How we use your information

Information we collect

We collect information you choose to submit: contact enquiries (name, email, topic and message); venue claims (venue details, contact name, email, optional phone and supporting information); venue corrections (email, venue and correction message); newsletter subscriptions (email and consent evidence including notice version, time and source); and restricted administrator access (account email, authorisation and authentication/session records).

Technical information and preferences

Hosting and security systems may process limited technical information such as request time, IP address, browser/user-agent and security logs. The language selector stores a wn_lang preference cookie for up to one year. Browser location, if you choose it, is used in your browser to sort results and is not intentionally stored with a profile in this release.

Why we use it

We use contact, claim and correction information to handle your request, communicate with you, protect listing accuracy, prevent abuse and keep an audit of material listing decisions. We use administrator information to authenticate authorised staff and protect the service. Newsletter information is used only for the newsletter you expressly requested; other form submitters are not added unless they separately subscribe.

Purpose and consent

Marketing uses your affirmative newsletter consent. Other processing is limited to the lawful, specific purpose you requested and operation and security of the service. Where consent applies, you may withdraw it at any time without affecting earlier processing.

Services involved

We use Vercel for hosting and server runtime, Supabase for database storage and restricted authentication, and Postmark for operational email. Where enabled, Google Places supplies a live Google Rating for a human-verified Place ID; written Google reviews, reviewer names and reviewer profiles are not requested. Verified information about processing locations, subprocessors and transfer safeguards is provided below when configured.

Google Maps Platform Terms ↗ · Google Privacy Policy ↗

External services

When you choose an external link, such as a venue website, Google Maps, WhatsApp or Instagram, that third party processes information under its own privacy terms. We do not send newsletter subscriber lists to venues.

Retention and deletion

Contact enquiries are kept for 12 months after the last substantive interaction; correction submissions for 12 months after closure; and venue-claim personal information for 24 months after closure, rejection, withdrawal or replacement. Newsletter details are kept until unsubscribe or the newsletter ends, then only a restricted suppression record for up to three years. Closed administrator profile data is removed or de-identified after 90 days. Necessary authentication/security logs are kept for no more than 12 months unless an incident needs longer investigation. A documented dispute, complaint, legal duty or fraud/security investigation may pause deletion only for affected records; holds are reviewed every six months. Deleted records may remain in encrypted backups until the documented backup cycle expires and are not restored for ordinary use.

Newsletter choices

Newsletter consent is separate from account, contact and venue-claim submissions. We record the notice version, purpose, source and time of an affirmative opt-in.

Your choices and requests

You may ask whether we process your personal information and request access, correction or deletion where the purpose or lawful justification has ended. You may object or withdraw consent where applicable. We may request information needed to verify identity and may retain records where Qatar law or a documented legal claim requires it. Use the newsletter unsubscribe link to stop marketing. For other requests or a complaint, use the Contact page or the configured privacy email. If unresolved, you may contact the competent Qatar personal-data authority.

Cookies and analytics

Venue analytics records daily aggregate counts such as profile views, offer interactions and outbound clicks. It does not create advertising profiles, persistent visitor fingerprints or per-user click histories. A short-lived, first-party security cookie may be used to enforce the rating-submission cooldown; its server-side digest is kept separately from business analytics and expires after the cooldown. Essential session or security storage may also be used where needed to operate and protect the service.

Security

We use access controls, restricted administrator authentication, database row-level controls, transport security, monitoring and other measures proportionate to the information and risk. Provider encryption at rest is not represented as application-level or field-level encryption. No internet service can guarantee absolute security. Do not send identity documents or sensitive personal information unless specifically requested through an approved secure process.

Children

The service is not directed to children and we do not knowingly seek children’s personal information. A child should not submit personal information without an appropriate parent or guardian. Contact us if you believe a child submitted information so we can review and act.

Changes to this notice

We may update this notice when the service or legal requirements change. We will publish a new effective date and give appropriate notice if a material change affects an existing consent.