, contain the incident, preserve relevant evidence and make legally required notifications within the applicable timeframe. Unconfirmed alerts or public speculation are not treated as a confirmed breach.

17. Referrals and third parties

If ALFITOURI introduces a customer to an independent provider, the customer contracts with that provider directly unless a separate lawful written arrangement states otherwise. Data submitted to the provider is governed by the provider's privacy policy. ALFITOURI shares referral information only as reasonably necessary and where there is a lawful basis or customer action supporting the introduction.

18. Children and capacity

The service is not intended for a person who lacks legal capacity to enter the relevant transaction without appropriate authorization. Do not submit children's personal data unless it is necessary for a lawful service and you have the required authority or consent.

19. Changes and contact

Future updates are identified by version and effective date. The version recorded with an order or acceptance action helps establish the policy presented for that transaction. Contact ALFITOURI through the Support section on alfitouri.com for privacy requests or questions.

File-retention clarification

A cleanup function exists for unattached uploads, but we do not promise automatic deletion at a fixed deadline. Email your order reference to request deletion; records needed for support, security or legal obligations may remain.

Current infrastructure

Current infrastructure uses Vercel for hosting and Supabase for data and storage. The retention clarification above explains the limits of deletion timing; the original recorded version remains the order reference.

Partner referral requests

We retain your submitted name, contact details and requirements, selected partner and destination, language, source page, reference, submission and consent timestamps, and review status. These details are used to qualify and register the referral; they are not automatically sent to the partner. Relevant details are shared with your selected independent partner after review and registration, with your consent.

A keyed hash derived from the connection address is used to limit abuse; the referral record does not store a raw IP address. Do not send passport or banking details. To request access, correction, consent withdrawal or deletion, email moayedalfitouri@gmail.com with your reference. Records are retained as needed for enquiry handling, referral evidence and applicable obligations, then deleted when no longer needed.

Optional analytics choices

Google analytics and optional chat start disabled and load only after acceptance. Rejection leaves search and referral intake available. Use Privacy choices to change your decision or withdraw consent. Chat does not load on referral-form pages. Form contents are excluded from analytics. The embedded travel provider and affiliate links activate only after acceptance. Without acceptance, the flight form opens an untracked search at the independent provider; that provider applies its own privacy policy after you leave this site. Rejection and withdrawal prevent travel marketing requests on this site.