Service providers and their roles

Supabase — PostgreSQL, authentication, storage and related services for merchant, staff, customer and loyalty-operation records. The current project connection indicates eu-central-1; support, logs and backups may involve other regions under the provider's service.

Vercel — app hosting, server routes, edge delivery and operational security and performance logs. The primary runtime currently observed is fra1; that does not mean every edge, support or log operation remains in Germany.

Apple and Google — issuing and updating Wallet passes. We send fields needed for the pass, its signature and update process according to the configured design.

Resend — account and service email when enabled. It is not used to sell contact lists.

Nuqtaty first-party analytics — measurement of public website use within the platform backend. It contains page, pseudonymous session, IP, approximate location, referrer and UTM, viewport and interaction data. We do not load Google Analytics.

Contentsquare (formerly Hotjar) — optional heatmaps and session replay on the public Arabic/English homepages and selected web-dashboard pages after separate consent for each area. Dashboard text, numbers and media are masked; forms and identity areas are excluded. We do not send account identities. Login, registration, billing, admin, individual customer pages and native staff apps are excluded. Permission can be withdrawn through analytics settings.

The Frankfurt regions above are evidence for the current database connection and primary runtime only, not a promise about every backup, log, support operation or provider subcontractor. Before adding a provider, we review purpose, data minimisation, processing location, contract, safeguards and applicable Saudi transfer requirements.