Privacy Policy · سياسة الخصوصية

1. Who we are and our role

Waya is a digital loyalty program service for small and medium businesses in Saudi Arabia, including coffee shops, salons, bakeries, and retail stores. Merchants use Waya to issue Apple Wallet and Google Wallet loyalty passes to their customers, track stamp- and points-based rewards, and manage their customer base. Waya does not operate a separate customer-facing app.

Waya is the data controller for merchant-account data. For the personal data of a merchant's customers, the merchant is the controller and Waya is the processor, acting on the merchant's instructions under our Data Processing Agreement. The contracting entity is [Waya legal entity / CR number — to be inserted]. You can contact us at support@trywaya.com.

2. Information we collect

From merchants (account holders)

• Email address, name, phone number, and business name provided at sign-up.
• Authentication identifiers when you sign in with Google or with Apple (the ID provided by the identity provider; we do not receive your password).
• Username and a password set in-app, where applicable.
• Loyalty program configuration, branding (logos, colors), and reward rules entered by you.
• Your acceptance of our legal terms (the version, date and time, IP address, and device/browser information), kept as a record of agreement.
• Device push-notification tokens for Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM), used to deliver reward and activity notifications to your merchant device.

From customers (end users enrolled in a merchant's program)

• Contact details that customers provide voluntarily during enrollment, typically a phone number or email address, used to issue and update a wallet pass.
• Stamp count, points balance, and visit history within the merchant's program.

3. Camera permission and QR code scanning

The Waya Merchant mobile app requests permission to use the device camera. This permission is used solely to scan QR codes that customers present in order to identify the customer's loyalty account and add stamps or points to it.

• The camera is activated only when the merchant taps the in-app scan button.
• Camera frames are decoded locally on the device. We do not store, upload, transmit, or persist any photos, video, or images captured by the camera.
• The only output of the scan that leaves the device is the decoded QR text identifying the customer's loyalty account.
• You can revoke the camera permission at any time in your device's system settings; manual entry of customer phone or email remains available as an alternative.

4. How we use information and our lawful basis

• To create and operate merchant accounts and authenticate sign-in.
• To issue, update, and revoke Apple Wallet and Google Wallet loyalty passes for customers enrolled by merchants.
• To send activity push notifications to merchant devices (rewards earned, low pass usage alerts).
• To provide customer support and respond to inquiries.
• To detect, investigate, and prevent abuse, fraud, and security incidents.
• To operate, secure, and improve the Service and develop new features, analytics, and machine-learning models (see Section 5).
• To comply with applicable Saudi Arabian and international legal obligations.

Our lawful basis for processing merchant-account data is the performance of our agreement with you, our legitimate interests in operating and improving the Service, and compliance with the law. Where the law requires consent, we ask for it. We do not sell personal information, and we do not use personal information for advertising profiling.

5. Product improvement, analytics, and AI

We use account and usage data to understand how the Service is used and to make it better. For any analytics or machine-learning that goes beyond providing the Service, and for any use of a merchant's customer data, we use aggregated or irreversibly anonymised data only — data from which no individual can be re-identified, including by us. Anonymised data is not personal data and is outside the scope of the PDPL. We do not use sensitive personal data, or any inference of it, for marketing or profiling.

6. Marketing messages

Promotional or marketing messages to a merchant's customers are sent only where the customer has given a separate, specific marketing consent, and every such message includes a free and easy way to opt out, consistent with the PDPL and the rules of the Communications, Space & Technology Commission (CST). Transactional and service messages (for example, "your card is ready" or "points updated") are not marketing. Merchants are responsible, as controllers, for obtaining these consents.

7. Service providers (sub-processors)

We rely on a small number of trusted third parties to operate Waya. Each receives only the data needed to perform its function and is bound by its own terms and security commitments:

• Supabase — Postgres database, authentication, file storage, and edge functions hosting.
• Google — Sign in with Google, Google Wallet pass issuance, and Firebase Cloud Messaging (FCM) for Android push notifications.
• Apple — Sign in with Apple, Apple Wallet pass issuance, and Apple Push Notification service (APNs) for iOS notifications.
• Vercel — Hosting for the trywaya.com web application.
• StreamPay — Subscription billing for merchants (when activated).

8. Data storage, retention, and international transfer

Account and program data is stored on Supabase infrastructure. Data may be processed and stored outside Saudi Arabia, including in regions used by our service providers. Where personal data is transferred outside the Kingdom, we do so in accordance with the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom — relying on an adequate level of protection or, where that is absent, an appropriate safeguard such as the Standard Contractual Clauses issued by SDAIA, together with data minimisation and, where required, a documented transfer risk assessment. We retain account data for as long as the account is active and for a reasonable period thereafter to meet legal, accounting, and operational requirements, and to establish, exercise, or defend legal claims. Wallet pass data is retained for the lifetime of the pass. Anonymised and aggregated data may be retained.

9. Security and data breaches

All traffic between your device and our services is encrypted in transit using HTTPS / TLS. Authentication credentials are managed by Supabase Auth and the OAuth identity provider you choose. Wallet passes are signed with industry-standard cryptography (PKCS#7 for Apple Wallet, RS256 JWT for Google Wallet). No system is perfectly secure; if you believe your account has been compromised, contact us immediately. In the event of a personal-data breach, we will notify the competent authority (SDAIA) within the period required by the PDPL Implementing Regulations and affected individuals without undue delay where the breach may cause them harm.

10. Your rights

Under the PDPL you have the right to be informed about how your data is processed, to access it, to obtain it in a readable format, to request correction, and to request deletion, and to withdraw consent where processing is based on consent. You may exercise these rights by emailing support@trywaya.com. Merchants can manage their own customer data inside the Waya dashboard; a customer wishing to exercise rights over their data should contact the merchant (the controller), and Waya will assist. These rights do not apply to data that has been irreversibly anonymised. To delete your merchant account, send a request from the email address associated with the account.

11. Children

Waya is intended for use by businesses and adult customers. The service is not directed at children under the age of 13, and we do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. The version and date at the top of this page indicate when it was last revised. For material changes we will seek renewed acceptance where appropriate. Continued use of Waya after a change constitutes acceptance of the revised policy.

13. Contact

Questions, requests, and complaints: support@trywaya.com.