Legal
Privacy notice
Updated 12 October 2026
This notice is a plain language draft and still needs legal review. We keep this notice short because we keep little data.
Who we are
Hilalstay is operated by Mohamed Abdelhamid Abdalla Mohamed, of 241 Church Road, Old St Mellons, Cardiff CF3 6YX, United Kingdom, which is the controller of the personal data described here. The quickest way to reach us on anything about your data is hello@hilalstay.com.
What we collect
Searches include destinations, dates, guest ages, nationality, currency and filters. Bookings use the holder and guest details you enter. Optional accounts store your name, email, a password hash, verification status, saved stays and linked booking references. Support requests store the contact details, message and reference you submit. Do not include card details, passport scans or other sensitive documents in support messages.
Why we use it
We use your data to make and manage your booking, which includes taking payment through our booking partner and letting you look up, change or cancel a stay. We also use it to keep the site working and safe, to meet legal obligations, and to answer you when you write to us. We do not use it for advertising and we never sell it.
Who receives it
Your booking details go to Nuitee (LiteAPI), our booking partner, so the hotel can receive and manage your reservation. Our site is hosted by DigitalOcean, and our email runs through Microsoft. These providers process data only to deliver their part of the service. Some of them may process data outside the United Kingdom, in which case we rely on appropriate safeguards for the transfer. Card payments are handled by our booking partner's payment form and its payment processor: we never see or store your card details.
How long we keep it
Member sessions expire after 30 days and verification or reset codes after one hour. Saved items remain until you remove them or request account deletion. Optional planner data stays in your browser until you delete it or clear site data. Support and booking records need a documented retention schedule before launch. During this test, records are private test data and are not represented as automatically deleted.
Your rights
Under UK data protection law you can ask us for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, or ask for it to be moved elsewhere where the law provides for that. Write to hello@hilalstay.com and we will act as the law requires. You also have the right to complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we handle your data.
Cookies and security
We use essential sign-in cookies for member and staff sessions. Browser storage remembers selected preferences and a journey plan only when you choose to save it. Checkout uses session storage to recover details after refresh. Our booking partner may use its own necessary payment cookies. Verification and booking messages are stored in a private queue; delivery is not confirmed until the email service records its result. See the cookies page for details.
Contact
Questions about this notice or your data go to hello@hilalstay.com, or by post to Mohamed Abdelhamid Abdalla Mohamed, 241 Church Road, Old St Mellons, Cardiff CF3 6YX, United Kingdom.