Privacy Policy

For store customers' data, the merchant whose loyalty program you joined is responsible for your data. We process it on their behalf and only to run that program.

For merchant and staff account data, WHAOLOYALTY is the responsible party.

• Store customers: name, mobile number, gender, your consent to receive notifications, and how you signed up (QR code or link), plus your IP address and browser type at sign-up.
• Loyalty card: stamp or points balance, rewards, and transaction history (date, branch, the staff member who recorded it, and the amount entered when points are calculated).
• Digital wallet: the device identifier and push token that Apple Wallet or Google Wallet sends when you add the card, used only to update the card and deliver its notifications.
• Merchants and staff: store and business name, email, mobile number, website, username, password (stored as a one-way hash that cannot be read), branches, and last sign-in time.
• Merchant content: logos, images, card text and notification messages the merchant uploads.

The cashier app uses the camera only to scan the QR code on a card. It does not store or upload images.

• To issue your loyalty card, add it to your wallet and keep it up to date.
• To record stamps, points and rewards on each visit.
• To deliver wallet notifications sent by the merchant, when you have agreed to receive them.
• To give the merchant statistics about their own loyalty program.
• To secure the service and prevent abuse.
• To contact merchants about their accounts and subscriptions.

We do not sell your data, use it for advertising, or share it with other merchants.

• Only the merchant whose program you joined. No other merchant can see your data.
• Apple and Google, as needed to run and update the card in their wallets.
• Infrastructure providers that host the service, such as Amazon Web Services for image storage in the Bahrain region.
• Government authorities, where the law requires it.

All data is sent over an encrypted connection (HTTPS). Passwords are stored hashed, each merchant's data is kept separate from every other merchant's, and access is restricted by role (owner or cashier).

• Customer and card data: for as long as the card is active, or until the customer or the merchant asks for it to be deleted.
• Merchant and staff data: deleted within 90 days of the account being closed, unless the law requires us to keep it longer.

Under the Saudi Personal Data Protection Law, you have the right to:

• Know what data we collect about you and why.
• Access your data and get a copy of it.
• Correct your data if it is inaccurate.
• Ask for your data to be deleted.
• Withdraw your consent to notifications at any time, from the card's settings in your wallet or by removing the card.

If you are a customer of a store, you can contact the store directly or contact us, and we will coordinate with the store to handle your request. We respond to requests within 30 days.

whaoloyalty.com does not use tracking cookies, analytics or advertising tools. Our servers may log technical data such as IP addresses for security purposes only.

We may update this policy from time to time. Any update is published on this page with a new "Last updated" date, and we notify merchants of material changes.