Privacy Policy

The Aurion (fada alibtikar alawla Company, Commercial Registration No. 7044181357), a company operating in the Kingdom of Saudi Arabia, is the data controller for the personal data described in this policy. We operate theaurion.com, where guests book stays at properties we own and operate.

This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have under the Saudi Personal Data Protection Law (PDPL). For anything privacy-related, contact us at support@theaurion.com.

• Account data: your name, email address, phone number, country, and preferred language and currency.
• Booking data: the guest name, email address, phone number and country on each booking, your stay dates, the number of guests, and payment references (amounts, currency, and transaction identifiers).
• Sign-in data: we use passwordless sign-in — a one-time code and secure link sent to your email. We never store a password for you.
• Technical data: basic session information, IP addresses, request details, and error logs that help us keep the service secure and working properly.

Your card number never touches our servers. Card payments are entered directly with our payment processor over a secure connection; we only receive confirmation of the payment and its reference identifiers.

• To perform our contract with you: creating and managing your bookings, taking payment, issuing refunds, and sending booking confirmations and other essential service emails.
• To meet legal obligations: keeping the tax, VAT, and accounting records that Saudi law requires of us.
• To run our business responsibly: guest support, preventing fraud and misuse, and improving the service.
• With your consent, where the PDPL requires it for a particular use. You can withdraw consent at any time.

We never sell your personal data, and we use no advertising or third-party analytics trackers. Your personal data is shared only where providing the service requires it:

• Our payment processor — when you pay, you enter your payment details directly with the processor; we receive only confirmation of the payment and its reference identifiers.
• Convex — the database platform where our application data, including accounts and bookings, is stored.
• Resend — delivers our transactional emails, such as sign-in codes and booking confirmations, and therefore processes the name and email address they are sent to.

The infrastructure that hosts and delivers the website also processes technical data such as IP addresses and request logs in the course of serving the site.

We may also disclose data where Saudi law requires it or where a competent authority lawfully requests it.

The providers above operate infrastructure outside the Kingdom of Saudi Arabia, so your data may be processed abroad. When that happens, we transfer it in line with the PDPL's requirements for cross-border transfers, with contractual and technical safeguards in place to keep it protected to the same standard.

We keep your data for as long as your account is active and as long as it is needed for your bookings. Booking and payment records are then retained for the periods Saudi tax and commercial regulations require, after which they are deleted or anonymised.

You have the right to:

• know how we process your personal data;
• request access to, and a copy of, the data we hold;
• have inaccurate or incomplete data corrected;
• request deletion of data we no longer have a lawful basis to keep;
• withdraw any consent you have previously given.

To exercise any of these rights, email support@theaurion.com and we will respond within the timeframe the PDPL sets. You may also lodge a complaint with the competent data protection authority in the Kingdom of Saudi Arabia (SDAIA).

We use essential first-party cookies to keep you signed in and remember your language preference. If you arrive through an authorised partner's referral link, we also store that partner's referral code in a first-party cookie for 30 days so the resulting booking can be attributed correctly. This is not used for advertising or cross-site tracking.

Our service is intended for adults. Accounts and bookings may only be created by people aged 18 or over, and we do not knowingly collect personal data from children.

We may update this policy from time to time. The current version is always published on this page with its "Last updated" date, and material changes will be reflected there before they take effect.

For any question about this policy or your personal data, write to us at support@theaurion.com.

You can also write to us at 3201 Mas’ar Al Harami Al Jamawat, Madinah 42371, Kingdom of Saudi Arabia.