Last updated 11 September 2026
This Privacy Policy explains what personal data Where2Hang (“we”, “us”, “our”) collects when you use the Where2Hang app and website (the “Service”), why we collect it, how we use and share it, and the choices and rights you have. We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the “PDPL”). By creating an account you confirm you have read it.
Beta. Where2Hang is currently in beta and under active development. This policy will be updated as the service and its features develop; the date above shows when it last changed.
1. Who we are
Where2Hang is a venue-discovery service for Abu Dhabi and the UAE, operated by its founding team in Abu Dhabi, who are the data controller for the personal data described here. For any privacy question, or to exercise your rights, contact us at admin@where2hang.com.
2. What we collect
We collect the following, most of which you give us directly:
- Account details — your email and password (passwords are stored securely by our authentication provider, never in plain text).
- Optional profile details — the age band, gender, relationship status, resident/visitor status and region you may choose to share to improve your recommendations. These are optional and you can skip them.
- Age confirmation — we ask your age band at signup to tailor content and to apply age-appropriate content controls (for example, alcohol-related venues).
- Activity in the app — the venues you view, save, check in to and review (including any rating, comment and crowd details you give), the searches, filters and pages you use, and similar interactions, so the Service works and improves.
- What you say to Wasta — the messages you type to our assistant, and its replies, are kept so the Service can carry on the conversation and so we can improve how it answers.
- Precise location — only if you allow it through your device permissions. While the app is open and location is allowed, we use your device’s position to show what’s near you, to place you on the map, and we record it with your check-ins and with the pages and searches you use. We do not collect location in the background or when the app is closed, and everything works without it.
- Device and session data — a random identifier we set on your device (a cookie, kept for up to 400 days) so we can tell one visitor from another and join what you did before signing up to your account, your browser or app version (the user-agent string), and basic session information needed to run the Service securely. No advertising identifiers.
- Notifications — if you turn on push notifications, the subscription your browser issues for them.
3. Why we use it (and our lawful basis)
- To provide and personalise the Service — recommendations, saved spots, plans and check-ins (performance of our agreement with you).
- To apply age-appropriate content controls (compliance and protection of minors).
- To understand how the Service is used and improve it, using aggregated and anonymised insights (our legitimate interest in running and improving the Service).
- To send you marketing about offers and events only if you opt in (your consent — you can withdraw it anytime).
- To keep the Service secure and meet legal obligations.
4. Marketing
We only send you marketing emails if you tick to opt in at signup or in settings. Every marketing email has an unsubscribe link, and you can turn it off at any time — you will still have full access to the Service.
5. How we share data
We do not sell your personal data. We share it only with:
- service providers who process it on our behalf, under agreements that limit their use of the data: Supabase (accounts and database), Vercel (hosting), Anthropic (the AI model that answers your Wasta messages receives the text of your conversation and the filters you have set, and nothing that identifies you), Google (Places data for venue details and the venue-name suggestion box, which sends what you type to Google), Resend (email), and CARTO and Cloudflare (map tiles and map libraries, which see your device’s network address when the map loads);
- venues and partners, but only in aggregated and anonymised form that does not identify you;
- authorities where we are legally required to.
6. International transfers
Our providers process data outside the UAE: our database and accounts are hosted in Australia (Supabase, Sydney), and our hosting, AI, email and mapping providers process data in the United States and the European Union. Where data is transferred abroad we rely on contractual protections with those providers to keep it to a standard consistent with the PDPL.
7. How long we keep it
We keep your personal data while your account is active and as long as needed for the purposes above, then delete or anonymise it. You can delete your account yourself at any time from Profile → Delete my account in the app, or at where2hang.ae/delete-account; if you can no longer sign in, email us from the address on the account and we delete it by hand within 30 days. When you do, your account, profile, saved items, check-ins, notification subscriptions and rewards are deleted, and your usage events, Wasta conversations and unmatched searches are separated from your account so they no longer identify you; we keep some of it only where the law requires. Usage events and Wasta conversations are otherwise kept for as long as we need them to improve the Service and are not automatically expired today. Aggregated, anonymised insights that no longer identify you may be retained.
8. Your rights
Under the PDPL you have the right to access your personal data, to have it corrected or deleted, to object to or restrict certain processing, to withdraw consent, and to data portability. To exercise any of these, contact us at admin@where2hang.com. You may also close your account at any time from within the app.
9. Security
We use appropriate technical and organisational measures to protect your data, including secure authentication, access controls and encryption in transit. No system is perfectly secure, but we work to protect your information and will act promptly if a problem arises.
10. Children
The Service is intended for adults, and the app stores list it accordingly. We ask your age band at signup: anyone who tells us they are under 18 is limited to age-appropriate content (for example, alcohol-serving venues are hidden) and is otherwise treated like any other member. The Service is not for children under 13; if you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy as the Service or the law develops. The “Last updated” date shows when it last changed, and we will bring significant changes to your attention in the app.
12. Contact
Questions about your privacy or this policy: admin@where2hang.com.