Privacy Policy

From a merchant: business and branch details, brand assets, and the contact information for the owner and staff accounts we set up.

From an enrolled loyalty member: the minimum a merchant configures at enrollment, by default just a name. No payment card data, and no location tracking beyond Apple's and Google's own on-device Wallet relevance (we never see or store a member's location).

To issue and keep a wallet pass current (stamps, balance, tier, expiry), to run the barista scan app a merchant uses at the counter, and to produce the per-branch reports a merchant sees in their dashboard.

Merchant and member data is hosted on Amazon Web Services in the eu-south-1 (Milan) region. This is a cross-border transfer of data from Egypt, handled in line with Egypt's Personal Data Protection Law (Law 151/2020) and its cross-border transfer requirements.

Apple and Google, to deliver and update the Wallet pass on a member's device (their own Wallet privacy terms apply to that step). Paymob, to process a merchant's subscription billing. Paymob never receives end-customer loyalty data, only the merchant's own billing details. We don't sell or share data with anyone else.

For as long as a merchant's subscription is active, plus a limited period after cancellation to allow reactivation and to meet our own accounting and legal record-keeping obligations.

If you apply for a role at careers@digicardslab.com, we receive what you send us: typically your CV, your contact details and any note you include. We use it only to assess your application and to contact you about it. Applications are held in our business email (Zoho Mail) and are not shared with anyone outside DigiCards Lab.

We keep an application for up to 12 months after the role is filled, so we can reach you about a future opening, then delete it. Email careers@digicardslab.com at any time to have it deleted sooner.

Under the PDPL, a data subject can request access to, correction of, or deletion of their personal data. A merchant can request this on behalf of an enrolled member, or a member can contact us directly. When a deletion request is honored, we remove the identifying information linking that history to you (name, phone number, and similar identifiers); aggregate visit and stamp counts may be retained in de-identified form for the merchant's own business records, since this data no longer identifies you once the link is removed.

Questions about this policy, or a data request: hello@digicardslab.com.