Privacy Policy.

This policy explains how Fostay ("we", "us") handles personal data when you browse fostay.com or make a booking through it. We aim to collect the minimum needed to run a great booking service, and we handle it in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where applicable to you, the EU/UK GDPR.

Booking data: the details you enter at checkout — guest name(s), email address, phone number, stay dates, selected hotel and room, nationality where required by the accommodation provider.

Payment data: card and payment details are collected and processed by our booking partner Nuitee Travel (LiteAPI) and its payment processors. Fostay never receives or stores your full card details.

Technical data: standard web logs (IP address, browser, device type, pages viewed) and, if enabled, privacy-conscious analytics used in aggregate to understand how the site is used.

Communications: emails you send us, and records of booking-related support.

To operate bookings: your booking data is shared with Nuitee and the accommodation provider to create, manage and honour your reservation — this is necessary for performing the contract you request.

To support you: replying to enquiries and resolving booking issues, using our legitimate interest in operating a functioning service.

To improve the product: aggregate, non-identifying analytics about how pages perform.

Marketing: only if you explicitly opt in (for example, joining the early-access list). You can unsubscribe at any time via the link in any email.

Nuitee Travel (LiteAPI) — our booking and payment fulfilment partner — and, through it, the accommodation provider you book. Their processing of your data is governed by their own privacy policies.

Service providers that host and run our infrastructure (e.g. website hosting, email delivery), bound by data processing agreements.

Authorities, where disclosure is required by law.

We do not sell personal data.

Our partners and infrastructure may process data outside the UAE (for example in the EU or US). Where that happens, we rely on our providers' contractual safeguards for lawful international transfer.

Booking records are kept for as long as needed to service the booking and to meet legal, tax and dispute-resolution obligations, then deleted or anonymised. Technical logs are retained for a short operational window. Marketing lists are kept until you unsubscribe.

We use strictly necessary cookies/storage for the site to function (for example, holding your checkout selection between pages). If we introduce analytics or marketing cookies, we will surface controls to accept or decline them.

Subject to applicable law, you can request access to, correction of, or deletion of your personal data; object to or restrict certain processing; and withdraw consent where processing is based on it. Write to privacy@fostay.com and we will respond within a reasonable period. You may also lodge a complaint with your local data protection authority.

Traffic to the site is encrypted (HTTPS), access to booking data is limited to what operations require, and card data never touches our systems. No internet service can guarantee absolute security, but we design to minimise what there is to lose.

We may update this policy as the product evolves; the current version always lives at this address, with the date below.

Contact: privacy@fostay.com.

Last updated: July 2026.