Qtap is a loyalty app. You collect stamps and points at cafés, salons, gyms and other independent businesses in Qatar, and you trade them for rewards. This document explains what we do with your personal data when you use the app.
Qtap is operated from Doha, Qatar. Our offices are at Flare Business Center, Level 25, Manarat Lusail, Lusail, Qatar. The legal entity behind Qtap, and the controller of your personal data for the purposes of this policy, is Qtap Loyalty LLC (Delaware, USA).
You can reach us at:
This policy is written to comply with Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016, the "PDPPL"), the EU General Data Protection Regulation ("GDPR"), and comparable data protection laws.
This policy applies to you if you are:
If you are a business using the Qtap Dashboard, a different policy applies, published at qtap.qa/privacy-policy.
A shorter version of this policy is shown inside the app under Support and legal information. Where the two differ, this page is the current one.
When you create an account
When you use the app
If you joined from a QR code on the web
Some merchants let you join their programme from a poster or counter QR code without downloading the app. On that route we collect the phone number and any optional details you type on the enrolment page. There is no verification code on the web path, so a number entered there stays unverified until the first time someone signs in to the app with it.
The app asks for your location only while it is open, and only at approximate accuracy (roughly 100 metres, not precise navigation-grade positioning). We never ask for background location, and the app cannot see where you are when it is closed.
Your coordinates are sent to our server so it can work out which merchants are near you and how far away they are. That calculation happens in the moment and the result is not written to our database. We do not keep a record of where you have been.
There is one exception, and it is one you choose: when you suggest a new merchant, you can tap "Use my current location" to attach coordinates to the suggestion. Those coordinates are saved with the suggestion. You can remove them before sending.
| Permission | Why we ask | What happens if you say no |
|---|---|---|
| Camera | To scan a merchant's QR code so you can collect stamps and points | You can still tap a tag or type a code by hand |
| NFC | To read the Qtap tag on a merchant's counter | You can still scan the QR code or type a code |
| Location (while using the app) | To show nearby merchants on the map and sort them by distance | The map still works; merchants are just not sorted by distance |
| Photo library | To let you pick a profile picture | You keep the default avatar |
Two things worth saying plainly. The camera reads the barcode and nothing else: no photograph is taken, kept or uploaded when you scan. And when the app reads an NFC tag, it reads the web address written on the tag, not the tag's hardware serial number.
Under the PDPPL and the GDPR we have to tell you the legal basis for each use.
| What we do | Legal basis |
|---|---|
| Running your account and letting you sign in | Contract |
| Keeping your stamps, points, vouchers and reward history accurate | Contract |
| Showing your loyalty activity to the merchant so they can honour it at the counter | Contract |
| Sending you notifications about stamps earned, rewards unlocked and rewards about to expire | Contract |
| Sending you offers and marketing from merchants you have joined | Consent, off unless you turn it on |
| Showing you merchants near you | Consent, through the location permission |
| Preventing fraud and abuse of loyalty programmes | Legitimate interest |
| Keeping the service secure and diagnosing faults | Legitimate interest |
| Improving the app using aggregated usage data | Legitimate interest |
| Meeting tax, accounting and record-keeping obligations | Legal obligation |
You can withdraw consent at any time. Turn off marketing with the "Offers and updates from merchants" switch on the Account screen, mute an individual merchant in Settings, or turn off notifications entirely. Withdrawing consent stops that use from then on and does not undo anything that already happened.
Qtap is a two-sided service. When you join a merchant's loyalty programme, you are starting a relationship with that business, and they need to be able to recognise you at the counter and honour what you have earned. Staff at a merchant you have joined can see:
They can also attach their own private notes and tags to your record, in the way a shop might write something on a customer card.
What they cannot see is anything about your life at other merchants. Your balance at the café down the road, and even the fact that you have joined it, stays invisible to them. Each merchant sees their own slice and only their own slice.
A merchant only gets this access once you have joined their programme. Browsing a merchant's page, or walking past their shop, gives them nothing.
Merchants agree to a Data Processing Addendum that limits what they may do with this information, including a ban on using it for anything other than running their loyalty programme, and an obligation to act on deletion requests we pass to them.
We use a small number of companies to run the service. They act on our instructions and are bound by written data processing agreements.
| Who | What they do | Where |
|---|---|---|
| Supabase Inc. | Hosts our database, file storage and backend functions | Japan (AWS Asia Pacific, Tokyo) |
| Google, as Firebase Authentication | Sends the one-time code that signs you in, and holds your sign-in record | United States and global infrastructure |
| Google, as Firebase Crashlytics | Anonymous crash and error reports from the app, used to find and fix bugs; crash reports are not linked to your account | United States and global infrastructure |
| OneSignal | Delivers push notifications | United States |
| Apple | Delivers push notifications on iPhone, and updates Apple Wallet passes | United States and global infrastructure |
| Google, as Google Wallet | Creates and updates Google Wallet passes | United States and global infrastructure |
| Google, as Google Maps and Google Places | Map tiles on Android, and public information about merchants such as opening hours and ratings | United States and global infrastructure |
| Apple, as Apple Maps | Map tiles on iPhone | United States and global infrastructure |
| Expo | Delivers app updates. Your device contacts Expo on launch to check for one | United States |
What each of them actually receives is narrower than you might expect. OneSignal gets the push subscription for your device, your Qtap ID, your language, whether you have any stamps or points, and the text of the notification. It does not get your name, phone number or email. Google Places is queried about the merchant, never about you. The map providers receive the map requests your device makes.
We do not sell your personal data. We do not share it with advertising networks or data brokers. We do not share your data with merchants you have not joined.
We will disclose data when a court or a competent regulator orders us to, when the law obliges us to report something, or when someone's safety is at risk. Where we are permitted to tell you, we will.
If Qtap is acquired or merges with another company, your data may transfer as part of the business. We will tell you before that happens and you will have the chance to delete your account first.
The Qtap app contains no analytics SDK, no advertising SDK, and no attribution or tracking library of any kind. Crash reporting is limited to the anonymous Firebase Crashlytics reports described in section 6. We checked this against the app's full dependency list, not just our intentions.
The usage statistics we do keep, such as which merchant pages get opened, are recorded in our own database and are used to make the app better.
Your data is processed in Qatar, Japan, the United States and the European Union, depending on which provider is handling it at the time. Our main database sits in the Asia Pacific (Tokyo) region.
Transfers outside Qatar are protected by:
If you are in the European Economic Area, the United Kingdom, or anywhere else with strict cross-border rules, email privacy@qtap.qa and we will send you the specific safeguards for any transfer.
| Category | Retention |
|---|---|
| Account and profile data | While your account is active |
| Stamps, points, vouchers and visit history | While your account is active, then anonymised (see section 10) |
| Push notification token | While your account is active, or until you turn notifications off |
| Location coordinates used to find nearby merchants | Not retained; used in the moment and discarded |
| Details you attach to a merchant suggestion, including any coordinates or email | Kept with the suggestion while we evaluate whether to approach that business |
| Support messages | 3 years after the last interaction |
| Marketing consent records | 3 years after withdrawal |
You can delete your account yourself, from inside the app, without asking us. Open the account tab, go to Settings, tap Delete account, then tap "Delete your account" at the bottom of the Account screen and confirm.
Here is exactly what happens.
Straight away. Your account is marked for deletion and you are signed out. Push notifications stop.
For the next 30 days. Nothing is erased. If you sign in again with the same phone number during this window, your account is restored with your cards and balances intact.
After 30 days. Deletion becomes permanent and cannot be reversed. At that point:
What survives, and why. Your past transactions stay in each merchant's records, detached from your identity and labelled as a deleted user. Merchants need those rows to balance their own books and meet their tax obligations, in the same way a shop keeps its till receipts after a customer has gone. Those records can no longer be traced back to you.
Wallet passes on your phone. If you added a loyalty card to Apple Wallet or Google Wallet, delete the pass from Wallet yourself. Deleting your Qtap account clears the pass from our side, but a copy already installed on your device stays there until you remove it.
If you joined on the web and never installed the app, there is no in-app screen for you to use. Email support@qtap.qa and we will delete the membership.
Under the PDPPL and the GDPR you have the right to:
Email privacy@qtap.qa to exercise any of these. We respond within 30 days. If your request is complicated we may take another 30 days and will tell you why.
Some of your rights touch data held by a merchant you joined. When that happens we pass your request on to them, and they are contractually required to act on it within 7 days.
One honest note about profile photos: your picture is stored at a web address that is long and unguessable, but that address is not itself access-controlled. Anyone who obtains the link can view the image. Do not use a photo you would not be comfortable being seen.
Your phone number is the key to your account. If you change numbers, update it in the app before you give up the old one, and tell your mobile operator promptly if you lose your SIM.
Qtap is a general audience app. It is not directed at children, we do not market it to them, and we do not knowingly collect personal data from anyone under 13.
If you are under 18, you should have a parent or guardian's permission before creating an account. If you believe a child has created an account, email privacy@qtap.qa and we will remove it.
When something material changes we will:
Minor edits such as typos and formatting go live immediately.
For help with the app itself, including how to delete your account, see qtap.qa/support.
If you would rather contact the Qatar regulator directly, the NCGAA can be reached at https://assurance.ncsa.gov.qa.