Privacy policy

Yalator is operated by Elevate Tourism L.L.C, a tourism company licensed in Dubai, United Arab Emirates under trade licence number 916444, issued on 17 November 2020. When you book through this site, we are the party you are contracting with and the party responsible for your personal data.

Registered address: Elevate Tourism Hub, Office No. 10, Al Khayat Avenue, Al Quoz 1, Dubai, United Arab Emirates. Written enquiries about your personal data reach our data protection contact at dpo@elevatedmc.com.

When you make a booking, we ask for:

• Your name — the operator needs to know who is arriving.
• Your email address — where the confirmation goes, and how we reach you if something changes.
• Your phone number — so the operator or a driver can reach you on the day.
• The details of what you booked: the experience, the date, the departure and how many people are travelling.
• Anything you tell us in the notes, such as a dietary requirement or an access need.
• If you sign in with Google or Apple: your name and email address, and from Google a link to your profile picture. We never see your password, and neither provider tells us anything else about you.

We also record ordinary technical information when you use the site — the pages you view and rough location from your IP address — which is what makes the site work and tells us which experiences people are actually looking for.

Everything above applies in our iPhone and Android apps too. The apps ask for three things a website cannot, and each is asked for only when you use the feature that needs it.

• Your location, if you tap “use my location” when choosing where you are going. It is used to find the nearest place we sell experiences in, and it is not stored or sent anywhere afterwards. Say no and you pick a place from the list instead — nothing else changes.
• The camera, to scan a QR code an agent has sent you so their trip appears in your account. It reads codes and nothing else: no photograph or video is taken, kept or uploaded, and the apps do not ask for the microphone at all.
• Somewhere to keep you signed in. Your session is held in the iPhone Keychain or Android’s equivalent secure storage, which is the part of the phone designed for it. Signing out removes it.

Trips and saved experiences you have not signed in for are kept on the device itself, which is why they are on that phone and not another one. Signing in copies them to your account.

The apps use Firebase Analytics— Google’s analytics for mobile apps, which is a different product from the Google Analytics on the website — to count how features are used. It is named separately because the two collect through different mechanisms, and a policy that said only “Google Analytics” would be describing half of it.

This is worth stating precisely rather than reassuringly. Payment is handled by Stripe. The card fields you type into are served by Stripe, from Stripe’s own domain, inside a frame on our page.

Your card number, expiry and security code go directly to them. They do not pass through our servers, are not stored in our database, and are not present anywhere in the code that runs this site. What we receive back is a reference to the payment and the last four digits, which is what appears on your confirmation.

We share the minimum that makes the booking work, with:

• The operator running your experience — your name, contact details, party size and any notes. They cannot run the trip without them.
• Stripe, our payment processor, to take and refund payments.
• Brevo, which sends our transactional email, so your confirmation reaches you.
• Google, for analytics — Google Analytics on the website and Firebase Analytics in the apps — which tells us how they are used in aggregate.
• Google and Apple, if you choose to sign in with them. They confirm to us that you are who you say you are; we do not tell them anything about your bookings.

We do not sell your data, and we do not pass it to anybody for their own marketing. If you subscribe to our mailing list that is a separate, optional choice, and one click unsubscribes you.

Your bookings, and the money. A booking record — what you bought, when, for how much — is a financial record, and UAE tax and accounting law requires us to keep those for a set number of years. We keep them for exactly as long as that obligation lasts, and no longer.

Everything else: two years. An account that has never booked, the experiences you saved, the trips you planned, and your marketing preferences are kept for two years after you last use them. After that we remove or anonymise them.

Asking us to delete something does not wait for either period — see below. What we cannot delete on request is the part the law requires us to keep, and we will say so rather than quietly keeping it.

You can ask us to:

• Send you a copy of what we hold about you.
• Correct anything that is wrong.
• Delete what we are not legally required to keep.
• Close your account entirely — see below for what that removes and what it cannot.
• Stop sending you marketing email — which the unsubscribe link in every one of them also does, immediately.

Closing your account is something you can do yourself, in the app or here, without asking us. How to delete your account sets out exactly what goes and what has to stay.

Ask by writing to us. We may need to check you are who you say you are before we hand over personal data, which usually means asking about a booking only you would know.

We use the small number of cookies the site needs to function, plus Google Analytics to understand how it is used. We do not run advertising trackers.

Your browser can block or delete cookies. Blocking the functional ones will stop parts of checkout working, because they are how the site remembers what you are in the middle of.

If we change how we handle your data we will update this page and the date at the top of it. If a change is significant and affects a booking you already hold, we will email you rather than rely on you noticing.

Questions about any of this are welcome — including the awkward ones. The Help Centre covers how bookings work; for anything about your data, write to us directly.