Loyale Privacy Policy
Last updated: 28 October 2026
Who is responsible for your information
Loyale is operated by Loyale Programming and Graphic Design W.L.L, a limited liability company registered in the Kingdom of Bahrain under Commercial Registration number 135962-1. In this policy, "Loyale", "we" and "us" mean that company. "You" means whoever is using the Loyale app.
Loyale is a loyalty app. You collect stamps and cash credit at shops, cafés and restaurants that take part, and redeem them for rewards. Those businesses are called merchants in this policy.
We are the data controller for the information described here, and we handle it in accordance with the Personal Data Protection Law (Law No. 30 of 2018) of the Kingdom of Bahrain. Each merchant is a separate controller for the information it receives about you (section 4).
Contact us about anything in this policy at info@loyaleapp.co. A person reads it, and none of it costs you anything.
1. What is not switched on
We would rather tell you plainly than write this policy in a tense it has not earned.
- Loyale does not take payment from you today. Where the app lets you place an order, you pay the merchant at the counter in the ordinary way. In-app payment is being built and is not live. We will update this policy before it is, and we will tell you.
- Loyale never sees your card details. Not today, and not when in-app payment is switched on — card data goes directly to our payment processor, Tap Payments, and never reaches our systems.
- Gift cards and Loyale Streak are not switched on. We will update this policy before they are.
- We do not sell your personal information. Not to merchants, not to advertisers, not to anyone. There is no arrangement of that kind and there never has been.
2. What we collect
What you give us when you sign up. Your mobile number, your email address and your name, and your date of birth, nationality and gender as the sign-up screens ask for them. Your mobile number is how we identify you — it is the account.
What happens as you use the app. Every collect and redeem: which merchant, which branch, when, the amount of the receipt where the merchant's system sends it, and the stamps or credit it earned. Your redemptions, vouchers, gift transfers, promo codes and streaks. This is the record that makes your balance mean something, so we keep it for as long as you have an account.
Your orders, if you order in the app. What you order, any notes you add, the branch and how you collect it — your table, or, for drive-through, the car details you save (plate number, make and colour). The merchant preparing your order sees these details, with your name and the last four digits of your mobile number. If you rate an order, the merchant sees your rating and comment with your first name and initial; we may hide a rating that is abusive, false or unlawful. Notes can mention allergies; add only what the merchant needs to know.
Your device and the app. Device type and operating system, the app version, and a push notification token if you allow notifications. Crash and error reports where the app fails.
How you use the app. Which screens you open and where you tap on them, and a recording of the screen while you use the app, with every word and picture on it hidden. We link this to your member code, never to your name, mobile number or email, and use it only to fix faults and make the app easier to use. Recordings are deleted after 30 days.
Where you are, only if you allow it. The app asks for location so it can show you merchants near you. If you say no, the app works — you sort and search instead. We do not track your location in the background and we do not build a history of where you have been.
What we never collect. We do not collect your card number, your CPR, your passport, your bank details, your contacts, your photos, your messages, or anything from other apps on your phone.
3. Why we are allowed to hold it
Under Bahrain's Personal Data Protection Law we must have a lawful basis for each thing we do with your information. Ours are:
| What we do | Why we are allowed to |
|---|---|
| Run your account, your balance and your redemptions | Performing the contract you have with us |
| Send you the verification code to sign in | Performing the contract |
| Tell a merchant you redeemed at their branch | Performing the contract — the redemption cannot work otherwise |
| Keep records of transactions | Our legal obligations, including tax and accounting |
| Fix bugs, improve the app, prevent abuse, keep the service secure | Our legitimate interests in running a working, honest service |
| Send you marketing messages | Your consent, which you can withdraw at any time |
| Use your location | Your consent, given through your phone's permission prompt |
Where we rely on your consent you can take it back whenever you like, and doing so never costs you your rewards.
4. Who sees your information
Merchants see what they need to serve you and honour your rewards. When you collect or redeem at a merchant, that merchant sees the transaction at its branch and enough to identify you at the till: your name, your member code and your balance with it. Once you have used a merchant, it can also see your date of birth, nationality, gender, email address, mobile number and how much you have spent with it, and its staff can export them. A merchant may use this only to identify you, honour what you hold, serve you through Loyale, handle complaints, meet its legal duties and prevent fraud — never to contact you outside Loyale, to sell or share it, or to combine it with other information to build a profile of you. Each merchant is responsible, as a separate controller under the Personal Data Protection Law, for what it does with the information it receives. A merchant cannot see where else you shop, what you collect anywhere else, or your balance with anyone but them.
Our suppliers, for the jobs they do. We use a small number of service providers, each of which sees only what its job requires:
- Mobishastra — sends your sign-in codes and notices by SMS. It receives your mobile number.
- Resend — sends our emails, including sign-in codes sent by email. It receives your email address.
- Google Firebase — delivers notifications to the app on your phone. It receives a notification token for your device.
- PostHog — app analytics, in the European Union. It receives what section 2 describes under How you use the app, and the device details and crash and error reports described under Your device and the app, linked to your member code.
- Foodics — a till system used by some merchants. Where a merchant uses it and you place an order, your order reaches their till.
- Tap Payments — our payment processor, for when in-app payment is switched on. Card details go directly to Tap and never reach us.
- Hosting and analytics providers, which hold the systems the app runs on.
Each of them is bound to use the information only to provide that service to us.
Nobody else. We do not share your information with anyone else unless the law requires it of us, or a court or a competent authority in Bahrain orders it.
5. Where your information is kept
Your information is held on servers operated for us. Some of our service providers process information outside Bahrain. Where that happens, we take reasonable steps to ensure the information is protected to a standard consistent with the Personal Data Protection Law, and we only use providers that commit to protecting it.
6. How long we keep it
While you have an account, we keep your account and your transaction history — because your balance is made of that history, and a balance with no record behind it cannot be audited or trusted.
Deactivating your account in the app switches it off and signs you out; it does not delete your information. To have your account deleted, ask us (see Deleting your account below). When we delete an account, we delete your profile and stop using your information to identify you, and we keep the financial and transaction record only for as long as Bahraini tax and accounting law requires, because we are obliged to.
Marketing consent and location permission stop the moment you withdraw them.
7. Your rights
Under the Personal Data Protection Law you have the right to:
- be told what we hold about you, and why;
- get a copy of it;
- correct anything that is wrong;
- object to our using it for a particular purpose, including marketing;
- withdraw consent you have given;
- ask us to delete your account and your personal information, subject to the records we are legally obliged to keep;
- complain to the Personal Data Protection Authority in Bahrain if you think we have got it wrong.
How to use them. Write to info@loyaleapp.co from the number or email on your account, or ask in the app. We will answer within thirty days. There is no charge.
Deleting your account. You can ask us to delete it at any time. Be aware that deleting your account ends your stamps and credit — they are tied to the account and cannot be transferred or reinstated afterwards. We will say so clearly before we act, so nobody loses a balance by accident.
8. Children
Loyale is not for children under 13, and we do not knowingly create accounts for them. If you believe a child has an account with us, tell us at info@loyaleapp.co and we will remove it.
9. Keeping it safe
We protect your information with access controls, encrypted connections, and restricted internal access on a need-to-know basis. No system is perfectly secure and we will not claim otherwise. If a breach occurs that puts your information at risk, we will tell you and the Personal Data Protection Authority as the law requires.
10. Changes to this policy
We will change this policy as Loyale changes — in particular before in-app payment, gift cards or Loyale Streak are switched on. The date at the top always reflects the current version. Where a change materially affects how we use your information, we will tell you in the app or by message; we will not make a significant change quietly.
Contact
Loyale Programming and Graphic Design W.L.L Commercial Registration 135962-1, Kingdom of Bahrain info@loyaleapp.co · WhatsApp +973 3933 1996
You may also complain to the Personal Data Protection Authority of the Kingdom of Bahrain at any time. You do not have to come to us first, though we would like the chance to put it right.