Privacy Policy

**Account info:** email address, phone number, display name (optional), preferred language, email verification status, phone verification status.

**Order info:** selected gift card, denomination, total paid, payment method, payment status, Moyasar invoice ID, order timestamp.

**Technical info:** IP address, browser & OS (User-Agent), pages visited, anonymized Vercel Analytics statistics.

**Authentication data:** temporary OTP codes for phone verification, session JWT (stored as a secure HttpOnly cookie).

**Order fulfillment:** delivering gift card codes, payment confirmations, receipts.

**Account operation:** identity verification, saving preferences, avoiding repeated re-verification.

**Fraud prevention:** monitoring suspicious patterns (e.g. the purchase counter that requires email verification before a 4th paid order).

**Improvement:** aggregated usage analysis to improve UX (we do not sell data to any third party).

**Legal compliance:** retaining invoice records for VAT purposes as required by the Saudi tax authority (ZATCA).

**Moyasar (payment gateway):** customer name, email, amount, order ID — for processing payments. Moyasar is regulated by SAMA.

**Resend (transactional email):** email address, customer name (if any) — for verification and receipt emails.

**WhatsApp Business / Baileys:** phone number — for delivering OTP codes and gift cards.

**Vercel Postgres:** database — data hosted in the European Union (Frankfurt).

**Vercel Analytics:** anonymized visit statistics (no identifying cookies).

**ZATCA (Saudi tax authority):** invoice data as required by Saudi e-invoicing rules.

We do not sell your data and do not share it with marketing companies.

**Order and invoice records:** 10 years (as required by Saudi tax law).

**Active account data:** as long as your account is open.

**After account deletion:** we deactivate immediately and hard-delete after 30 days (anonymized invoice numbers are retained for accounting purposes).

**OTP codes:** wiped after 5 minutes or immediately upon verification.

**Access:** view all your data on the /account page.

**Correction:** edit email, phone, name, preferences from /account/settings.

**Deletion:** delete your account from /account/settings → Danger zone.

**Object to processing:** opt out of new-brand and promotional notifications from settings.

**Portability:** request a copy of your data by contacting us.

We use a single cookie: `tether_session` — a secure session token (HttpOnly, Secure, SameSite=Lax) that keeps you signed in. We do not use advertising tracking cookies.

Vercel Analytics uses anonymized techniques for visit counts (no identifying cookies).

Passwords are hashed with bcrypt. Sessions are signed with HMAC. Verification and password-reset links are signed and short-lived.

In the event of a suspected breach, we will notify affected users within 72 hours via their registered email.

Our service is not directed at users under 18. If we discover an account belonging to a minor, we close it and delete the associated data.

We may update this policy when necessary. Material changes will be sent to your registered email. The currently effective version is always the one on this page.