Privacy notice

This notice explains what personal data JokerPrice collects when you use jokerprice.com, the JokerPrice app, the API and the MCP server, why we use it, who processes it for us and the rights you have. We handle personal data under Saudi Arabia’s Personal Data Protection Law (PDPL) and its implementing regulations.

Who is responsible

JokerPrice is responsible for the personal data described in this notice. For any privacy question or request, including to use the rights described below, write to us through the contact form and choose “Privacy and data requests”.

What we collect

We collect only what we need to run your account and the service:

• Account details. Your email address, the name you give, a random account ID, when you signed up, whether you have verified your email address, and your chosen language.
• Password. Never stored in readable form. We keep a random salt and a PBKDF2-SHA-256 hash, so we cannot see or recover your password.
• Sign-in sessions. A random session token in a cookie. We store only a SHA-256 hash of it, your account ID and its expiry.
• Your workspace. The properties, map locations, pricing rules, comp sets, calendars, rate plans and refresh history you save.
• Linked calendars. If you link a property’s calendar export (iCal): the link, the nights it marks as unavailable, and each event’s short title as the calendar gives it. Some exports include a guest’s name in the title.
• Hostaway connection. Only if you connect Hostaway: your Hostaway account ID; the access token Hostaway issues, stored encrypted, with when you connected and when the token expires; the Hostaway listing chosen for each property (its ID, name and currency); and, for each property, the last send: when it ran, whether it worked, how many nights and which dates it covered, and an error code if it failed. The API key you paste is used once to obtain the token and is never stored.
• Email preferences. Whether you have turned on the weekly pricing digest, and when it was last sent.
• API keys. Each key’s name, a short prefix, a SHA-256 hash of the key, when it was created, last used or revoked, and request counts for rate limits. The full key is shown to you once and never stored.
• Billing. If you take a paid plan: the plan, billing period, status and renewal date, Polar’s customer and subscription IDs, and a log of Polar’s billing notifications. A notification we cannot match to an account is kept with the customer’s email address until it is resolved. Payment card details stay with Polar.
• Messages you send us. Through the contact form: your name, email address, topic and message, plus your account ID and email address if you are signed in.
• Newsletter. If you subscribe: your email address and when you subscribed. No issue has been sent yet.
• Security records. To slow down password guessing and form abuse, we count recent attempts under a hash of your email address or IP address.
• Technical data. As with any website, your browser sends your IP address and basic device details with each request. Cloudflare uses them to deliver and protect the site and works out your country, which we use to show examples from your market. We do not store that country with your account.

We do not ask for or store your Airbnb, Gathern or Agoda password, your payment card details or any government ID, and we do not keep your Hostaway API key.

Public listing data

To build market reports and recommendations, we collect public information about listings on Airbnb, Gathern and Agoda: listing IDs and links, titles, city and approximate location, property type, bedrooms, ratings, links to listing photos, asking prices and day-by-day availability. This describes properties, not people: we do not collect host names, host contact details or guest details. If you believe a listing we show concerns you personally, contact us and we will review it.

Why we use it, and on what basis

The PDPL requires a legal basis for each use of personal data. Ours are:

• Providing the service you signed up for, as our agreement with you requires: creating and securing your account, saving your workspace, producing recommendations, sending the rates you approve to Hostaway if you connect it, sending the emails your account needs (email verification and password reset), applying your plan and handling billing.
• Keeping JokerPrice secure and working, in our legitimate interest: sign-in protection, rate limits, preventing abuse and diagnosing faults.
• Understanding how the site is used, in our legitimate interest, through Cloudflare Web Analytics, which counts visits without cookies and without identifying individuals.
• Your consent, for the weekly pricing digest and the newsletter, which you choose to receive and can stop at any time.
• Your request, when you write to us and we answer.
• Legal obligations, such as responding to lawful requests from authorities.

We do not sell personal data, use it for advertising or share it with advertisers. Pricing recommendations are about properties, not people, and we make no decisions about you based solely on automated processing.

Who processes data for us

We use the following service providers, and each receives only what it needs for its task:

• Cloudflare hosts the site and the app on Cloudflare Workers, delivers and protects every request, runs Cloudflare Web Analytics and keeps short-term request logs. It also holds a fallback copy of our database in Cloudflare D1.
• Our database server, a virtual private server rented from LightNode in Frankfurt, Germany, stores your account and workspace in PostgreSQL. It has no public database port and is reached only through Cloudflare’s private tunnel.
• Rowsafe makes continuous, encrypted backups of that database.
• Amazon Web Services sends our email through Amazon SES in its US East (N. Virginia) region, us-east-1, from no-reply@jokerprice.com: email verification, password resets, the weekly pricing digest, and contact-form messages delivered to our own mailbox.
• Zoho Mail hosts the jokerprice.com mailbox where we receive and answer email, in Zoho’s Saudi Arabian data centre.
• Polar (polar.sh) sells and bills paid plans as merchant of record. It receives your email address, account ID and the plan you choose, and collects your payment details itself under its own privacy policy.
• OpenFreeMap and the OpenStreetMap Foundation serve map tiles. Your browser loads them directly when you view a map, so they receive your IP address and the area you view. When you search for an address, our server sends the text you typed to the OpenStreetMap Foundation’s Nominatim service, without your IP address or account details.
• Google Maps Platform (Places API): when the app shows nearby hotels and attractions, our server asks Google about the map area in view. No personal data is sent.
• Hostaway, only if you connect your Hostaway account. To connect, our server sends Hostaway your account ID and the API key you paste, and receives an access token. To let you choose a listing, it fetches your Hostaway listings and shows each one’s name, city and currency. When you approve a send, it sends the Hostaway listing ID with the dates and nightly prices of the open nights you reviewed. When you disconnect, it asks Hostaway to revoke the token. These requests go directly from our server to Hostaway’s API (api.hostaway.com). Hostaway holds your listings under your own agreement with Hostaway, and passes the rates on to Airbnb and your other channels.
• Listing platforms. Listing photos load directly from the platforms’ own image servers, such as Airbnb’s, which receive your IP address. Links to listings open the platforms’ own sites.

Requests that collect public listings may pass through a proxy provider; they never contain your data. We may also disclose personal data where the law requires it.

Transfers outside Saudi Arabia

Some of this processing takes place outside the Kingdom. Your account and workspace are stored in Germany, our email is sent from the United States, and Cloudflare, Polar, the map services and, if you connect it, Hostaway operate internationally. Our mailbox is held in Saudi Arabia. We transfer personal data abroad only as far as needed to provide the service you use, and only to the providers listed above.

How long we keep it

• Account, workspace, linked calendars, API keys and billing records: until you delete your account. Each workspace save keeps the current version and the previous three.
• Hostaway connection: until you disconnect it or delete your account. Disconnecting deletes the token, the account ID and the listing links, and asks Hostaway to revoke the token. Deleting your account deletes them too, and first asks Hostaway to revoke the token. Rates already sent stay in Hostaway.
• Sessions: 14 days, or until you sign out or change your password.
• Email links: password-reset links expire after one hour and verification links after three days.
• Security counters: about a day.
• Newsletter address: until you ask us to remove it.
• Messages you send us: in our mailbox for as long as we need them to answer you and follow up.
• Address searches: results are cached for 30 days, with no record of who searched.
• Backups: deleted data can remain in encrypted database backups until those backups expire.
• Fallback copy: the copy in Cloudflare D1 dates from 28 October 2026, when we moved to our current database server, and will be deleted once the move is complete.
• Request logs: kept by Cloudflare for a short period.

Polar keeps its own payment records as merchant of record, for as long as tax and accounting law requires.

Your rights

Under the PDPL you have the right to:

• Be informed about how your personal data is used, as this notice does.
• Access your data and get a copy. In account settings, “Download my data” gives you everything stored for your account in one file.
• Have it corrected. Ask us through the contact form to correct your name or email address.
• Have it deleted. “Delete account” in account settings permanently deletes your account and its data straight away, apart from copies in backups until they expire. You can also ask us to remove your newsletter address.
• Withdraw your consent at any time: turn off the weekly digest in account settings or use the one-click unsubscribe link in any digest, or ask us to remove you from the newsletter.
• Complain. If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the PDPL.

To use a right that account settings do not cover, write to us through the contact form. We answer within 30 days, and may ask you to confirm the request from the email address on your account.

Cookies and browser storage

JokerPrice sets two cookies, both needed for the site to work:

• __Host-rimal_session keeps you signed in. It is set when you sign in, cannot be read by scripts on the page, and expires after 14 days or when you sign out.
• jp_lang remembers the language you chose, for up to a year. It is set when you open an Arabic page or switch language.

We use no advertising or tracking cookies, and Cloudflare Web Analytics sets none. Cloudflare may set its own security cookie if it needs to check a request for automated traffic.

The site also keeps some data in your browser’s local storage, which is not sent to us: your light or dark theme, how you left the sidebar, your onboarding progress, a backup copy of your workspace so unsaved changes survive a reload, and market snapshots you save in the app. Clearing this site’s data in your browser removes it.

How we protect it

• The site is served only over HTTPS.
• Passwords are stored as salted PBKDF2-SHA-256 hashes; session tokens, API keys and email links are stored only as SHA-256 hashes.
• The database has no public port and is reached only through Cloudflare’s private tunnel.
• Your workspace is scoped to your account, and every save is checked against the signed-in account.
• Hostaway access tokens are encrypted with AES-GCM under a key kept as a server secret, and bound to your account, so a copied token cannot be decrypted under another account. The Hostaway API key you paste is never stored.

If a personal data breach puts you at risk, we will tell you and the authorities as the PDPL requires.

Children

JokerPrice is a service for adults running a rental business. It is not meant for children, and we do not knowingly collect children’s personal data.

Changes to this notice

We update this notice when the way we handle personal data changes, and the date at the top shows the current version. We will tell account holders about significant changes by email or in the app before they apply.

Contact

Write to us through the contact form and choose “Privacy and data requests”. We reply by email.