Privacy Policy

Makhtoom is a digital loyalty-card platform, a product of Tech Corners Establishment, Commercial Registration No. 7050260822, Kingdom of Saudi Arabia. We are the controller of business-account data registered with us, and the processor of those businesses' end-customer data on their behalf (see section 5).

For any privacy question or request: info@techcorners.sa

Business account data (the account owner and their staff):

• Business name, type, card link, and any logo or brand assets the owner uploads
• Email address, phone number, and password (stored encrypted by Firebase; we never see it)
• Invoice and subscription history — payment-card details go directly to the Moyasar payment gateway and never touch our servers; we store only a card reference and the last four digits for display

End-customer data (collected on behalf of the business using Makhtoom):

• Name and mobile number
• Stamp, reward, and redemption history
• Birthday (day and month only, no year) if the customer chooses to provide it
• Wallet device identifiers (Apple Wallet push tokens / Google Wallet card state) to keep the card updated on the device

Technical and security data:

• Security logs on abusive requests (IP address hashed with SHA-256 — never stored raw — and a truncated browser signature), used solely to protect the platform
• The session cookie and local-storage data described in section 8

All platform data is stored inside the Kingdom of Saudi Arabia — in Google Cloud Firestore, Dammam region (me-central2). This covers business accounts, their customers' data, and the full stamp history.

Application servers (hosted on Fly.io) process requests transiently and do not persistently store your data outside Saudi Arabia.

• Contract performance: running the business account, loyalty cards, and billing — the core of the service you signed up for
• Consent: optional features such as birthday greetings, and appearing in the Makhtoom clients list (a separate consent, revocable at any time)
• Legitimate interest: protecting the platform from abuse and fraud (the security logs in section 2)

We never sell data, and we never share it with anyone for marketing purposes.

Data a business collects about its customers through Makhtoom (names, phone numbers, stamp history) belongs to that business — it is the controller, and Makhtoom processes the data on its behalf solely to operate the loyalty program. We never use one business's customer data for any other purpose, and no other business can access it.

If you are a customer of a business that uses Makhtoom and want to access or delete your data, the fastest route is contacting the business itself; you may also write to us directly and we will assist in coordination with them.

• Account data and customer data are kept for as long as the account exists
• On an account-deletion request, the business's data and its customers' data are deleted from the database, except billing and financial-audit records we are legally required to keep
• An end customer may request deletion of their card and data at any time (see section 9)

We use only the following processors, each handling the minimum needed for its function:

• Google — the Firestore database (Dammam), Firebase Authentication, Google Wallet passes, and the reCAPTCHA anti-bot service (subject to Google's Privacy Policy and Terms of Service)
• Apple — Apple Wallet passes and their push notifications (APNs)
• Moyasar — payment processing; your card details go to Moyasar directly and never touch our servers
• Fly.io — application-server hosting

We use no tracking cookies and no advertising analytics. What we do use:

• Session cookie (business owners and staff): proves your identity after sign-in. It is httpOnly — no script can read it — and expires automatically unless renewed by your visits
• A companion cookie holding only the session issue time — no personal data — so the browser knows when to renew
• Customer identity in local storage: a customer's card lives in their browser via a signed identifier in localStorage — no account, no password. Clearing browser data removes the card from that device; it can be restored through the business

Under the Saudi Personal Data Protection Law (PDPL), you have the right to:

• Know what data we hold about you and obtain a copy of it
• Correct inaccurate data
• Request deletion of your data (subject to what the law requires us to keep)
• Withdraw consent for any consent-based processing, at any time, without affecting prior processing

To exercise any of these rights, email info@techcorners.sa; we respond within a reasonable period not exceeding thirty days.

For any material change we will update the "last updated" date above and notify account holders via the dashboard or email. Continuing to use the service after a change takes effect means you have reviewed it.

Tech Corners Establishment — Commercial Registration 7050260822 — info@techcorners.sa