Draft for legal review — not final wording
Privacy policy
Last updated
Moving Loyalty (operated by Devya, https://devya.dev) issues loyalty cards for Apple Wallet, Google Wallet and the web on behalf of the businesses that use it. This policy explains what we store about cardholders and merchants, why, and the choices you have.
What we collect from cardholders
A mobile number (required, stored in international format and also as a keyed hash so it can be suppressed after erasure), an optional name, an optional birthday month and day, the language you chose, and the consent choices you made with their text version and time.
Your card's activity: stamps, visits, points, rewards earned and redeemed, the branch where a transaction happened, and the time. We never collect your location: Apple Wallet and Google Wallet decide on your device whether a card appears near a branch.
Technical evidence of consent: a hash of the IP address and the browser name at the moment you joined, kept with the consent record.
Why we process it
To run your loyalty card for the business you joined (performance of the programme you asked for).
To send offers from that business on your card only when you ticked the separate marketing box; you can stop them at any time from the card's back or the web card.
To meet legal duties: consent evidence is kept for at least three years after the last message (Egypt Law 151/2020 and its regulations) and as the Saudi PDPL requires.
Where data lives
Each country runs on its own stack: cardholders of Saudi businesses are stored in the Kingdom of Saudi Arabia; cardholders of Egyptian businesses are stored in Egypt or under a licensed transfer. Apple and Google receive what a wallet card needs to display and update (programme name, balances, the card's barcode) under their own policies.
Your rights
You can ask the business, or us, for a copy of your data, to correct it, or to erase it. Erasure voids your card, removes your personal data and keeps only a hashed suppression entry and the consent evidence the law requires.
To stop offers, open the card's back and tap Stop offers, or use the link on your web card.
Merchants and staff
For business accounts we store the owner's and staff's names, e-mail addresses and password hashes, the business details, branches, wallet credentials (encrypted at rest) and an audit log of changes.
Contact
Write to privacy@devya.dev. Draft for counsel — not yet reviewed.