Data Protection Notice
0.1 · September 7, 2026
Draft pending legal review. This text may change before launch.
1. Applicable law
The platform processes personal data under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, for people in the Kingdom of Saudi Arabia, the Personal Data Protection Law. Where the two differ, the stricter rule applies to the person concerned.
2. Your rights
Access: a copy of the personal data we hold about you. Correction: fixing inaccurate data. Deletion: removing your data where the law allows us to. Objection and restriction: asking us to stop or limit particular uses. Portability: receiving your data in a machine-readable form.
3. How to exercise them
Customers: open your card page and use "delete my data"; the wallet card is revoked and identifiers are removed within 30 days, while financial records are kept anonymised as the law requires. Creators and businesses: ask from your dashboard or through the published contact details; we answer within 30 days and may ask you to verify your identity first.
4. Residency and security
All personal data is stored and processed in the United Arab Emirates. Data is encrypted at rest and in transit. Identity documents and bank details are sealed with a key that application servers do not hold; every time an administrator opens one, the access is recorded.
5. Retention
Sign-in codes are deleted minutes after use. Sessions expire and can be revoked from the devices page. Membership and purchase records follow the business's programme and the financial retention period. Fraud signals are kept only for their review periods.
6. Processors
Apple and Google (wallet cards and push updates), the payment provider (business billing), the messaging provider (one-time codes), the cloud provider (hosting in the UAE) and banks (creator payouts). Each processor receives only what its task requires under a written agreement.
7. Contact
Requests and complaints about personal data can be sent through the contact details published on this site. You may also complain to the competent data protection authority in your country.