Who we are
LOYA is an online service for businesses in the United Arab Emirates: a business page, a digital loyalty card and online bookings. We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
Business owner data
Name, email, password (hashed) and business details (name, address, phone, photos, products), used to provide the service and contact you about your account.
Subscription payments are processed by Stripe. We never see or store your full card number — we only keep the subscription status, invoices and the last four digits shown by Stripe.
Customer data
For a booking: name, phone, date, party size and an optional note — shared only with that business.
For the loyalty card: a card identifier, the stamp count and, if you provide them, your first name and phone. No payment data is collected from customers.
Sharing
We never sell data. A customer’s data is visible only to the business they booked with or joined. Apple and Google receive only what is shown on the loyalty card. Stripe receives what it needs to process subscription payments. Some of these providers may process data outside the UAE, with appropriate safeguards as required by the PDPL.
Sign-in & analytics
When you sign in with Google, Google shares your name, email and profile photo with us. For each sign-in we record the date, the method, your approximate location (country and city, from our hosting network) and the type of device, system and browser, to keep accounts secure and understand how LOYA is used. We do not store your IP address in this record.
With your consent (the cookie banner), we use Google Analytics to measure visits and which pages help most. Ads cookies are never used and we do not sell data. You can decline, and you can clear your choice at any time by clearing this site’s data in your browser.
Retention & security
Data is kept while the account is active and deleted on request, except records we must keep by law (for example tax invoices). Access is protected (hashed passwords, HTTPS, rate limiting).
Your rights
Under the PDPL you can request access to, correction or deletion of your data, or object to its processing, by contacting us on WhatsApp or by email. Customers may also contact the business directly.