Privacy Policy

Karam Rewards is operated by LEEM ECOSYSTEMS L.L.C. S.P.C. (trade licence CN-6742983, Abu Dhabi Department of Economic Development), TODO: Registered address, Abu Dhabi, United Arab Emirates ("Karam Rewards", "we", "us").

When you join a restaurant's loyalty programme, the restaurant decides why and how your data is used (the "controller"). We process that data on the restaurant's behalf to run the programme (the "processor"). For restaurant accounts, and for security and fraud prevention on the platform, we are the controller.

Customers: full name, mobile number, email address, delivery platform and order number, the rewards you win and redeem, the dates of your visits, the codes issued to you, and your marketing choice. We also see technical data such as your IP address and device type, used to prevent abuse.

Restaurant accounts: name, work email, hashed password, business and branding details, and billing details (card payments are handled by Stripe; we do not store full card numbers).

We do not collect payment card details from customers, Emirates ID numbers, or any health, religious or other sensitive data.

• To run the loyalty programme: verify your email, check your delivery order, issue and track rewards and visit codes, and let restaurant staff confirm a reward at the table. (Basis: performing the programme you joined, and your consent.)

• To prevent fraud and abuse, keep the platform secure, and meet legal obligations. (Basis: legitimate interests and legal obligations.)

• To send you offers and news from the restaurant, only if you ticked the separate marketing box. (Basis: your consent.)

• To give the restaurant summary insights about its programme. These are based on aggregated or de-identified information.

We do not sell your personal data.

Marketing is optional and is never a condition of joining. The box is not pre-ticked. Every marketing email has an unsubscribe link that works immediately, and you can also ask the restaurant or us to stop. Service messages (verification codes, your reward code, expiry reminders) are not marketing.

The restaurant whose programme you joined can see your data. It cannot see other restaurants' customers. We use trusted service providers who process data only on our instructions: Supabase (database), Vercel (hosting), Resend (email), Stripe (restaurant billing), and, where a restaurant uses the related features, OpenAI (summary insights) and Meta WhatsApp (messaging). We may disclose data to authorities where the law requires.

Our providers may store or process data on servers outside the UAE. By joining and giving your consent you agree to this transfer. We require our providers, by contract, to protect your data to a standard comparable to UAE law, and we only transfer what is needed to run the service.

We keep customer records for up to 24 months after your last activity, then delete or anonymise them. We keep billing records for the period required by UAE tax law. If you ask us to delete your data sooner, we will, unless the law requires us to keep it.

You can ask to access your data, correct it, receive a copy, have it deleted, restrict or object to its use (including for marketing), and withdraw your consent at any time. Withdrawing consent does not affect what happened before. Write to privacy@karamrewards.com or to the restaurant. We will reply within a reasonable time and no later than 30 days. If you are not satisfied, you may complain to the UAE Data Office.

We use encryption in transit, hashed passwords, signed session cookies, access controls separating each restaurant's data, and rate limits against abuse. If a breach is likely to harm you, we will notify the UAE Data Office and the people affected promptly, as required by law. No system is perfectly secure.

The programme is for people aged 18 and over. If you are under 18, please ask a parent or guardian to take part on your behalf. We do not knowingly collect data from children; if we learn we have, we will delete it.

We use only essential cookies (sign-in sessions and language choice). We do not use advertising or cross-site tracking cookies.

If we make material changes we will update the date above and, where the law requires, tell you or ask for your consent again.

LEEM ECOSYSTEMS L.L.C. S.P.C., TODO: Registered address, Abu Dhabi, United Arab Emirates. Email: privacy@karamrewards.com.