Privacy policy

1. Who is responsible

The business where you created your card is the data controller. Wafly is the processor and acts only on its instructions, under a processing contract.

2. Data processed

• First name; phone number or email if you give one (the email may also come from Google); birthday (day and month) if you give it.
• Sign in with Google: we only receive your first name and verified email — never your password, contacts or date of birth.
• Loyalty data: points or stamps, tier, visits, rewards, purchase amounts linked to points (never item details or bank data).
• Preferences and your consent to receive offers, with its date; Wallet technical identifiers; IP address at sign-up; a cookie that finds your card on your phone.

3. Purposes

• Run your card and points.
• Card information (balance, rewards, expiring points).
• Offers: only with your consent (article 7 of law 18-07), which you can withdraw at any time.
• A birthday gift, if you gave the date.
• Fraud prevention and security; legal and accounting obligations.

4. Recipients

The business and its authorised staff; Wafly and its contracted providers. Hosting: [Nom, forme juridique et adresse de l’hébergeur en Algérie], servers in Algeria. Apple and Google (Wallet cards, Sign in with Google), Resend (email), and where used WhatsApp and SMS providers. Your data is never sold or shared with other businesses.

5. Processing outside Algeria

Some providers are established abroad: Apple (Apple Wallet), Google (Google Wallet and Sign in with Google), Resend (email) and, where used, Meta (WhatsApp) and an SMS provider. Transfers abroad require ANPDP authorisation (article 44 of law 18-07), which the business requests with Wafly's help.

6. Retention

• While your card is used, then 3 years after your last visit (automatic anonymisation).
• A card never used at the till may be deleted by the business after 30 days. Technical logs: 13 months.
• If you delete your account: immediate anonymisation.

7. Your rights

From your customer area you can view, download and delete your data and withdraw your consent. Law 18-07 gives you the rights of information, access, rectification and objection, including to direct marketing: contact the business or privacy@wafly.app. You may also refer the matter to the ANPDP.

8. Security, cookies and minors

Encrypted connections, per-business isolation, signed and replaceable card QR, hashed till PINs, audit log. No advertising cookies or third-party trackers, and no audience measurement. Only necessary cookies are set: your customer space session (90 days); remembering your card on the phone used to sign up (up to 400 days); referral, which keeps the code of the person who invited you until you sign up (30 days); light or dark theme (1 year). On the sign-up page, the “Continue with Google” button loads a script provided by Google (accounts.google.com), which may read or set Google’s own cookies under Google’s privacy rules; you can always sign up with the form instead. Minors need the consent of their legal representative.

9. Contact

Questions about your data: privacy@wafly.app.