Privacy Policy

Operator and scope

DAYEM is operated by Jordanian Axis for Software and Computer Systems. This policy explains how personal information is handled through the DAYEM marketing website, merchant application, loyalty enrollment, customer management, support, and supported wallet features. Privacy questions and requests can be sent to support@dayemcard.com or WhatsApp +962 79 167 0500.

DAYEM and merchant responsibilities

Each merchant decides why and how it runs its loyalty program, what optional customer details it requests, its rewards, and whether it sends marketing. The merchant is responsible for its notices, instructions, and lawful use of customer information. DAYEM provides the platform and processes loyalty-program information to deliver the service for merchants.

DAYEM also makes independent decisions about merchant accounts, platform security, abuse prevention, billing administration, service operation, and legal compliance. The precise controller and processor allocation, including any required data-processing terms, must be confirmed in the merchant agreement before launch in each market.

Information we process

For merchants and team members, DAYEM processes account identifiers, name and email, authentication and MFA information held through Supabase Auth, business profile and commercial status, roles and permissions, program and reward settings, branding media, invitations, service activity, audit events, and support communications.

For loyalty customers, DAYEM processes a first name and business-scoped username, and may process a last name, email, or phone when supplied or requested by the merchant. It also processes marketing-consent records, memberships, points or stamp balances, immutable loyalty transactions, rewards and redemptions, QR credentials, wallet-pass status, wallet messages, consent-withdrawal credentials, and privacy-request records.

First name and a business-scoped username are required to create a loyalty membership. Last name, email, phone, marketing consent, and Apple Wallet or Google Wallet use are optional. Technical records may include timestamps, security and rate-limit identifiers stored in hashed form, session information, request metadata, and application or provider error classifications.

Sources, purposes, and legal grounds

Information comes from merchants, authorized team members, customers, authentication and wallet providers, and ordinary use of DAYEM. It is used to create and secure accounts, operate loyalty programs, calculate ledger-derived balances, process rewards, provide dashboards and exports, issue and synchronize wallet passes, send consent-based wallet broadcasts, prevent abuse, investigate faults, respond to requests, and administer the commercial service.

The legal ground depends on the relationship, country, and purpose. It may include performing the requested service or merchant agreement, complying with law, protecting legitimate interests such as service security and fraud prevention, or consent where consent is required. Merchants remain responsible for identifying and documenting the appropriate ground for their customer processing. DAYEM does not currently use customer information for solely automated decisions that produce legal or similarly significant effects.

Marketing choices

Marketing consent is optional, recorded separately from loyalty enrollment, and is not required to join a program. DAYEM records consent and withdrawal evidence, including the notice version and selected channels for new consent events. Older records may be identified as legacy evidence where the same detail was not historically collected.

Customers can withdraw marketing consent using the preferences link in an eligible wallet pass or by contacting the merchant or DAYEM. Withdrawal prevents future consent-dependent broadcast eligibility but does not make earlier lawful processing unlawful or erase transaction history automatically.

Service providers and digital wallets

DAYEM uses Supabase for authentication and PostgreSQL-backed application data, Hetzner infrastructure for application hosting, and Apple or Google services when a customer chooses supported wallet functionality. These providers process technical or personal information only as needed for their respective services and under their own applicable terms.

For Google Wallet, DAYEM sends the customer display name, loyalty balance and progress, reward details, a loyalty QR credential, program and merchant branding, a marketing-preferences link, and eligible wallet messages. Google controls the Wallet application, device notification delivery, and provider-side retention. Disabling a pass in DAYEM does not guarantee immediate deletion of every record held by Google.

For Apple Wallet, DAYEM includes the customer display name, loyalty balance and progress, reward details, a loyalty QR credential, program and merchant branding, and a marketing-preferences link in the signed pass. Apple controls the Wallet application and device notification delivery. DAYEM does not disclose customer information to advertising networks through the marketing website.

International processing

DAYEM is operated from Jordan and is preparing to serve Jordan and Cyprus. Providers or their support personnel may process or access information in countries other than the customer’s or merchant’s country, including outside the European Economic Area. Exact hosting regions, transfer routes, and contractual safeguards depend on deployed provider configuration and agreements and must be confirmed before commercial launch. This policy does not claim that Standard Contractual Clauses, adequacy decisions, or other transfer instruments are in place unless separately verified.

Retention, deactivation, and deletion

DAYEM retains records according to the purpose for which they are needed, service security, transaction integrity, disputes, and applicable legal or business requirements. A general retention schedule has not yet been legally approved, so DAYEM does not publish invented fixed periods. Replaced media becomes eligible for automated deletion after seven days, while short-lived enrollment and recovery credentials have bounded expiry and cleanup behavior.

Customer anonymization removes or replaces direct profile and contact details, withdraws marketing consent, deactivates memberships, disables wallet passes, and preserves non-identifying ledger and audit history needed for integrity. Deactivation or account termination does not promise immediate deletion from immutable transaction records, audit records, security logs, provider systems, or backups. Backup retention and final deletion procedures remain launch decisions requiring operational and legal approval.

Your privacy rights

Depending on applicable law, a person may request access, correction, deletion, restriction, objection, withdrawal of consent, or a portable copy of information. DAYEM supports merchant-side request tracking, customer correction and anonymization workflows, and authorized exports. Rights are not absolute; transaction integrity, legal duties, another person’s rights, or the inability to verify a requester may limit a request.

Start by contacting the merchant responsible for the loyalty program or support@dayemcard.com. DAYEM or the merchant will use proportionate information already available to confirm that the requester is entitled to act. DAYEM does not currently provide an identity-document upload feature.

Cookies and necessary technologies

The marketing website does not currently use analytics or advertising cookies. The application uses strictly necessary authentication and session cookies, a cookie that remembers an authenticated user’s selected business, and short-lived anonymous credentials used to protect enrollment, recovery, consent, and invitation flows from abuse. These technologies are required for requested functionality and security; DAYEM therefore does not currently display a nonessential-cookie consent banner.

Security

DAYEM uses measures including tenant-scoped authorization, role and capability checks, active-membership validation, database constraints and row-level security, hashed public credentials, rate limiting, immutable loyalty records, durable background jobs, audit events, MFA for platform administration, input validation, and browser security headers. Access is restricted according to role, and customer contact details and transaction history have separate permissions. No online service can guarantee absolute security.

Complaints, updates, and contact

Please contact DAYEM or the relevant merchant first so the concern can be investigated. In Jordan, complaints may be escalated in accordance with the Personal Data Protection Law to the Personal Data Protection Directorate at the Ministry of Digital Economy and Entrepreneurship. Where the GDPR applies, a person may also complain to the competent supervisory authority; in Cyprus this is the Office of the Commissioner for Personal Data Protection.

We may update this policy when the service, providers, or legal requirements change. The current version and effective date will remain available here. Contact support@dayemcard.com for questions or requests.