Privacy Policy

What personal information Rahlio collects, why, who receives it, where it is stored and for how long — and how you can see, export, correct or delete it.

Last updated: 9 Oct 2026

Operator details

Trading name: Rahlio
Operated by: NasTech
Business number: 300869443
Contact: support@rahlio.com

Rahlio is a trading name of NasTech (no. 300869443)

1. About this policy

1.1. This Privacy Policy explains how the business that operates Rahlio — the website www.rahlio.com and the Rahlio apps — collects and uses personal information ("we"). That business is the controller responsible for your information and for the databases in which it is kept; its name, registration and address are given under "Operator details" at the top of this document, and privacy enquiries can be sent to privacy@rahlio.com.

1.2. This policy is written to meet the Privacy Protection Law, 5741-1981, as amended (including Amendment 13), and the regulations made under it. Where the EU or UK General Data Protection Regulation applies to you, you also have the rights described in the section on those laws.

1.3. You are under no legal obligation to give us personal information. Without the information marked as required, however, we cannot provide the related service — a hotel cannot be booked without the guests’ names, and a flight cannot be booked without passport details.

2. What we collect

2.1. We collect only what the Service needs, by purpose:

Searches and trip planning: destination, dates, number of travellers and ages of children, budget, preferences, and the free-text requests you write to the planning assistant.
Account and sign-in: mobile number (verified by a one-time code), email address, display name, language, currency and time zone; and, if you sign in with Google or Apple, the identifier, name and email address they share with us.
Bookings: the name, email and phone of the person booking; for each guest or passenger, name, date of birth and, where required, gender, nationality, passport number and expiry; special requests and arrival time; and the Booking, its price, status and payment references. We never receive or store card numbers.
What you choose to keep in your account, such as saved travellers, saved hotels and preferences.
Communications: messages you send us by email, through the contact form or on WhatsApp, including any file or location you choose to share, and our replies.
Device and usage: device type, operating system, app version, language, push-notification token, and pseudonymised records of how the Service is used — for example, which screens were opened.
Where you connect from: when the website or the app opens, our own server looks up the country of the internet address you connect from, in a database kept on our servers (IP geolocation by DB-IP, db-ip.com, under the Creative Commons Attribution 4.0 licence), to choose which languages we offer you and the currency we first show prices in. The address is not stored for this and is sent to no one; behind a VPN, the country is the VPN’s.
Security records: sign-in events, a hashed form of your IP address, the approximate country your connection comes from as reported by our hosting provider, and your browser or device type.
Invitations: if you join through a friend’s invitation, we record who invited you and how the invitation reached you, and the friend sees your first name, the initial of your surname, whether you have booked and whether your first stay is complete; to stop anyone inviting themselves, we compare the verified phone numbers, email addresses and devices of the two accounts. When a first stay of yours costing at least US$300 is complete, the friend who invited you is given a Rahlio Plus coupon, recorded against the invitation together with the booking that made it count; if that booking is cancelled or refunded, the coupon is withdrawn unless it has already been used. If you share your own invitation link, anyone who opens it sees your first name.

2.2. We do not access your device’s location, contacts or photos.

3. Sensitive information

3.1. Some information may reveal health or religious belief — for example, a need for step-free access, a food allergy, or a request for kosher or halal meals. We ask for it only where it helps to plan or fulfil your trip, keep it only with your consent, and pass it to a hotel only as part of a special request you make. Such preferences are stored encrypted, and are decrypted only to serve you, for an agent working on your trip at your request, and in your own data export. Text you write freely in a request is kept as you wrote it, so please do not include health details there unless they are needed.

3.2. You can withdraw your consent to our keeping such preferences at any time in the privacy settings; they are then erased from your profile and from all your trips. A special request already sent with a Booking stays with that Booking.

4. Why we use it

4.1. We use personal information for the following purposes, and for no purpose incompatible with them:

to provide the Service — search, planning, making and managing Bookings, confirmations, reminders and support (necessary to perform our contract with you);
to verify identity, secure accounts, prevent fraud and misuse, and enforce our terms (our legitimate interest, and our legal obligations);
to meet legal duties, including consumer protection, accounting and tax record-keeping, and lawful requests of the authorities (legal obligation);
to understand how the Service is used and improve it, using pseudonymised data (our legitimate interest);
to send advertising, only if you have given your prior express consent (consent).

4.2. We do not sell personal information, and we make no decision that has legal or similarly significant effects on you solely by automated means. Offers are ordered by software according to the criteria shown on screen.

5. Who receives your information

5.1. We share personal information only as needed for the purposes above:

Suppliers and Service Providers: Nuitee (LiteAPI) and, through it, the hotel or airline you book receive the details of the person booking and of the guests or passengers needed to make and manage the Booking. They use them as independent controllers, under their own privacy policies.
Payment: card details are entered directly on the Supplier’s payment page and processed by the Supplier and its payment processor, Stripe. We receive only the payment status and reference.
Hosting and infrastructure: Amazon Web Services — our servers and main database, in its Israel region (Tel Aviv) — and cloud file storage in Israel or the European Union.
Communication: Brevo (email), Telesign and, as a fallback, Twilio (SMS verification codes), Meta (WhatsApp), Google Firebase Cloud Messaging with Apple’s push notification service (app notifications), and Resend (messages sent through the website’s contact form).
Installs and links: AppsFlyer measures which link or campaign brought an install or an opening of the app, and resolves the links we send so that the app opens on the right screen — also after it is installed from such a link. It receives identifiers of the device that are not the advertising identifier, the app version, the device type and the link that was opened, never your name, contact details or Bookings, under its own privacy policy.
Places: when you ask for a hotel near a named place, Google Maps Platform receives the words naming that place — never your account details — to find where it is.
Artificial intelligence: Anthropic or OpenAI process the text of planning requests and assistant conversations to produce an answer. Our systems check each request before it is sent and block it if it contains an email address, phone number, card number or passport number.
Sign-in: Google and Apple, if you choose to sign in with them.
Agents: if you ask one of our agents, or a travel agency using our platform, for help, they see the details of your trip and Booking.
Authorities and advisers: where the law requires it or to protect rights and safety, and our professional advisers under a duty of confidentiality.
A successor: if the Service or the business operating it is transferred, the new operator, subject to this policy.

5.2. Providers acting on our behalf process information only on our instructions and are bound to protect it.

6. Storage and transfers outside Israel

6.1. Our servers and main database are in Israel, with Amazon Web Services; file storage is in Israel or the European Union; and some of our providers operate in the European Union, the United States and other countries. A Booking is, by its nature, passed to the Supplier and to the Service Provider in the country of travel.

6.2. We transfer information outside Israel in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001: to countries whose law provides an adequate level of protection, including the member states of the European Union; to recipients that undertake in writing to protect the information; or on another ground those Regulations allow.

7. How long we keep information

7.1. We keep personal information only for as long as it is needed for the purpose it was collected for, or as the law requires:

Using the Service without an account: the guest identifier, and trips not taken into an account, are deleted 30 days after they are created.
Account information: for as long as the account exists. After you ask to delete it, it is erased 30 days later, as described below.
Bookings and payment records: for as long as tax, accounting and consumer-protection law require, and as needed to deal with claims.
Raw responses received from Suppliers: up to 90 days.
Security logs: 90 days. Records of sign-in sessions: 30 days after the session ends.
A data export you request: 7 days, after which the file is removed.
Correspondence with our support team: as long as needed to handle the matter, and as a business record.
One-time codes and links: sign-in codes expire within 10 minutes, password links within 30 minutes and confirmation links within 30 days.
Records of phone verification, which contain your number: deleted 7 days after the code was sent.
Pseudonymised records of how the Service is used: 13 months from receipt, then deleted.

8. Your rights

8.1. You have the right to:

see the personal information we hold about you (section 13 of the Privacy Protection Law), in Hebrew, Arabic or English;
ask us to correct or delete information that is inaccurate, incomplete, unclear or out of date (section 14);
receive a copy of your information in a structured, machine-readable form — in the privacy settings you can request an export, which is prepared as a JSON file with a readable page beside it;
withdraw any consent you have given, including to sensitive preferences and to advertising, without affecting what was done before;
ask to be removed from any list used for advertising or direct mailing;
delete your account, as described below.

8.2. Most of these can be done directly in the app’s privacy settings. You can also write to privacy@rahlio.com. We will answer within the time the law sets, and may first ask you to confirm your identity. If you are not satisfied with our answer, you may complain to the Privacy Protection Authority at the Ministry of Justice. When you sign in on our website or in our app, we record that you accepted the Terms of Use and acknowledged this policy — which version, when, in which language, and a hashed form of your network address — and we record it again when either document changes.

9. Deleting your account

9.1. You can ask to delete your account in the app’s privacy settings or through the account-deletion page on our website. The account is erased 30 days after the request; until then you can cancel the request, and we email you the date.

9.2. On deletion we permanently erase your sign-in and contact details, your profile, saved travellers, the passport numbers stored with your orders, your device tokens and your trips that were never booked, and we end every session.

9.3. We keep, as the law requires or permits: records of paid orders, for accounting, tax and consumer-protection purposes and to deal with claims; the history of the consents you gave and withdrew, to show what was agreed; and correspondence with our support team, as a business record. These are kept only as long as necessary and are not used for any other purpose.

10. Security

10.1. We protect information with measures suited to its sensitivity, in line with the Privacy Protection (Data Security) Regulations, 5777-2017, including encryption in transit (TLS); field-level encryption of passport numbers and other secrets; hashing of passwords, codes and IP addresses; role-based access for staff; audit logs of administrative actions; and rate limits with automatic blocking of repeated failed sign-in attempts.

10.2. No system is completely secure. If a serious security incident affects your information, we will act as the law requires, including notifying the Privacy Protection Authority and, where required, you.

11. Children

11.1. The Service is intended for adults. A child’s details — name, age or date of birth and, for flights, passport details — are collected only when an adult provides them to search for or book a trip that includes the child, and are used only for that purpose.

12. Advertising messages

12.1. We send advertising by email, SMS or other electronic message only with your prior express consent, in accordance with section 30A of the Communications Law. Every advertising message is marked as such, identifies us, and includes a simple way to refuse further messages. You can also withdraw consent in the app’s notification settings or by writing to privacy@rahlio.com. Service messages about your Bookings are not advertising.

13. Cookies and similar technologies

13.1. The website sets cookies only to remember your language and currency and, if you choose to stay signed in, to keep you signed in; it also uses browser storage while a tab is open. We use no advertising cookies and no third-party analytics on the website; in the app, AppsFlyer measures installs and the links we send, without advertising identifiers (see “Who receives your information”). The details are in the Cookie Policy.

15. Changes to this policy

15.1. We may update this policy. The date of the current version appears at the top of this document, and we will give notice of a material change through the Service or by email before it takes effect.

16. Contact

16.1. Privacy enquiries and requests: privacy@rahlio.com. Everything else: support@rahlio.com.