Privacy Policy

This Privacy Policy explains how SaifX For Computer Systems & Communication Equipment Software Design ("the Company", "we", "us" or "our") collects, uses, discloses, and protects personal data in connection with YourLoop, a digital loyalty and stamp-card platform available at yourloop.app (the "Service").

This Policy applies to two categories of individuals: (a) Merchants — the businesses and their staff who register for and use the Service; and (b) End Customers — the individuals who enroll in a Merchant's loyalty programme through the Service. Our role and responsibilities differ between these two categories, as explained in Section 4 (Legal Basis & Our Role).

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

Merchant account data. When a Merchant registers for and uses the Service, we collect information such as:

• name of the account holder and staff users;
• email address;
• phone number;
• business details, such as business name, location, branding, and workspace configuration; and
• billing-related information processed through our payment provider (we do not store full payment-card numbers ourselves).

End-Customer data. On behalf of Merchants, the Service collects and stores personal data about End Customers who enroll in a Merchant's loyalty programme, which may include:

• name;
• email address;
• phone number;
• date of birth or birthday; and
• stamp, reward, and enrollment activity (for example, stamps earned, rewards claimed, and the dates of these events).

Technical and usage data. We may also collect limited technical information automatically when you use the Service, such as device and browser information, log data, and information stored locally on your device (see Section 10 — Cookies & Local Storage).

We use personal data for the following purposes:

• to provide, operate, and maintain the Service, including creating and managing accounts and workspaces;
• to enable Merchants to run their loyalty programmes, enroll End Customers, and record stamp and reward activity;
• to issue and update Apple Wallet and Google Wallet passes that reflect loyalty progress;
• to process subscriptions, billing, and payments through our payment provider;
• to communicate with Merchants about their accounts, including service, security, and transactional messages;
• to provide customer support and respond to enquiries;
• to monitor, secure, and improve the Service, including detecting and preventing fraud and abuse; and
• to comply with legal obligations under applicable law.

We do not sell personal data. We process End-Customer data only as necessary to provide the Service to Merchants and in accordance with the Merchant's instructions.

Our role under applicable data-protection law depends on the category of data:

• Merchant account data — the Company acts as the data controller. We determine the purposes and means of processing Merchant account data, and we are responsible for it under this Privacy Policy.
• End-Customer data — the Company acts as the data processor. We process End-Customer data on behalf of, and in accordance with the instructions of, the relevant Merchant, who acts as the data controller for that data. The Merchant is responsible for establishing a lawful basis for collecting and processing End-Customer data, for providing any required notices, and for obtaining any required consents.

We process personal data on lawful bases that may include: the performance of a contract (providing the Service); our legitimate interests in operating and securing the Service; compliance with legal obligations; and, where applicable, consent.

We use trusted third-party service providers to help us deliver the Service. These providers process personal data on our behalf, or on behalf of Merchants, only to the extent necessary to perform their services:

• Stripe — payment and subscription processing;
• Supabase — hosting, database, authentication, and storage infrastructure;
• Apple Wallet — issuance and updating of Apple wallet passes;
• Google Wallet — issuance and updating of Google wallet passes;
• Google Maps — location and mapping features; and
• Zoho — email and communications delivery.

Each provider is subject to its own privacy and security terms. We take reasonable steps to ensure that our providers offer an appropriate level of protection for personal data.

We retain personal data for as long as necessary to provide the Service and to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Merchant account data is retained for the duration of the account relationship and for a reasonable period thereafter to comply with legal, accounting, and reporting obligations. End-Customer data is retained on behalf of the relevant Merchant for as long as the Merchant maintains its account and loyalty programme, or until the Merchant instructs us to delete it, subject to any legal retention requirements. Following termination of an account, we may delete or anonymise personal data in accordance with our standard practices and applicable law.

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures include access controls, authentication, encryption in transit, and multi-tenant isolation designed to keep each business's data separated from others.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for the security of the devices you use to access the Service.

Subject to applicable law, individuals have rights in relation to their personal data, including the right to:

• access the personal data we hold about them;
• correct inaccurate or incomplete personal data;
• request deletion of their personal data;
• object to or restrict certain processing; and
• withdraw consent where processing is based on consent.

If you are a Merchant, you may exercise these rights in relation to your account data by contacting us at admin@yourloop.app, or by using the tools available within the Service.

If you are an End Customer, the Merchant whose loyalty programme you enrolled in is the controller of your data. You should direct your request to that Merchant. Where we receive a request from an End Customer, we will refer it to, or act on the instructions of, the relevant Merchant.

We process personal data in a manner consistent with the applicable data-protection laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and its implementing regulations, as applicable. Where the PDPL applies, we aim to uphold its principles, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and security.

The Service uses cookies and similar technologies, including browser local storage, to operate correctly. For example, we use local storage to remember your language preference and your active business selection, and to maintain your authenticated session.

These technologies are primarily necessary for the functioning of the Service. You can control or clear cookies and local storage through your browser settings; however, disabling them may affect the availability or functionality of parts of the Service.

Our third-party processors may store or process personal data in locations outside the United Arab Emirates. Where personal data is transferred outside the UAE, we take steps intended to ensure that it receives an adequate level of protection consistent with applicable law, including through the safeguards offered by our service providers. By using the Service, you acknowledge that your personal data may be processed in such locations.

If you have any questions about this Privacy Policy, or wish to exercise your rights, please contact us at:

If you are an End Customer, please remember that the Merchant whose loyalty programme you joined is the controller of your data, and requests relating to that data are best directed to that Merchant in the first instance.