Privacy Policy

1. Introduction

YallaChalet ("the service", "we", "us") is an Arabic-first directory of chalet rentals in Jordan. This document describes what data we collect when you browse the directory, contact a chalet owner, or create an owner account to claim or submit a listing. We have written this policy to be honest about what crosses the wire and what does not, in plain language a renter or owner can read in five minutes.

2. Data we collect

We collect only what we need to operate the directory and to give chalet owners aggregate statistics about how their listings perform.

• Owner account details — you only create an account if you are a chalet owner claiming or submitting a listing. We use Clerk (our authentication provider) to sign you in with an email address, Google, or Facebook. We store your Clerk user identifier, your email address, and — if you choose to add one — an optional contact phone number. The phone number is not required, is never used to log you in, and is kept only as an ordinary contact detail. Renters browsing the directory do not need an account.
• Ownership verification — when you claim an existing listing, you submit proof-of-ownership links: a Google Business Profile, a social-media profile, or the chalet's own website. We store those links and a member of our team reviews them manually before approving the claim. There is no verification code, and no SMS or WhatsApp step.
• yc_sid session cookie — a randomly generated identifier set as an HttpOnly, Secure, SameSite=Lax cookie with a 14-day lifetime. We use it to count distinct sessions per chalet listing for the owner-facing analytics dashboard. It contains no name, no email, no phone number, and no advertising profile. It is a functional cookie (see the Cookies section below).
• Google Analytics 4 — page-level traffic metrics (page views, referrer, approximate region, device class). Google Analytics loads on every visit; see the Cookies section for what that means and how to opt out at the browser level.
• Server logs — your IP address, user agent, requested URL, and response status are written to short-lived application logs for security and abuse-prevention purposes. We never publish these logs and we never join them to your yc_sid.

Cookies

The directory uses a small number of cookies. Neither is an advertising cookie, and neither is used to track you across sites we do not own.

• yc_sid — a first-party, functional session cookie. It is HttpOnly (JavaScript cannot read it), Secure, SameSite=Lax, and expires 14 days after your last visit. Its only purpose is to count distinct sessions per listing so owners can see how their chalets perform. It carries a random identifier and nothing else.
• yc_consent — a first-party cookie that records your response to the cookie notice so we do not show it on every page. It is readable by the page (not HttpOnly), holds only your notice choice, and lasts about one year.

Google Analytics sets its own cookies when it loads. Google Analytics currently loads on every visit, regardless of the notice — the notice is informational. If you do not want Google Analytics cookies, block them at the browser level (most browsers let you block third-party or analytics cookies) or use a tracker-blocking extension. Clearing your browser cookies removes yc_sid, yc_consent, and any Google Analytics cookies from this device.

3. Data we do NOT collect

• We do not assign you any advertising identifier.
• We do not sell, rent, or share data with third-party advertisers, data brokers, or marketing networks.
• We do not use yc_sid to track you across sites we do not own. The cookie is SameSite=Lax and is read only by yallachalet.com.
• We do not take any payment or card details. Bookings and payments happen directly between the renter and the chalet owner, off-platform — we are never in the money path.
• We do not collect biometric data.

4. Third parties

The directory runs on a small number of third-party services (subprocessors). Each is listed below with the reason we use it and what it receives.

• Clerk — authentication for owner accounts (email, Google, or Facebook sign-in). Receives your email address and, when you use social sign-in, the identity your provider returns. Subject to Clerk's own privacy policy.
• Resend — delivery of transactional owner emails (for example, the message confirming a claim was approved). Receives the recipient email address and the content of that email. Subject to Resend's own privacy policy.
• OpenAI — when an owner submits or edits a listing, the listing description text is sent to OpenAI to generate the other-language version so the listing reads correctly in both Arabic and English. Chalet names and addresses are converted locally and are never sent. No renter data is ever sent to OpenAI. Subject to OpenAI's own privacy policy.
• MapTiler — map tiles for the chalet location map. When you open a map, your browser requests tiles directly from MapTiler, so your IP address reaches MapTiler as part of loading the map. Subject to MapTiler's own privacy policy.
• Replit — hosts our Postgres database (chalet listings, owner records, aggregate event counts) and our image storage (chalet photos). Hosted by Replit Inc.
• Google Analytics — page-level analytics, loaded on every visit. Subject to Google's own privacy policy.

5. Your rights

Under applicable Jordanian and EU/UK data-protection law, you may:

• Access — request a copy of the data we hold about you.
• Correct — request correction of any inaccurate data.
• Delete — request deletion of your data (account closure, erasure of cookies on this device, removal of an owner record).
• Object — object to processing on legitimate-interest grounds.

To exercise any of these rights, contact us at the email below. We respond within 30 days.

6. Retention

• yc_sid cookie — 14 days from the last visit, then automatically deleted by your browser.
• yc_consent cookie — about one year, then automatically deleted by your browser.
• Server logs — kept for a limited period, then rotated out.
• Owner accounts and records — kept while the account is active; deleted on request or within a reasonable period after the account is closed.
• Aggregate event counts — indefinite (these are non-identifying counters keyed by chalet, not by user).

7. Contact

For privacy questions, data-subject requests, or complaints:

• Email: contact@yallachalet.com

If we cannot resolve your concern, you may also contact your local data-protection authority.

8. Changes

We update this policy when our data handling changes, when a new third party joins the stack, or when the law changes. Each version is dated at the top of the page (lastUpdated). Material changes will be announced via a banner on the homepage for at least 14 days before the new version takes effect.