Privacy Policy — dPoints

01Introduction

D Points App (“we,” “our,” or “us”) operates the D Points App loyalty rewards platform, including the D Points App mobile application (“App”) and associated web services (“Platform”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Platform.

We are committed to protecting your privacy in accordance with applicable data protection laws including the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), India’s Digital Personal Data Protection Act 2023 (DPDPA), Malaysia’s Personal Data Protection Act 2010 (PDPA), Singapore’s Personal Data Protection Act 2012 (PDPA), and internationally recognised standards including the General Data Protection Regulation (GDPR) where applicable.

AGREEMENT TO TERMS

By downloading, installing, accessing, or using the D Points App mobile application or web platform, you confirm that you have read, understood, and agree to be bound by this Privacy Policy and our Terms of Use. If you do not agree to this Policy in full, you must discontinue use of the Platform immediately.

02Who We Are

D Points App is a loyalty rewards platform that enables customers to earn and redeem points at participating venues including restaurants, cafes, food trucks, bakeries, and cloud kitchens. Venue owners and their staff use the Platform to manage loyalty programs, send marketing communications, and process customer transactions.

03Types of Users and Data Collected

The D Points App Platform serves two distinct categories of users with different data requirements.

3.1 Customers (Loyalty Members)

Customers are individuals who enroll in the D Points App loyalty program to earn and redeem points at participating venues.

MINIMUM DATA REQUIRED TO USE D POINTS

The minimum personal information required to create a customer account is your full name and either your email address or mobile number. This information is used solely for account creation, identity verification, and secure login authentication. You are never required to provide anything beyond this to access the core loyalty features of the App.

Category	Data Collected	Why We Collect It
Identity & Login	Full name — to personalise your account and identify you at venues Email address — for account login, identity verification, and transactional communications Mobile number (optional if email provided) — for account login and OTP verification Password (stored as a one-way cryptographic hash — never readable) — to authenticate your login securely	Account creation, login, and identity verification
Identity Credentials	Unique QR code token, 6-character PIN	Used at venue counters to process loyalty point transactions without sharing personal details with staff
Profile	Profile photo (optional, uploaded by you)	Personalisation of your in-app profile only
Transaction Data	Points earned, points redeemed, sale amounts, venue visits, transaction timestamps, transaction history	Core loyalty program operation — required to credit and track your points balance accurately
Preferences	Menu item preferences per venue (set by you)	Enables personalised offers from venues you are enrolled with
Notification Data	Device push notification token	Delivery of loyalty updates, points alerts, and offers to your device
Technical & Security	IP address, device type, app version, session logs, error logs	Security monitoring, fraud prevention, and improving app stability

What we do NOT access or collect from customers

No camera access — customer accounts do not request, require, or use camera access at any point. Only venue staff accounts use the camera, and only for QR code scanning (see Section 3.2).
No microphone access — the D Points App does not access or use the microphone on any device, for any user type, under any circumstances.
No location tracking — we do not track your GPS location. City or country may be optionally provided during registration but is never tracked in real time.
No payment or banking data — D Points does not process, store, or have access to your payment card, bank account, or any financial credentials.
No government ID — we do not collect passport numbers, national ID numbers, or any government-issued identification.
No contact list or files — D Points does not access your phone's contacts, files, photos library, or any other app data.

3.2 Venue Users (Owners, Managers, Staff)

Venue users are business operators and their employees who manage loyalty programs through the D Points App Platform.

Category	Data Points	Purpose
Account Information	Full name, email address, password (hashed), role	Account creation and access control
Venue Information	Venue name, address, city, country, phone, website, venue type	Platform listing and operations
Business Data	Transaction records, revenue analytics, customer engagement data	Business intelligence and reporting
Staff Actions	Points awarded, redemptions processed, orders placed	Audit trail and accountability
Media	Venue logo, banner images	Public venue profile

Camera Access — Venue Staff Only, QR Scanning Only

Camera access is requested exclusively from venue staff accounts, and solely for the purpose of scanning customer QR codes to process loyalty point transactions at the counter. This camera usage is strictly limited to reading QR codes in real time. No images, photographs, or video are stored, recorded, saved, or transmitted at any point. The camera is activated only when a staff member initiates a scan and is immediately released afterwards. Customer accounts do not request, access, or use the camera under any circumstances.

04How We Use Your Information

4.1 Customers

Account authentication and login — your name and email address (or mobile number) are used to create and access your account securely. This is the primary reason we collect this information.
Identity verification — email or mobile OTP verification confirms that you own the contact details provided and prevents fraudulent account creation
Operate and manage your loyalty points account and maintain an accurate points balance
Process points earned and redeemed at participating venues
Deliver personalised offers based on your preferences and transaction history
Send transactional notifications (points awarded, redemptions, order updates)
Send marketing communications from venues you are enrolled with — you may opt out at any time through your device settings or by contacting us
Detect and prevent fraud, abuse, and security threats
Improve the Platform and user experience through anonymised usage analytics
Comply with applicable legal obligations

4.2 Venue Users

Provide access to the venue management dashboard
Process customer loyalty transactions
Generate analytics and business reports
Deliver platform notifications and system alerts
Manage subscription and billing
Comply with legal obligations

05Legal Basis for Processing

Contractual necessity — to perform our agreement with you when you use the Platform
Legitimate interests — to operate, improve, and secure the Platform; to prevent fraud
Consent — for marketing communications and push notifications (you may withdraw consent at any time)
Legal obligation — to comply with applicable laws and regulations

06Data Sharing and Disclosure

OUR COMMITMENT — YOUR DATA IS NEVER FOR SALE

We do not sell, rent, lease, trade, share for compensation, or otherwise transfer your personal data to any third party under any circumstances whatsoever. Your name, email address, mobile number, transaction history, and all other personal information you provide to D Points App is used exclusively to operate and improve the D Points loyalty platform for your benefit. No data broker, advertiser, marketing agency, analytics company, or any other commercial third party has access to your personal information.

6.1 With Participating Venues

When you enroll at a venue, that venue’s authorised staff can view your name, points balance, transaction history at their venue, and preferences you have set for that venue. Venues cannot access your data from other venues you are enrolled with.

6.2 With Service Providers

Alibaba Cloud (Singapore region, Singapore data centre) — cloud infrastructure and database hosting. Your data is stored and processed within Singapore. Users in the UAE and other regions may have their data transferred to and processed in Singapore; such transfers are protected by appropriate contractual safeguards.
Google Firebase Cloud Messaging (FCM) — push notification routing to Android devices
Apple Push Notification service (APNs) — push notification delivery to iOS devices

All service providers are contractually bound to protect your data and use it only for the purposes we specify.

6.3 Legal Requirements

We may disclose your information if required by law, court order, or government authority in any jurisdiction where we operate, including UAE, India, Malaysia, and Singapore.

6.4 Business Transfer

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

07Data Retention

Data Type	Retention Period
Customer account data	Duration of account + 3 years after deletion request
Transaction records	7 years (financial compliance)
Push notification tokens	Until updated or account deleted
Venue user data	Duration of venue subscription + 3 years
System logs and error records	12 months
Marketing communications	Until opt-out or account deletion

08Your Rights

Depending on your country of residence, you have the following rights regarding your personal data:

All Users

Access — request a copy of the personal data we hold about you
Correction — request correction of inaccurate or incomplete data
Deletion — request deletion of your account and personal data
Objection — object to processing based on legitimate interests
Withdrawal of Consent — withdraw consent for marketing or push notifications at any time
Portability — request your data in a structured, machine-readable format

Regional Rights

🇦🇪 UAE · PDPL

Rights under Federal Decree-Law No. 45 of 2021 including the right to be informed, access, correction, and erasure of your personal data.

🇮🇳 INDIA · DPDPA 2023

Right to information, correction, erasure, grievance redressal, and nomination under the Digital Personal Data Protection Act 2023.

🇲🇾 MALAYSIA · PDPA 2010

Right to access and correct your personal data under the Personal Data Protection Act 2010.

🇸🇬 SINGAPORE · PDPA 2012

Right to access, correction, and withdrawal of consent under the Personal Data Protection Act 2012.

To exercise any of these rights, contact us at business@dpointsapp.com. We will respond within 30 days.

09Data Security

We implement multiple layers of technical and organisational security controls to protect your personal information.

Encryption — Double-Layer Protection

Encryption in transit — all data exchanged between your device and our servers is encrypted using TLS 1.2/1.3 (the same standard used by banks and financial institutions). No personal information travels unencrypted over any network.
Encryption at rest — personal data and transaction records stored in our database are encrypted at the storage level using AES-256, a military-grade encryption standard. Even in the unlikely event of a storage breach, your data is unreadable without the encryption keys.
Double-layer security — the combination of transport-layer encryption (TLS) and storage-layer encryption (AES-256) means your information is protected at every point in its journey — while being sent, while being processed, and while being stored.

Authentication & Access Control

Password protection — passwords are processed through an industry-standard one-way cryptographic hashing algorithm before storage. This means your password is never stored in any readable form — not by our team, not by our systems. It cannot be retrieved or decrypted.
Session tokens — login sessions use short-lived, cryptographically signed tokens that expire automatically. Expired tokens cannot be reused, limiting the window of any potential unauthorised access.
Role-based access control — venue owners, managers, and staff can only access data that belongs to their own venue. There is no cross-venue data visibility. Superadmin access is separately secured and audited.
Email verification — new customer accounts require email or mobile OTP verification before full access is granted, preventing account creation with false credentials.

Infrastructure Security

Network isolation — our database and backend services operate within a private network and are not directly reachable from the public internet. Only the application layer is exposed, through controlled, firewalled endpoints.
QR code integrity — customer QR codes are generated using cryptographically secure random values. They are unique per customer and mathematically infeasible to predict, guess, or reverse-engineer.
Automated encrypted backups — data is backed up regularly in encrypted form. Backups are stored separately from primary infrastructure to ensure recoverability without compromising security.
Ongoing security reviews — our infrastructure and application code undergo periodic security assessments to identify and remediate vulnerabilities.

Despite these measures, no system is completely secure. We encourage you to use a strong, unique password and to keep your login credentials confidential. If you suspect unauthorised access to your account, contact us immediately at business@dpointsapp.com.

10Push Notifications

With your consent, we send push notifications including points awarded or redeemed, personalised offers from enrolled venues, order updates, and marketing messages. You can withdraw consent at any time through your device settings or within the D Points App app.

11Children's Privacy

The D Points App Platform is not intended for individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at business@dpointsapp.com and we will delete that information.

12International Data Transfers

Your data is stored and processed in Singapore on Alibaba Cloud infrastructure. If you access D Points from the UAE or other regions, your personal data is transferred to and processed in Singapore. This transfer is protected by appropriate contractual safeguards and is carried out in compliance with applicable data protection laws, including the UAE Federal Decree-Law No. 45 of 2021 (PDPL), Singapore's Personal Data Protection Act 2012 (PDPA), and Malaysia's PDPA 2010 where relevant. By using the D Points Platform, you acknowledge that your data will be processed in Singapore.

13Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via push notification or email, and update the “Last Updated” date at the top of this Policy. Continued use of the Platform after changes constitutes acceptance of the updated Policy.

14Acceptable Use & Prohibited Activities

The D Points App Platform is provided exclusively for legitimate loyalty rewards and business management purposes. By using the Platform, you agree that you will not engage in any of the following prohibited activities:

Prohibited Uses

Illegal activity — using the Platform for any illegal, fraudulent, criminal, or unauthorised purpose under the laws of any applicable jurisdiction
Account manipulation — creating fake accounts, impersonating other users or venues, or submitting false personal information
Points fraud — attempting to fraudulently earn, transfer, or redeem loyalty points through deceptive means, exploitation of system errors, or collusion
Unauthorised access — attempting to gain access to other users’ accounts, venue dashboards, or any backend system you are not authorised to use
Reverse engineering — attempting to decompile, disassemble, reverse-engineer, or otherwise tamper with the application, its APIs, or its underlying systems
Automated abuse — using bots, scripts, crawlers, or any automated tool to interact with the Platform in a manner inconsistent with normal human use
Disruption — engaging in any activity that disrupts, damages, overloads, or impairs the Platform or its servers, including denial-of-service attacks
Harmful content — using any messaging or communication feature within the Platform to send spam, phishing content, malware, or any content that is abusive, threatening, or harmful
Privacy violations — collecting or harvesting personal data of other users from the Platform without authorisation

ENFORCEMENT

Violation of any of the above terms may result in immediate account suspension or permanent termination without notice, removal of accumulated points, and where the conduct constitutes a criminal offence, referral to the relevant law enforcement authorities in the applicable jurisdiction. D Points App reserves the right to co-operate fully with any lawful investigation.

15Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

Get in touch

For grievances under India’s DPDPA, you may contact our Grievance Officer at the email below. We will acknowledge within 48 hours and resolve within 30 days.

D Points App
EMAIL · business@dpointsapp.com
WEBSITE · dpointsapp.com
OPERATED BY · 28SPIDER TECHNOLOGIES, UAE

This Privacy Policy was drafted to comply with UAE PDPL (Federal Decree-Law No. 45 of 2021), India DPDPA 2023, Malaysia PDPA 2010, Singapore PDPA 2012, and international best practices including GDPR standards. Last updated 25 April 2026.