1Stay reports and guest reviews
Check-in confirmation times, issue reports and support replies are stored on the server to follow up the reservation. They are visible to the reservation holder and authorised team members, and are not sent to public reviews.
A submitted review saves six ratings, optional reasons, review text and the first name at that time. Only after your explicit consent and team review may the text, ratings, first name and submission date appear on the listing. Detailed reasons and internal review notes are not public. Do not include your own or others' phone numbers, addresses or private information.
Unsubmitted review answers remain only in the page's memory while you are on that trip page. They are not sent to the server before submission. Contact support to request investigation or removal of information.
2About this document
This page explains what information AliJaa, including alijaa.com, host.alijaa.com and the AliJaa and AliJaa Host Android apps, retains about you, why, with whom it is shared, how long it is retained and your choices. It describes the system's actual processing.
Responsible business: AliJaa, proprietor Ali Jorfy. Address: Ground floor, No. 147, Shahid Piryayi (Abhari) Street, Shahid Abadchi (Sheikh Baha) Street, Kuy-e Enghelab, Ahvaz, Khuzestan. Phone support: +98 937 051 4658; landline: 02191097811 (9 am–6 pm Tehran time); email: support@alijaa.com.
3Information guests provide
A mobile number for sign-in; first and last names if provided; saved property IDs after sign-in; online request and reservation details, including dates, guest numbers, amounts and status; optional guest notes and team replies.
Where profile photos are enabled, adding one is optional. Your booking hosts can see it until one week after the stay ends. Support may remove inappropriate photos; you can remove your photo at any time.
Where booking chat is enabled, messages exchanged with the host are retained by AliJaa for investigating reports and can be viewed by support. Before payment, phone numbers and links are not displayed in messages.
For reservations arranged through support before version 1.3, information you sent, such as names, travel dates, guest numbers, payment receipts and, when needed, card or IBAN refund details, remains in support's messaging service.
Guests are no longer shown or asked to complete a national-ID field. Previously supplied IDs remain stored, are not shown to hosts and are not used in any process. Contact support to request deletion.
4Information hosts provide
A mobile number for sign-in; first and last names, a short introduction and profile image; legal name, national ID and ID-card image for identity checks; title deeds, a lease or power of attorney for ownership checks, and the owner's name and national ID if supplied when the host is not the owner.
Property details include type, capacity, amenities, rules, prices and discounts, photos, blocked calendar dates with private notes, and the exact address, building number, unit, postcode and map location.
The Current location button reads your device location to place a map pin only when you select it and your browser grants permission.
5Information recorded by the AliJaa team
When someone asks about a stay by phone or messaging service, even without an account, the team may record their name, mobile number, travel dates, guest numbers and conversation notes for follow-up.
For cancellations and refunds, the request time, receipt of card or IBAN details, decision and transfer reference are recorded.
6Information generated through use
For security, guest and host sign-in attempts are recorded with time and outcome. Mobile numbers and IP addresses in these records use keyed hashes rather than raw values. Verification-code requests retain the mobile number and hashed IP; text-message delivery records retain the number, message type and status.
Each guest session is recorded on the server with its IP address and browser details for session management. Host sessions retain a device name.
Servers keep technical request logs, including IP address, time, page URL, referring page and browser. Specified sensitive events, including booking events, host session issuance and revocation, identity decisions and staff document access, are recorded in audit logs.
7What stays on your device
Browser storage holds saved lists with notes and dates, recently viewed properties, any legacy messaging-request notes, and visit counts for installation prompts. The host dashboard stores recently searched locations.
Of those items, only saved property IDs are also sent to the server when you are signed in. Previously saved properties from the same browser are merged into your account after sign-in. List structure, notes, dates, recent views and messaging-request notes remain on your device; logging out does not delete them.
Sign-in uses an essential HttpOnly cookie, unreadable by scripts, on the website and a similar cookie on the host dashboard. The offline app stores public pages and files, not account information.
AliJaa's Android apps run inside the phone's browser and share its storage. They request no sensitive Android permissions and have no notifications. Uninstalling an app or logging out does not delete the account or saved lists. Clear browser data to remove local data; contact support to delete an account.
8Analytics and error reporting
alijaa.com uses Cloudflare Web Analytics without cookies. It collects page URLs, referring pages, browser and device type, country inferred from IP, and loading performance for aggregate statistics, not advertising profiles. Browsers may also send Cloudflare Network Error Logging reports containing page URLs, referrers and IP addresses.
AliJaa has no Google Analytics, social-network pixels or advertising cookies. The host dashboard does not run the analytics script, although its traffic also passes through Cloudflare.
Your browser may offer to read a text verification code automatically. This requires your approval.
9Why we use information
To carry out the purposes for which you supplied it: sign-in, reservation coordination and follow-up, refunds, host identity and ownership verification, support, service security, and improving the website using aggregate visit statistics.
Your information is not sold or supplied to advertisers.
10Who receives information
The booked property's host sees the guest's name, a partial mobile number and reservation details in the dashboard, but not the guest's national ID. Support may share the guest's name and mobile number with the host, and the host's exact address and contact details with the guest to coordinate the reservation.
After the required payment is received and the reservation confirmed, the online reservation holder sees the host account's name and mobile number and the property's saved exact address and location on the trip page. These details are not displayed publicly or in reservation lists. Access to check-in information closes when the reservation is cancelled or expires.
The SMS provider, Melipayamak, receives only the mobile number and sign-in code. The SMS-sending account is shared with AliJaa's related brands.
Cloudflare: requests, including IP addresses, pass through its network for delivery and security. It also holds analytics and error reports.
Hosting: AliJaa's application and primary database are hosted in the service operator's country. An encrypted backup is stored on a server in Germany.
Property-description rewriting: the description supplied by a host is sent to an AI service in another jurisdiction for rewriting.
Telegram, for internal team notifications: operational events such as reservation submission, payment or cancellation, content or document submission and host registration are sent to the team with dates, night counts, amounts, reservation or host IDs and dashboard links, without guest names or mobile numbers. The same content may reach staff browser-notification services.
Maps: tiles load from OpenStreetMap, which receives your IP address and the map area viewed.
Messaging and external links: earlier support conversations are processed in the relevant messaging service. Sharing links for WhatsApp, Telegram, Bale, Eitaa, Rubika and SMS, and navigation links for Google Maps, Neshan and Balad, send information only when you select them.
Payments: after the Zarinpal gateway is enabled, online payment takes place through it only after host approval. AliJaa and Zarinpal exchange the amount, booking code and transaction result. Card information is entered only on the gateway page and never reaches AliJaa. AliJaa never requests payment to a personal card or bank account.
Information is disclosed to competent authorities when lawfully required, within the limits set by law.
11Public information
Only approved property text and photos, the host's first name and joining year, and an approximate location around 150–350 metres from the actual point are public.
Exact addresses, building numbers, postcodes, precise map coordinates, national IDs, mobile numbers and documents are never public.
12Identity and ownership documents
Host identity and ownership document images are encrypted, stored separately from public files, have no public URL, and are used only for identity and ownership checks. Each staff view is logged.
Hidden metadata, such as photo location, is removed from uploaded files during processing.
13Retention
There is currently no automatic deletion schedule. Account and property data are retained while the account is active. Reservation, dispute and financial records are retained as needed for bookings, investigations, accounting and legal obligations. Financial records cannot be deleted where financial and tax law requires retention.
Earlier messaging-service conversations remain on support devices until deleted. Encrypted backups are created daily; only the latest fourteen are retained on the server. Deleted data may remain in older backups until those are replaced.
14Security
Connections to the website, dashboard and apps are encrypted. Host national IDs and documents are encrypted at rest, staff access is restricted, and specified sensitive events are logged.
No system is completely immune to risk. If a security incident puts your information at risk, we will notify you.
15Your choices
Guests can edit first and last names on the account page; hosts can edit profiles and properties in the dashboard. To access, correct or delete other information, such as reservations, stored national IDs, sign-in records or support conversations, contact support.
Deletion is processed manually within legal retention requirements; see Retention. Phone support: +98 937 051 4658; landline: 02191097811 (9 am–6 pm Tehran time); email: support@alijaa.com.
16Changes to this policy
When this policy changes, its version and date are updated and the previous version remains available below. Material changes, such as a new measurement tool or a new category of information, are announced before taking effect.
Previous version — 1.3 (effective: )
This archived text is no longer updated. It applies to reservations confirmed while it was effective and payments made before the next version but confirmed afterwards; see Payments awaiting confirmation in the applicable terms.
1. Stay reports and guest reviews
Check-in confirmation times, issue reports and support replies are stored on the server to follow up the reservation. They are visible to the reservation holder and authorised team members, and are not sent to public reviews.
A submitted review saves six ratings, optional reasons, review text and the first name at that time. Only after your explicit consent and team review may the text, ratings, first name and submission date appear on the listing. Detailed reasons and internal review notes are not public. Do not include your own or others' phone numbers, addresses or private information.
Unsubmitted review answers remain only in the page's memory while you are on that trip page. They are not sent to the server before submission. Contact support to request investigation or removal of information.
2. About this document
This page explains what information AliJaa, including alijaa.com, host.alijaa.com and the AliJaa and AliJaa Host Android apps, retains about you, why, with whom it is shared, how long it is retained and your choices. It describes the system's actual processing.
Responsible business: AliJaa, proprietor Ali Jorfy. Address: Ground floor, No. 147, Shahid Piryayi (Abhari) Street, Shahid Abadchi (Sheikh Baha) Street, Kuy-e Enghelab, Ahvaz, Khuzestan. Phone support: +98 937 051 4658; landline: 02191097811 (9 am–6 pm Tehran time); email: support@alijaa.com.
3. Information guests provide
A mobile number for sign-in; first and last names if provided; saved property IDs after sign-in; online request and reservation details, including dates, guest numbers, amounts and status; optional guest notes and team replies.
For reservations arranged through support before version 1.3, information you sent, such as names, travel dates, guest numbers, payment receipts and, when needed, card or IBAN refund details, remains in support's messaging service.
Guests are no longer shown or asked to complete a national-ID field. Previously supplied IDs remain stored, are not shown to hosts and are not used in any process. Contact support to request deletion.
4. Information hosts provide
A mobile number for sign-in; first and last names, a short introduction and profile image; legal name, national ID and ID-card image for identity checks; title deeds, a lease or power of attorney for ownership checks, and the owner's name and national ID if supplied when the host is not the owner.
Property details include type, capacity, amenities, rules, prices and discounts, photos, blocked calendar dates with private notes, and the exact address, building number, unit, postcode and map location.
The Current location button reads your device location to place a map pin only when you select it and your browser grants permission.
5. Information recorded by the AliJaa team
When someone asks about a stay by phone or messaging service, even without an account, the team may record their name, mobile number, travel dates, guest numbers and conversation notes for follow-up.
For cancellations and refunds, the request time, receipt of card or IBAN details, decision and transfer reference are recorded.
6. Information generated through use
For security, guest and host sign-in attempts are recorded with time and outcome. Mobile numbers and IP addresses in these records use keyed hashes rather than raw values. Verification-code requests retain the mobile number and hashed IP; text-message delivery records retain the number, message type and status.
Each guest session is recorded on the server with its IP address and browser details for session management. Host sessions retain a device name.
Servers keep technical request logs, including IP address, time, page URL, referring page and browser. Specified sensitive events, including booking events, host session issuance and revocation, identity decisions and staff document access, are recorded in audit logs.
7. What stays on your device
Browser storage holds saved lists with notes and dates, recently viewed properties, any legacy messaging-request notes, and visit counts for installation prompts. The host dashboard stores recently searched locations.
Of those items, only saved property IDs are also sent to the server when you are signed in. Previously saved properties from the same browser are merged into your account after sign-in. List structure, notes, dates, recent views and messaging-request notes remain on your device; logging out does not delete them.
Sign-in uses an essential HttpOnly cookie, unreadable by scripts, on the website and a similar cookie on the host dashboard. The offline app stores public pages and files, not account information.
AliJaa's Android apps run inside the phone's browser and share its storage. They request no sensitive Android permissions and have no notifications. Uninstalling an app or logging out does not delete the account or saved lists. Clear browser data to remove local data; contact support to delete an account.
8. Analytics and error reporting
alijaa.com uses Cloudflare Web Analytics without cookies. It collects page URLs, referring pages, browser and device type, country inferred from IP, and loading performance for aggregate statistics, not advertising profiles. Browsers may also send Cloudflare Network Error Logging reports containing page URLs, referrers and IP addresses.
AliJaa has no Google Analytics, social-network pixels or advertising cookies. The host dashboard does not run the analytics script, although its traffic also passes through Cloudflare.
Your browser may offer to read a text verification code automatically. This requires your approval.
9. Why we use information
To carry out the purposes for which you supplied it: sign-in, reservation coordination and follow-up, refunds, host identity and ownership verification, support, service security, and improving the website using aggregate visit statistics.
Your information is not sold or supplied to advertisers.
10. Who receives information
The booked property's host sees the guest's name, a partial mobile number and reservation details in the dashboard, but not the guest's national ID. Support may share the guest's name and mobile number with the host, and the host's exact address and contact details with the guest to coordinate the reservation.
After the required payment is received and the reservation confirmed, the online reservation holder sees the host account's name and mobile number and the property's saved exact address and location on the trip page. These details are not displayed publicly or in reservation lists. Access to check-in information closes when the reservation is cancelled or expires.
The SMS provider, Melipayamak, receives only the mobile number and sign-in code. The SMS-sending account is shared with AliJaa's related brands.
Cloudflare: requests, including IP addresses, pass through its network for delivery and security. It also holds analytics and error reports.
Hosting in this archived version: the application and main database were on Hetzner cloud servers in Germany, sharing infrastructure with AliJaa's related brands, with encrypted backups off-server.
Telegram, for internal team notifications: operational events such as reservation submission, payment or cancellation, content or document submission and host registration are sent to the team with dates, night counts, amounts, reservation or host IDs and dashboard links, without guest names or mobile numbers. The same content may reach staff browser-notification services.
Maps: tiles load from OpenStreetMap, which receives your IP address and the map area viewed.
Messaging and external links: earlier support conversations are processed in the relevant messaging service. Sharing links for WhatsApp, Telegram, Bale, Eitaa, Rubika and SMS, and navigation links for Google Maps, Neshan and Balad, send information only when you select them.
Payment uses the connected bank gateway after host approval. AliJaa never asks for transfers to personal accounts and never receives your card passwords.
Information is disclosed to competent authorities when lawfully required, within the limits set by law.
11. Public information
Only approved property text and photos, the host's first name and joining year, and an approximate location around 150–350 metres from the actual point are public.
Exact addresses, building numbers, postcodes, precise map coordinates, national IDs, mobile numbers and documents are never public.
12. Identity and ownership documents
Host identity and ownership document images are encrypted, stored separately from public files, have no public URL, and are used only for identity and ownership checks. Each staff view is logged.
Hidden metadata, such as photo location, is removed from uploaded files during processing.
13. Retention
There is currently no automatic deletion schedule. Account and property data are retained while the account is active. Reservation, dispute and financial records are retained as needed for bookings, investigations, accounting and legal obligations. Financial records cannot be deleted where financial and tax law requires retention.
Earlier messaging-service conversations remain on support devices until deleted. Encrypted backups are created daily; only the latest fourteen are retained on the server. Deleted data may remain in older backups until those are replaced.
14. Security
Connections to the website, dashboard and apps are encrypted. Host national IDs and documents are encrypted at rest, staff access is restricted, and specified sensitive events are logged.
No system is completely immune to risk. If a security incident puts your information at risk, we will notify you.
15. Your choices
Guests can edit first and last names on the account page; hosts can edit profiles and properties in the dashboard. To access, correct or delete other information, such as reservations, stored national IDs, sign-in records or support conversations, contact support.
Deletion is processed manually within legal retention requirements; see Retention. Phone support: +98 937 051 4658; landline: 02191097811 (9 am–6 pm Tehran time); email: support@alijaa.com.
16. Changes to this policy
When this policy changes, its version and date are updated and the previous version remains available below. Material changes, such as a new measurement tool or a new category of information, are announced before taking effect.
Previous version — 1.2 (effective: )
This archived text is no longer updated. It applies to reservations confirmed while it was effective and payments made before the next version but confirmed afterwards; see Payments awaiting confirmation in the applicable terms.
1. Stay reports and guest reviews
Check-in confirmation times, issue reports and support replies are stored on the server to follow up the reservation. They are visible to the reservation holder and authorised team members, and are not sent to public reviews.
A submitted review saves six ratings, optional reasons, review text and the first name at that time. Only after your explicit consent and team review may the text, ratings, first name and submission date appear on the listing. Detailed reasons and internal review notes are not public. Do not include your own or others' phone numbers, addresses or private information.
Unsubmitted review answers remain only in the page's memory while you are on that trip page. They are not sent to the server before submission. Contact support to request investigation or removal of information.
2. About this document
This page explains what information AliJaa, including alijaa.com, host.alijaa.com and the AliJaa and AliJaa Host Android apps, retains about you, why, with whom it is shared, how long it is retained and your choices. It describes the system's actual processing.
Responsible business: AliJaa, proprietor Ali Jorfy. Address: Ground floor, No. 147, Shahid Piryayi (Abhari) Street, Shahid Abadchi (Sheikh Baha) Street, Kuy-e Enghelab, Ahvaz, Khuzestan. Phone 02191097811 (9 am–6 pm Tehran time), WhatsApp 09370514658 (only through alijaa.com links), email support@alijaa.com.
3. Information guests provide
A mobile number for sign-in; first and last names if provided; saved property IDs after sign-in; online request and reservation details, including dates, guest numbers, amounts and status; optional guest notes and team replies.
For WhatsApp reservations, information you send, such as name, travel dates, guest numbers, payment receipt and refund card or IBAN details when needed, remains in support's WhatsApp.
Guests are no longer shown or asked to complete a national-ID field. Previously supplied IDs remain stored, are not shown to hosts and are not used in any process. Contact support to request deletion.
4. Information hosts provide
A mobile number for sign-in; first and last names, a short introduction and profile image; legal name, national ID and ID-card image for identity checks; title deeds, a lease or power of attorney for ownership checks, and the owner's name and national ID if supplied when the host is not the owner.
Property details include type, capacity, amenities, rules, prices and discounts, photos, blocked calendar dates with private notes, and the exact address, building number, unit, postcode and map location.
The Current location button reads your device location to place a map pin only when you select it and your browser grants permission.
5. Information recorded by the AliJaa team
When someone enquires by phone, WhatsApp or Instagram, even without an account, the team may record their name, mobile number, travel dates, guest numbers and conversation notes for follow-up.
For cancellations and refunds, the request time, receipt of card or IBAN details, decision and transfer reference are recorded.
6. Information generated through use
For security, guest and host sign-in attempts are recorded with time and outcome. Mobile numbers and IP addresses in these records use keyed hashes rather than raw values. Verification-code requests retain the mobile number and hashed IP; text-message delivery records retain the number, message type and status.
Each guest session is recorded on the server with its IP address and browser details for session management. Host sessions retain a device name.
Servers keep technical request logs, including IP address, time, page URL, referring page and browser. Specified sensitive events, including booking events, host session issuance and revocation, identity decisions and staff document access, are recorded in audit logs.
7. What stays on your device
Browser storage holds saved lists with notes and dates, recently viewed properties, notes of WhatsApp requests and visit counts for installation prompts. The host dashboard retains recent location searches.
Only saved property IDs are sent to the server while signed in. Existing browser saves merge into the account after sign-in. Lists, notes, dates, recent views and WhatsApp-request notes remain on the device and are not deleted by logout.
Sign-in uses an essential HttpOnly cookie, unreadable by scripts, on the website and a similar cookie on the host dashboard. The offline app stores public pages and files, not account information.
AliJaa's Android apps run inside the phone's browser and share its storage. They request no sensitive Android permissions and have no notifications. Uninstalling an app or logging out does not delete the account or saved lists. Clear browser data to remove local data; contact support to delete an account.
8. Analytics and error reporting
alijaa.com uses Cloudflare Web Analytics without cookies. It collects page URLs, referring pages, browser and device type, country inferred from IP, and loading performance for aggregate statistics, not advertising profiles. Browsers may also send Cloudflare Network Error Logging reports containing page URLs, referrers and IP addresses.
AliJaa has no Google Analytics, social-network pixels or advertising cookies. The host dashboard does not run the analytics script, although its traffic also passes through Cloudflare.
Your browser may offer to read a text verification code automatically. This requires your approval.
9. Why we use information
To carry out the purposes for which you supplied it: sign-in, reservation coordination and follow-up, refunds, host identity and ownership verification, support, service security, and improving the website using aggregate visit statistics.
Your information is not sold or supplied to advertisers.
10. Who receives information
The property's host sees guest name, partial mobile number and reservation details, not national ID. For WhatsApp coordination, support may share the guest's name and mobile number with the host, and the host's exact address and contact details with the guest.
After the required payment is received and the reservation confirmed, the online reservation holder sees the host account's name and mobile number and the property's saved exact address and location on the trip page. These details are not displayed publicly or in reservation lists. Access to check-in information closes when the reservation is cancelled or expires.
The SMS provider, Melipayamak, receives only the mobile number and sign-in code. The SMS-sending account is shared with AliJaa's related brands.
Cloudflare: requests, including IP addresses, pass through its network for delivery and security. It also holds analytics and error reports.
Hosting in this archived version: the application and main database were on Hetzner cloud servers in Germany, sharing infrastructure with AliJaa's related brands, with encrypted backups off-server.
Telegram, for internal team notifications: operational events such as reservation submission, payment or cancellation, content or document submission and host registration are sent to the team with dates, night counts, amounts, reservation or host IDs and dashboard links, without guest names or mobile numbers. The same content may reach staff browser-notification services.
Maps: tiles load from OpenStreetMap, which receives your IP address and the map area viewed.
WhatsApp and external links: support conversations are processed in WhatsApp. Sharing links for WhatsApp, Telegram, Bale, Eitaa, Rubika and SMS, and directions links for Google Maps, Neshan and Balad, send information only when selected.
During this period, payment is made through your bank to a card or account named Ali Jorfy. Your card passwords are never shared with AliJaa.
Information is disclosed to competent authorities when lawfully required, within the limits set by law.
11. Public information
Only approved property text and photos, the host's first name and joining year, and an approximate location around 150–350 metres from the actual point are public.
Exact addresses, building numbers, postcodes, precise map coordinates, national IDs, mobile numbers and documents are never public.
12. Identity and ownership documents
Host identity and ownership document images are encrypted, stored separately from public files, have no public URL, and are used only for identity and ownership checks. Each staff view is logged.
Hidden metadata, such as photo location, is removed from uploaded files during processing.
13. Retention
There is currently no automatic deletion schedule. Account and property data are retained while the account is active. Reservation, dispute and financial records are retained as needed for bookings, investigations, accounting and legal obligations. Financial records cannot be deleted where financial and tax law requires retention.
Support WhatsApp conversations remain on support devices until deleted. Encrypted backups are created daily with fourteen retained on the server. Deleted information may remain until older backups are replaced.
14. Security
Connections to the website, dashboard and apps are encrypted. Host national IDs and documents are encrypted at rest, staff access is restricted, and specified sensitive events are logged.
No system is completely immune to risk. If a security incident puts your information at risk, we will notify you.
15. Your choices
Guests can edit first and last names on the account page; hosts can edit profiles and properties in the dashboard. To access, correct or delete other information, such as reservations, stored national IDs, sign-in records or support conversations, contact support.
Deletion is processed manually within legal retention requirements; see Retention. Phone 02191097811 (9 am–6 pm Tehran time), WhatsApp 09370514658 (only through alijaa.com links), email support@alijaa.com.
16. Changes to this policy
When this policy changes, its version and date are updated and the previous version remains available below. Material changes, such as a new measurement tool or a new category of information, are announced before taking effect.
Previous version — 1.1 (effective: )
This archived text is no longer updated. It applies to reservations confirmed while it was effective and payments made before the next version but confirmed afterwards; see Payments awaiting confirmation in the applicable terms.
1. About this document
This page explains what information AliJaa, including alijaa.com, host.alijaa.com and the AliJaa and AliJaa Host Android apps, retains about you, why, with whom it is shared, how long it is retained and your choices. It describes the system's actual processing.
Responsible business: AliJaa, proprietor Ali Jorfy. Address: Ground floor, No. 147, Shahid Piryayi (Abhari) Street, Shahid Abadchi (Sheikh Baha) Street, Kuy-e Enghelab, Ahvaz, Khuzestan. Phone 02191097811 (9 am–6 pm Tehran time) · WhatsApp 09370514658 (only through alijaa.com links) · email support@alijaa.com.
2. Information guests provide
Mobile number for sign-in; optional first and last names; saved property IDs after sign-in; and earlier online reservation details, including dates, guest numbers, amounts and status.
For WhatsApp reservations, information you send, such as name, travel dates, guest numbers, payment receipt and refund card or IBAN details when needed, remains in support's WhatsApp.
Guests are no longer shown or asked to complete a national-ID field. Previously supplied IDs remain stored, are not shown to hosts and are not used in any process. Contact support to request deletion.
3. Information hosts provide
A mobile number for sign-in; first and last names, a short introduction and profile image; legal name, national ID and ID-card image for identity checks; title deeds, a lease or power of attorney for ownership checks, and the owner's name and national ID if supplied when the host is not the owner.
Property details include type, capacity, amenities, rules, prices and discounts, photos, blocked calendar dates with private notes, and the exact address, building number, unit, postcode and map location.
The Current location button reads your device location to place a map pin only when you select it and your browser grants permission.
4. Information recorded by the AliJaa team
When someone enquires by phone, WhatsApp or Instagram, even without an account, the team may record their name, mobile number, travel dates, guest numbers and conversation notes for follow-up.
For cancellations and refunds, the request time, receipt of card or IBAN details, decision and transfer reference are recorded.
5. Information generated through use
For security, guest and host sign-in attempts are recorded with time and outcome. Mobile numbers and IP addresses in these records use keyed hashes rather than raw values. Verification-code requests retain the mobile number and hashed IP; text-message delivery records retain the number, message type and status.
Each guest session is recorded on the server with its IP address and browser details for session management. Host sessions retain a device name.
Servers keep technical request logs, including IP address, time, page URL, referring page and browser. Specified sensitive events, including booking events, host session issuance and revocation, identity decisions and staff document access, are recorded in audit logs.
6. What stays on your device
Browser storage holds saved lists with notes and dates, recently viewed properties, notes of WhatsApp requests and visit counts for installation prompts. The host dashboard retains recent location searches.
Only saved property IDs are sent to the server while signed in. Existing browser saves merge into the account after sign-in. Lists, notes, dates, recent views and WhatsApp-request notes remain on the device and are not deleted by logout.
Sign-in uses an essential HttpOnly cookie, unreadable by scripts, on the website and a similar cookie on the host dashboard. The offline app stores public pages and files, not account information.
AliJaa's Android apps run inside the phone's browser and share its storage. They request no sensitive Android permissions and have no notifications. Uninstalling an app or logging out does not delete the account or saved lists. Clear browser data to remove local data; contact support to delete an account.
7. Analytics and error reporting
alijaa.com uses Cloudflare Web Analytics without cookies. It collects page URLs, referring pages, browser and device type, country inferred from IP, and loading performance for aggregate statistics, not advertising profiles. Browsers may also send Cloudflare Network Error Logging reports containing page URLs, referrers and IP addresses.
AliJaa has no Google Analytics, social-network pixels or advertising cookies. The host dashboard does not run the analytics script, although its traffic also passes through Cloudflare.
Your browser may offer to read a text verification code automatically. This requires your approval.
8. Why we use information
To carry out the purposes for which you supplied it: sign-in, reservation coordination and follow-up, refunds, host identity and ownership verification, support, service security, and improving the website using aggregate visit statistics.
Your information is not sold or supplied to advertisers.
9. Who receives information
The property's host sees guest name, partial mobile number and reservation details, not national ID. For WhatsApp coordination, support may share the guest's name and mobile number with the host, and the host's exact address and contact details with the guest.
The SMS provider, Melipayamak, receives only the mobile number and sign-in code. The SMS-sending account is shared with AliJaa's related brands.
Cloudflare: requests, including IP addresses, pass through its network for delivery and security. It also holds analytics and error reports.
Hosting in this archived version: the application and main database were on Hetzner cloud servers in Germany, sharing infrastructure with AliJaa's related brands, with encrypted backups off-server.
Telegram, for internal team notifications: operational events such as reservation submission, payment or cancellation, content or document submission and host registration are sent to the team with dates, night counts, amounts, reservation or host IDs and dashboard links, without guest names or mobile numbers. The same content may reach staff browser-notification services.
Maps: tiles load from OpenStreetMap, which receives your IP address and the map area viewed.
WhatsApp and external links: support conversations are processed in WhatsApp. Sharing links for WhatsApp, Telegram, Bale, Eitaa, Rubika and SMS, and directions links for Google Maps, Neshan and Balad, send information only when selected.
During this period, payment is made through your bank to a card or account named Ali Jorfy. Your card passwords are never shared with AliJaa.
Information is disclosed to competent authorities when lawfully required, within the limits set by law.
10. Public information
Only approved property text and photos, the host's first name and joining year, and an approximate location around 150–350 metres from the actual point are public.
Exact addresses, building numbers, postcodes, precise map coordinates, national IDs, mobile numbers and documents are never public.
11. Identity and ownership documents
Host identity and ownership document images are encrypted, stored separately from public files, have no public URL, and are used only for identity and ownership checks. Each staff view is logged.
Hidden metadata, such as photo location, is removed from uploaded files during processing.
12. Retention
There is currently no automatic deletion schedule. Account and property data are retained while the account is active. Reservation, dispute and financial records are retained as needed for bookings, investigations, accounting and legal obligations. Financial records cannot be deleted where financial and tax law requires retention.
Support WhatsApp conversations remain on support devices until deleted. Encrypted backups are created daily with fourteen retained on the server. Deleted information may remain until older backups are replaced.
13. Security
Connections to the website, dashboard and apps are encrypted. Host national IDs and documents are encrypted at rest, staff access is restricted, and specified sensitive events are logged.
No system is completely immune to risk. If a security incident puts your information at risk, we will notify you.
14. Your choices
Guests can edit first and last names on the account page; hosts can edit profiles and properties in the dashboard. To access, correct or delete other information, such as reservations, stored national IDs, sign-in records or support conversations, contact support.
Deletion is processed manually within legal retention requirements; see Retention. Phone 02191097811 (9 am–6 pm Tehran time) · WhatsApp 09370514658 (only through alijaa.com links) · email support@alijaa.com.
15. Changes to this policy
When this policy changes, its version and date are updated and the previous version remains available below. Material changes, such as a new measurement tool or a new category of information, are announced before taking effect.
Previous version — 1.0 (effective: )
This archived text is no longer updated. It applies to reservations confirmed while it was effective and payments made before the next version but confirmed afterwards; see Payments awaiting confirmation in the applicable terms.
1. About this document
This page explains the information AliJaa collects, why, who receives it and your choices. It describes the system's actual processing at this version's publication.
2. Information you provide
For travellers: at this version's publication, searching and viewing properties required no personal details. Information you included in a WhatsApp request, such as name, travel dates and guest numbers, was shared with us and the host.
For hosts: a mobile number for sign-in; first and last names, national ID and identification image for verification; ownership or letting-rights documents; and property details, photos and prices.
3. Information generated through use
For security, host sign-ins and failed attempts are recorded with time and IP address. Verification-message records are retained to prevent abuse.
Server requests are recorded in technical logs for troubleshooting and security, not for behavioural profiling.
4. What remains in your browser
In this archived version, My trips requests were stored in the browser's local storage and not sent to our server. They were unavailable on other devices or after clearing browser data.
You can delete this data from the relevant page or browser settings.
5. Cookies and measurement tools
At this version's publication, AliJaa used no advertising cookies or third-party tracking tools. Google Analytics, social pixels and similar tools were not installed.
The host dashboard uses an essential technical cookie to maintain sign-in. It contains no behavioural content; sign-in cannot work without it.
If measurement tools are added, this page will be updated before activation.
6. Why we use information
Information is used for the purposes for which it was supplied: booking coordination and follow-up, host identity and ownership verification, support and service security.
Your information is not sold or supplied to advertisers.
7. Who receives information
Only information needed to coordinate a reservation is shared with that property's host. The exact address is supplied to the guest after confirmation.
A local SMS provider receives only the mobile number and message text to deliver verification messages.
AliJaa sits behind Cloudflare's content delivery network, through which traffic passes. Its infrastructure and database are hosted on our own dedicated server.
Information is disclosed to competent authorities when lawfully required, within legal limits.
8. Host identity documents
Uploaded host identity and ownership documents are held privately, separately from public files, with no public URL, and used only for verification.
These documents never appear on public property pages.
9. Retention
Account and property information is retained while the account is active. Technical and security logs are retained for a limited period and then deleted.
Completed-reservation and financial records are retained for periods required by financial and tax law and cannot be deleted during that period.
10. Security
Connections are encrypted. Staff access to user information is restricted and logged; sensitive events are kept in audit records.
No system is completely immune to risk. If a security incident puts your information at risk, we will notify you.
11. Your choices
You may request access, correction or deletion of your information by contacting support on WhatsApp.
Deletion is subject to legal obligations, as explained under Retention. Contact number: 09370514658
12. Changes to this policy
Changes update the version and date above. Material changes, such as new measurement tools or information categories, are announced before taking effect.