How Nuqtaty collects, uses and deletes data

The platform provider is maksab alwala aldhaki Company For Media Services, a Limited liability company (one person), Unified National Number 7055014174. Our address is 7234 Aswan Street, Al Wadi District, secondary number 3003, postal code 22518, Jeddah, Kingdom of Saudi Arabia.

Nuqtaty is the controllerfor merchant and staff account data, platform security, support, billing and Nuqtaty website analytics. The merchant named on a loyalty pass is normally the controller for its customers, programme rules and campaigns; Nuqtaty processes that data on the merchant's behalf. Nuqtaty may control a limited subset independently where security or a legal obligation requires it.

Merchant and staff accounts

• Name, email, phone number and business information.
• Authentication and session data, role, permissions and account status.
• Programme, design, branch, message and loyalty-operation settings and records.
• Support communications and subscription or invoice references; support does not ask for a full payment-card number.
• Security and technical data such as IP address, device and browser type and sign-in time.

Loyalty customers

• Name and phone number, plus optional fields displayed by the merchant such as email, birthday, gender, company or branch.
• Custom-field answers, referral identifier, message preferences and when those preferences changed.
• Stamps, points, balance, rewards, visits, redemptions and corrections linked to the pass.
• Apple Wallet and Google Wallet identifiers, update tokens and installation state.
• IP address, browser and device information and network-derived approximate location such as country, region and city, used for security, abuse prevention and source attribution.

iOS and Android apps and scanner

• Account, session, business and permission identifiers needed to display authorised data.
• For a scan: the customer identifier in the pass code, operation type and an optional invoice amount entered by staff.
• The camera frame is analysed on-device to extract the code; we do not store or send the camera frame to the server for that purpose.
• The current staff app has no advertising or cross-app tracking SDK and does not request precise GPS location or contacts.

Public website analytics

We measure public Nuqtaty pages with first-party analytics hosted as part of the platform; we do not load Google Analytics. Records may include the page, pseudonymous session ID, IP address, country, region, city and provider-supplied approximate coordinates, timezone, user agent, referrer and UTM values, viewport, clicks, scroll depth and visit duration. Approximate coordinates are not the phone's GPS location.

Optional Contentsquare (formerly Hotjar) heatmaps and session replay run on our public Arabic/English homepages and selected web-dashboard pages after you select “Allow recordings”. Website and dashboard permission are separate choices. The dashboard uses full masking of text, numbers and media; form entries and account identity areas are excluded. Only static navigation labels are explicitly shown there. We do not send account identities or user attributes to Contentsquare. Login, registration, billing, administration, individual customer pages and native staff apps are excluded. You can decline or withdraw permission through “Analytics settings”; withdrawal reloads the page to stop the recorder. Choices are stored for up to 180 days.

• Service and contract: create accounts, run loyalty programmes, issue passes, update stamps or balance, redeem rewards and provide support.
• Legal obligations: preserve records required by law and respond to a binding request from a competent authority.
• Legitimate interests where permitted: secure the platform, prevent fraud, diagnose failures, measure website performance and improve the product after balancing the effect on individuals.
• Consent: optional marketing offers and any other purpose for which consent is required. Marketing consent is recorded separately and can be withdrawn from the pass page or through the merchant.

Showing or acknowledging a privacy notice does not replace consent when consent is legally required. Marketing consent is not a condition of receiving the basic loyalty pass.

• The merchant and its authorised staff: only customers of that merchant, subject to role and permission.
• Supabase: authentication, PostgreSQL database, storage and related services.
• Vercel: app hosting, server execution, edge delivery and operational logs.
• Apple: issuing, signing and updating Apple Wallet passes and delivering required APNs pass updates.
• Google: issuing and updating a Google Wallet pass when the customer chooses to add one.
• Resend: operational email when the feature is enabled.
• Authorities or advisers: where necessary for a legal duty, claim or protection of rights.

We do not sell personal data or let one merchant view another merchant's data. See the service-provider list.

The current Supabase database connection indicates eu-central-1, and the currently observed primary Vercel runtime is fra1; both are in Frankfurt. This does not mean that every backup, log, support operation or content-delivery service remains in Germany. Supabase, Vercel, Apple, Google, Resend and their providers may process data in other countries for the service used.

We limit transfers to the stated purpose and review location, contract, security and applicable Saudi transfer requirements before adding a new provider. We do not describe all data as stored in one country unless that has been verified for the relevant processing.

A Wallet pass may contain branch locations so the phone can suggest the pass nearby. Apple or Google evaluates this on the device under its own settings; Nuqtaty does not receive precise GPS location merely because the pass was suggested. Where available, the cardholder can disable nearby suggestions from the pass page or device settings.

A stamp, balance or reward-state update is service communication. Promotional marketing is separate and is not enabled automatically by a QR scan, pass installation or store visit.

• Account and loyalty data is kept while the account or programme is active, or while needed to provide the service or settle a pending operation.
• We do not promise one automatic 30-day or 90-day purge for every record. Timing depends on purpose, record type, legal duty and provider backup cycle.
• After a verified deletion request, live data that is no longer needed is deleted or de-identified, sessions and access are revoked, and provider-held data is handled under the relevant contract and cycle.
• Limited billing, tax, dispute, fraud-prevention or legally required records may be retained and restricted to that purpose.
• Backups are not returned to ordinary use after deletion and expire through the provider's backup cycle rather than being edited record by record.

A merchant user can start deletion in account settings in the iOS or Android app, or on the website deletion pageafter signing in. Staff deletion removes that person's access; a sole-owner request may cover the business and dependent data after the impact is shown and outstanding prepaid value or legal duties are resolved. Uninstalling the app or cancelling a subscription alone does not delete the account. See Account deletion.

A cardholder can download available data as JSON or delete it from the verified pass page. A very large history may require a support request for the remainder.

Depending on the circumstances and applicable law, rights include being informed, access, a clear copy, correction, destruction, withdrawal of consent without retroactive effect and complaint to the competent authority. We may verify identity and authority first. A request may be limited where law requires retention, in which case we explain why.

Contact info@nuqtaty.com. We respond within the applicable statutory period, ordinarily 30 days for requests governed by the PDPL Implementing Regulations, and notify you if a legally permitted extension is needed.

Measures include TLS, managed authentication that stores passwords in one-way form, access controls and permissions, database-level isolation where applicable, operational logging and incident review. No digital method provides absolute security, so controls are reviewed against risk.

For a confirmed incident, we contain and assess it and notify affected parties or authorities when required within the applicable legal period.

The platform serves businesses and general loyalty programmes and is not designed to collect sensitive children's data. Merchants must not ask a minor for data or market to a minor without a lawful basis and guardian authorisation where required. Contact us if you believe a minor's data was collected incorrectly so we can review it with the merchant.

Necessary cookies support authentication, language and the cardholder session. Website measurement uses a first-party session identifier for up to 30 days and a first-touch attribution cookie for up to 90 days. We do not load Google Analytics. You can restrict analytics cookies in the browser. Blocking necessary cookies may affect sign-in or pass recovery.

Privacy requests and complaints: info@nuqtaty.com. Material changes are published here with a new date, and may also be shown in-product when they materially change how data is used.

See also the Terms, Data Processing Addendum and authoritative Arabic policy.