Madar Privacy Policy

Updated 14 November 2026

Operator and account-data controller: Kim Belbisi, Karbingatan 57, 264 51 Ljungbyhed, Sweden. Contact: [email protected].

Scope and responsibilities

Madar provides merchant loyalty programmes. We determine how account information is used to provide and protect the service. Merchants decide the purpose and rules of their loyalty programmes, which customers to register and which offers to confirm. We process programme data to provide those requested functions. Merchants must inform their customers and establish the appropriate basis for their processing. Our merchant-data notice (Arabic) explains these responsibilities.

Information and purposes

Account information includes email, an account identifier and authentication information needed to sign in, confirm email and recover access. Programme information includes business name/type/logo, reward rules, customer display names and identifiers, communication choices and their timestamps, pass identifiers, visits, balances and redemptions. Recorded dates support last-visit, return and weekly-activity calculations. We do not collect or infer customer age or gender.

We also process Wallet offer text, selected audience, confirmation time and queue status; AI consent/usage records; and, for purchases, Apple's transaction references, product, entitlement period/status and purchase environment. We do not receive your payment-card number from Apple. Support information is what you choose to send us. Service providers may process operational/security records. Do not enter sensitive data or unnecessary customer information.

Information is used to provide accounts, loyalty programmes and passes, verify access and subscriptions, confirm operations without duplicate awards, show programme activity and handle your requests. Necessary account processing supports our agreement with you; security and abuse prevention protect the service and its users. Optional marketing and AI choices are separate. Accepting terms is not blanket consent. The merchant app does not contain third-party advertising networks or cross-app advertising tracking.

Marketing choices and Wallet offers

Customer marketing consent is separate from loyalty registration and starts off. The merchant selects an eligible audience, reviews the offer and confirms it. Queueing an update does not prove delivery or viewing; Apple and device settings control Wallet presentation. A merchant can record withdrawal even after its subscription expires. Withdrawal excludes new sends and consent is checked again before queued updates are processed; it cannot recall an update already delivered. Loyalty members can contact their merchant or us, naming the programme without sharing the secret card code.

Providers and locations

We use Supabase for authentication and the database hosted in Ireland, and Render for the Madar service in Frankfurt, Germany. Resend sends email-confirmation and recovery messages through auth.madar-online.com with Ireland as the sending region; open/click tracking is disabled. Messages include the recipient address and secure action link. Apple processes pass registration/update tokens and subscription purchases through its services.

We use Cloudflare to deliver and protect this website. When you open a page, Cloudflare processes network/request information, including IP address and traffic-routing data, to deliver content and protect the service. Its own network-security processing is described in Cloudflare’s privacy policy. We do not promise that this website metadata stays in one country or is immediately erased when a Madar account is deleted.

Optional AI sends your question, business context and aggregate customer/visit/return counts to OpenRouter to generate suggestions using Anthropic Claude through Amazon Bedrock, after separate consent and an explicit send action. Customer names, account email, logo and individual records are not automatically added to that route. Free text and small aggregates may still reveal personal information. Do not enter it.

Processing includes transfers outside Saudi Arabia. An EU server location does not mean all support, backups or AI processing stay in Europe. We do not promise EU-exclusive AI processing or treat hosting location alone as proof of transfer safeguards. Our route requests restricted provider data collection and zero retention. These controls and the applicable standard agreements are not an absolute guarantee of every provider’s actual retention practices or records. See OpenRouter, Anthropic and AWS privacy information.

The standard service terms of Supabase, Render, Cloudflare, Resend and OpenRouter incorporate data-processing agreements for their applicable services; a separate handwritten signature is not generally required for ordinary use. These terms do not by themselves complete Madar’s processing arrangements with merchants or establish the applicable Saudi cross-border transfer basis. OpenRouter’s standard role wording also needs to cover the actual relationship if personal data controlled by a merchant is processed on its behalf. Our AI route does not automatically attach individual customer records; the warning against entering personal data still applies. We do not describe all commercial processing or transfer arrangements as independently certified. Contact us for the applicable processing information.

On your device

Refresh-session information is held in iOS Keychain; preferences and the separate local preview remain on the device. An unresolved operation may be kept to retry it safely. Optional Face ID/Touch ID matching is performed by iOS; Madar receives no face image or biometric template. Camera frames used to scan QR/PDF417 pass codes are not uploaded to Madar; the decoded code is sent for pass validation. When you share a pass file, you choose its recipient in the iOS share sheet. Copies exported or shared outside the service remain under your and the recipient's control.

Retention and deletion

Account, business, customer, pass, visit, reward and offer records are kept while the account continues to support the programme and its history. Deleting an owner's account requires confirmation that owned programmes will also be deleted. Access to that account and its shared programmes is stopped, then the account and owned programme data are removed when deletion completes. A pending deletion request is kept to retry until success; its record is removed after successful account deletion. We do not promise that pressing Delete instantly removes every external copy.

Linked subscription transaction details are deleted with the Madar account. The original Apple purchase reference and its environment remain without the Madar email or account identifier to prevent an old purchase being rebound to another account. This limited anti-rebinding record is not claimed to be anonymous to Apple. Account deletion does not cancel an Apple subscription; use Apple subscription settings.

AI question/answer text is not stored in the application's database in the current route. Consent records are kept to manage choices and are deleted with the associated account. Limited technical quota records can remain after the business link is removed until cleanup during subsequent use; they contain no chat text. Resend retains email/log data for 30 days under its current plan. Contact us for help requesting earlier removal of a specific message.

Hosting/security logs and backups are subject to provider operations; no uniform retention period or immediate deletion by every provider is promised here. Support correspondence is used to handle your request; you may request removal when no longer needed, subject to applicable obligations. Local previews, exported files, recipients' copies and an installed Wallet pass are not erased by remote account deletion. You can remove local data and remove the pass in Wallet.

Your rights

Contact us to request information, access, a readable copy, correction or deletion where applicable, or withdraw consent where it is the basis. Under applicable European rules you may also request restriction, object to processing or request portability subject to their conditions. Rights are not unconditional in every case; we explain any lawful restriction.

State whether your request concerns your Madar account or another merchant's programme. We may verify identity proportionately; do not email passwords, sign-in codes or sensitive documents without agreeing a safe channel. Saudi PDPL requests are normally handled within 30 days, with a reasoned notice of any permitted extension. European requests are normally handled within one month, with notice of any permitted extension. You may complain to SDAIA's National Data Governance Platform or Sweden's IMY where its jurisdiction applies.

Changes

We date updates and seek a separate choice before new optional processing that requires consent. This policy is not a compliance certificate or a guarantee of business results.