The small print
Privacy policy
What we collect when you plan, book or list experiences on Mshwar, why we use it, who we share it with, and the controls you have.
Version 2026-09-16 · In effect from
Who we are
Mshwar is operated by Mshwar, Tripoli, Lebanon (“Mshwar”, “we”). We decide how the personal data described here is used and we are responsible for it.
This policy follows Lebanese Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data. You can reach us about privacy through our Contact page.
What we collect
- Account details: your name, email address, preferred language and a one-way hash of your password. We never store your password itself.
- Travel preferences you save, such as interests, pace, budget and group size.
- Trip plans, including the requests you type into the AI planner and the itineraries it produces.
- Bookings: the experience, date, party size, price, cancellation terms and messages to the business.
- Payments: the amount, currency, status and the payment provider's reference. Card details go directly to the payment provider; we never receive or store full card numbers.
- Reviews, reports and group-trip suggestions or votes you submit.
- For business accounts: the organisation's details, staff roles and the verification documents you upload.
- Location, only when you choose to share it or pin a starting point for a plan.
- Technical data needed to run and protect the service: IP address, browser type, request identifiers and security logs.
How and why we use it
- To run your account, build plans, take bookings and process payments and refunds. We need this data to provide the service you asked for.
- To keep Mshwar safe: preventing fraud and abuse, enforcing rate limits, investigating incidents and keeping an audit trail of important actions.
- To meet legal duties, such as keeping accounting records and answering lawful requests from Lebanese authorities.
- To personalise plans and suggestions with your saved preferences and activity. We do this only if you switch personalisation on, and you can switch it off at any time.
- To send you travel ideas and offers. We do this only if you agree to marketing messages. Booking confirmations and other service messages are sent regardless, because they are part of the service.
The AI trip planner
When you ask the planner for a trip, your request and the constraints we extract from it are processed to build an itinerary. The text you type is not shared with businesses.
Feedback on plans is used to improve suggestions only while personalisation is on. Plans are suggestions: always check opening hours, travel conditions and the business's own terms before you go.
Processing outside Lebanon
Some of our providers store or process data outside Lebanon. We choose providers that protect personal data to a standard at least as high as this policy, and we limit what each one receives to what it needs.
How long we keep it
- Account and preference data: while your account is open. When you delete your account, your profile is anonymised.
- Bookings, payments and refunds: kept for as long as Lebanese commercial and tax law requires, even after account deletion. They are then linked only to an anonymised account.
- Reviews: kept after deletion, shown under an anonymised name.
- Security and audit records: kept for as long as they are needed to protect the service and to account for important actions. They cannot be edited.
- Verification documents: kept while the business account is active and for as long as needed to show how it was verified.
Your rights and controls
Under Law No. 81/2018 you can ask to access and correct your personal data, and you can object to its processing for legitimate reasons, including for marketing. You can also:
- download a copy of your data from Settings → Your data;
- reset personalisation, which clears saved preferences and recommendation signals;
- switch personalisation and marketing consent on or off, each on its own;
- delete your account, which anonymises your profile.
For anything else, contact us through our Contact page. We may need to confirm your identity first. If you are not satisfied with our answer, you can complain to the competent Lebanese authority, the Ministry of Economy and Trade.
How we protect it
We use encrypted connections, strong password hashing, role-based access, database-level isolation between businesses, short-lived signed links for private documents, and an append-only audit log. No system is perfectly secure; if a breach affects you, we will tell you and explain what we are doing about it.
Children
Mshwar accounts are for people aged 18 or over. Children can join experiences booked by an adult who is responsible for them.
Changes to this policy
Each version has a date. If we make an important change, we will tell you in the app and ask you to review it before you continue using your account.