Privacy policy
Last updated:
This policy explains how Walaora handles personal data. It covers two groups: business users (owners and staff who use the dashboard) and the customers of those businesses who join loyalty programs.
1. Our roles
For business users, Walaora is the controller of account data. For loyalty customers, the business running the program is the controller and Walaora processes data on its behalf.
2. Data we process
- Business users: name, work email, password hash, role, activity logs
- Loyalty customers: name, mobile number, optional email and birthday (month and day), loyalty activity, marketing consent with date and source
- Website visitors: language preference, the country estimated from the IP address to show prices (looked up on our own server and not stored) and, only with consent, analytics data
3. Why we process it
- To provide loyalty cards, rewards and reports
- To secure accounts and prevent abuse
- To send marketing messages only to customers who opted in
- To meet legal obligations
4. Sharing
We do not sell personal data. The providers that process data for us, what they do and where, are listed on the sub-processors page (/legal/subprocessors). Our servers are in Vienna, Austria.
5. Retention
Data is kept while the business account is active. When an owner deletes a workspace, its data can still be exported, or the deletion cancelled, for 14 days; after that all its data is deleted except tax invoices, which are kept for the legal retention period. Daily backups are kept for 14 days.
6. Your rights
Under Saudi Arabia’s Personal Data Protection Law you may request access, correction or deletion of your data. Loyalty customers should first contact the business; we will support the request.
7. Security
Passwords are hashed, sessions use secure cookies, access is role-based and sensitive actions are logged.
8. Contact
privacy@walaora.com