What we collect about you, why, and who can see it.
We keep the least we need to run your stamp card: your name, how you sign in, your stamps at each shop, and a log of every stamp.
We do not sell your information, rent it, show you third-party advertising, or put trackers or analytics on the site.
The shop where you collect stamps sees your name, your mobile number if we hold one, and your visit history at that shop. It does not see your email, it does not see the IP address the request came from, and it sees nothing from any other shop.
A shop may leave a reminder on your card if you have been away a while. You can stop it with one tap from your card page, for each shop separately.
Our servers are currently outside the Kingdom, in Ireland. That is stated plainly here because it is your business, and section 8 explains it.
You may see your information, correct it, and delete your account yourself from your card page. We answer within 30 days, at no cost.
If our answer does not satisfy you, you may complain to the Saudi Data & AI Authority (SDAIA).
The party responsible for your information in this service is 9Pass.
For anything about your information — access, correction, destruction, objection or a complaint — write to nine9pass@gmail.com. A person reads that channel, and we answer within 30 days.
For anything else, write to nine9pass@gmail.com.
What we do: a digital loyalty card for small shops in Saudi Arabia. A customer registers once, their card is added to the wallet on their phone, and they then collect stamps when a staff member scans their card code in the shop's app.
A customer does not need to install an app, on iPhone or on Android.
The Saudi Personal Data Protection Law applies to your information wherever it is processed, including when the servers sit outside the Kingdom.
Two parties handle your information, each with a different role. Knowing which one to ask saves you time.
The shop. It decided to run a loyalty card, it sets the reward and the number of stamps, and it sees its own customers in its own app. Your stamps, your visits and your reward at that shop are the shop's business first, and it answers for what it does with them inside its app.
9Pass. We build and run the software, we hold the database, and we issue the wallet card.
We also decide how the platform works: how many stamps can be earned in a day, how long data is kept, where it is kept, and what a shop can see. Because we decide those things we answer for them in our own right under the Law, not as someone carrying out the shop's instructions.
We do not ask shops for lists of numbers and we do not import them. Every customer in 9Pass registered themselves, through 9Pass.
Your account. How you sign in with Google or Apple, which brings your email and their account id — required, because it is what proves the card is yours. Your mobile number if you registered with one. A name for your card to greet you by, which is optional; without it the card prints "Member". And your preferred language.
Your card and your stamps. How many stamps you hold at each shop, how many rounds you have completed, the time of each stamp, every reward you redeemed, every gift you won on a stamp — when and at which branch you won it and collected it — and who added the stamp: which staff member, and whether they scanned your card code or added it by hand. Required — this is the card itself.
The stamp log. For every stamp attempt: the time, the shop, who added it, and the outcome. Refused attempts are logged too — one inside the gap between stamps, or past the daily limit — which is what protects your balance from being forged against you. It is not collected by your choice; the act of stamping generates it.
Where a shop collects stamps through an NFC sticker the customer taps, the stamp request reaches us from your own phone, and the sticker's id and counter, your device's IP address and your browser or system type are recorded with it.
Your wallet card. A serial number for the card, a key that lets your phone refresh it, and your device id and Apple push token so your phone wakes up when a stamp lands. Collected only if you add the card to your wallet.
Your session. A signed cookie on your phone carrying your account id, so the site knows you on your next visit without making you sign in again.
A verification code. If you registered with your mobile number, we generate a one-time code valid for five minutes.
Your acceptance of the terms. We record when you accepted and which version.
Your reminder choice. If you switch a shop's reminders off, we store that choice for that shop.
Your visit rhythm. From your stamps we work out the typical gap between your visits to each shop, so we can tell when you have been away longer than is usual for you. That is what the shop reminders in section 11 rest on.
We do not collect your date of birth, your gender, your location, your contacts, your photos, or any payment details. We do not ask for them.
If you withhold what is marked required above, a card cannot be issued. Withholding what is optional costs you nothing except being addressed as "Member".
Directly from you: your name, your language, your reminder choice, your acceptance of the terms, your agreement to sign in with Google or Apple, and your mobile number if you registered with one.
Indirectly:
From what you do in the service: every stamp a staff member adds generates a record by itself, and so does every stamp attempt that is refused. Nothing is asked of you at that moment, which is why it is named here explicitly.
From your device: your IP address and browser type arrive with every request, as with any website.
From Google or Apple: your email and their stable account id, and only if you chose to sign in through them. We never see your password with them.
From your phone, through the wallet: your phone registers your card with us, which is how we receive the device id and push token, and that is what lets the card refresh itself.
We buy data from nobody, and we accept no customer lists from shops.
The Personal Data Protection Law requires a lawful basis for each purpose, from a list the Law itself fixes. This is how they divide here.
Running your card: in implementation of an agreement to which you are a party — the one you entered when you registered. Creating your account, holding your stamps, issuing and refreshing your wallet card, and redeeming your reward are all impossible without it.
Protecting your balance from forgery: our legitimate interest, which does not conflict with your rights. The stamp log, the staff-code attempts and the daily stamp limits exist to stop anyone forging a stamp or taking a reward that is not theirs. We do not use this data for any other purpose.
Shop reminders: see section 11.
Alerting staff when a stamp lands: the same agreement, since a reward cannot be handed over unless the staff member knows who is in front of them.
If we want to use your information for a new purpose that is not on this page, we will tell you before we start, not after.
You. You see your card, your stamps and your shops on your card page, and your card in your phone's wallet.
The shop owner and its staff, for their own shop's customers only: your name, your mobile number if we hold one, your stamp count, and your visit, reward and gift history there. They can see that a stamp attempt happened and how it turned out, but not the IP address or device type it came from — those are withheld from them and readable only by us.
The shop does not see your email, your Google or Apple account id, your card key, your phone's push token, or anything at all from another shop.
These are not promises in prose: the database itself refuses those columns to a shop, so the restriction holds even if our own program asks for them by mistake.
Us. A small number of the people who run the service can read the records, to the extent needed to operate it and fix faults.
A staff member cannot see a colleague's secret code, and nothing on the customer side can read your card key.
Our database and services currently run on Supabase in Ireland, inside the European Union. That means most of your information is held outside the Kingdom.
The 9Pass website itself runs on servers in Germany.
The following also leaves the Kingdom:
To Apple in the United States: your phone's push token, with a signal telling your phone that an update is waiting. That request carries neither your name nor your stamp count, but Apple does learn the time of every stamp. The Apple card itself is built and signed by us and downloaded by your phone, so its contents never pass through Apple's servers.
To Google in the United States: if you choose to add your card to Google Wallet, your name, the shop's name and your stamp count are created as a record held by Google, because a Google card lives on their servers rather than on your phone. This differs from Apple, and we say so explicitly so that one is not assumed from the other.
Google offers no way to delete that record. Their API has no delete method at all, and that is their statement rather than our inference. So when you delete your account here, we empty the record of everything that points to you — your name, your card's code, your stamp artwork and your balance — archive it, then read it back to confirm it really is empty, and keep the result of that check. What is left is an empty shell at Google carrying nothing that identifies you, and neither we nor you can remove it. Removing the card from your phone is yours to do, and it de-links the card from your wallet rather than deleting it from Google's servers.
To Expo in the United States: your name and your stamp count, inside the alert that reaches a staff member's phone on every stamp.
If you registered with your mobile number, your number and the verification code pass through the SMS provider we use, which operates inside the Kingdom.
These transfers rest on the processing of your information outside the Kingdom being necessary to provide the service to you, and we are completing the contractual safeguards SDAIA requires for transfers outside the Kingdom with each provider.
We do not rely on any finding that a country offers adequate protection, because SDAIA has issued no such decision.
These periods run automatically, every night. You do not have to ask, and nothing waits on someone remembering. You can still delete your account yourself from your card page at any time, or write to nine9pass@gmail.com and we will do it within 30 days.
Your account, your stamps and your reward history: while you hold a card, then 24 months from your last stamp at any shop. Because the clock runs from your last stamp with us rather than at each shop, staying active at one shop keeps your record at a shop you have stopped visiting. If you want a particular shop's history removed sooner, ask.
IP address and device type in the stamp log: 90 days, then erased while the rest of the record stays. Their usefulness against forgery is short-lived.
Your stamps themselves — the time of each one, its shop and who added it: with your card, and destroyed with it.
The record of an attempt that was not stamped — its time, its shop, its outcome: it stays after your account goes, stripped of everything that points to you, with no name, no card id and no IP address, because it is the ledger that stops a stamp being forged against anyone's account.
Staff-code attempts: 90 days.
Your wallet registration and push token: for as long as the card is on your phone. Delete it and that device's registration is removed here.
Your card's record at Google, if you added it to Google Wallet: emptied and archived on the day your account goes, not deleted, because Google gives no one a way to delete it. See section 8.
A verification code: 5 minutes.
The session cookie on your phone: 365 days, then it expires by itself.
Server logs at our hosting provider: governed by their settings rather than ours, and measured in days rather than months.
Destruction means deletion beyond recovery: rows are removed from the database, and they leave the backups as those rotate out.
We may keep aggregate figures that do not identify you, such as how many stamps were given in a month. Those are not personal data.
Every connection to the service is encrypted in transit, and the database is encrypted at rest.
Permissions are enforced inside the database itself, at the row level and at the column level, not in application code alone. One shop cannot read another shop's rows, and certain columns are withheld from every client whoever it is: the hashed staff code, your card key, and your Google or Apple account id.
Where NFC stickers are used, their keys are derived per sticker from a master key that never leaves the server environment, and every tap carries a counter that is not accepted twice, so an old tap cannot be replayed.
Staff-code attempts are limited: wrong entries on your card screen are counted per card and per IP address and repeated ones are refused, and a staff account locks after five wrong attempts at its own sign-in or on the shop's own screens. A locked staff member is refused on every path.
We do not claim this makes a breach or a forgery impossible. Nobody can promise that. What we promise is to build protection in proportion to what we hold, and to tell you if it fails.
If the shop has switched this on, and you have been away longer than is usual for you, a short note may appear on your card in your wallet.
It appears on your card. It is not an SMS and not an email. We do not sell your number to anyone and we do not use it for anything else, and 9Pass never sends you an advertisement for any other shop.
Its limits: at most two reminders per absence, 14 days apart, and nothing between 9 at night and 9 in the morning, Riyadh time. They stop by themselves the moment you visit the shop.
We treat this as part of the loyalty card you asked that particular shop for: it is a message from a shop you deal with, about your own balance, on your own card.
You can stop it whenever you like, with one tap, from your card page, for each shop separately. Free, immediate, and without losing your card or a single stamp.
Deleting the card from your wallet also stops it.
The Personal Data Protection Law gives you rights. Here they are, and how to use them.
To be informed. That is what you are reading.
To see what we hold about you, and to take a copy of it in a readable electronic format.
To correct anything wrong, incomplete or out of date, including your name, your mobile number, and your stamp balance if it is wrong.
To ask us to destroy your information, and to delete your account entirely.
To object to a shop's reminders and stop them, as in section 11.
To withdraw consent where consent was the basis, without affecting what happened before you withdrew it.
To complain, and to claim compensation for material or moral damage you have suffered.
What you can do yourself today, from your card page: see your stamps, stop a shop's reminders, and delete your account.
For anything else — full access, a copy, a correction — write to nine9pass@gmail.com. None of it costs anything.
We answer within 30 days. If your request needs longer, we will tell you and tell you why before the 30 days are up, and extend once only.
We may check that you are the person the information belongs to before handing it over. The easiest route is to ask from inside your account, where your identity is already established.
Part of a request may not be possible: the record of a stamp attempt survives deletion stripped of everything that points to you, because it is what stops a stamp being forged against someone else's account.
The same is true of your card's record at Google: we empty it of everything that points to you, archive it, and check that it really is empty, but we cannot delete it, because Google gives no one a way to.
Deleting your account here does not delete your Google or Apple account, and the reverse is also true.
Start with us: write to nine9pass@gmail.com, and we answer within 30 days.
If our answer does not satisfy you, or we do not answer, you may complain to the Saudi Data & AI Authority (SDAIA), the regulator for the Personal Data Protection Law. Complaints are filed through SDAIA at sdaia.gov.sa.
Timing matters: a complaint is normally filed within 90 days of the incident or of your becoming aware of it.
Your right to complain to SDAIA is a statutory one. Nothing on this page or in our terms takes it away.
If your information leaks or is accessed unlawfully, we notify SDAIA within 72 hours of becoming aware of it, as the Law requires.
If the breach may harm you or affect your rights, we notify you as well, without delay, and tell you what leaked, when, what we did, and what we suggest you do.
We do not ask how old you are. Registration asks no age question, we do not collect a date of birth, and we hold nothing that would tell us a customer's age.
If you are a guardian and believe we hold information about your child, write to nine9pass@gmail.com. We treat it as a request to delete that account and everything in it, at no cost, and we answer within 30 days.
We do not sell your information, rent it, or trade in it.
We show no third-party advertising, build no advertising profiles, and take part in no cross-site tracking.
There are no analytics tools, no error trackers and no advertising pixels on this site today. Fonts ship with us rather than loading from an outside network, so opening a page does not send your address to a third party. If we ever add any of that, we will say so here before switching it on.
We do not read your messages, your contacts or your location.
We make no decision about you by automated processing alone. Whether you count as lapsed is worked out by the system, but its only effect is a note on your card. It never removes a stamp or withholds a reward.
We use no sensitive data, and we do not ask for any.
The shop owner creates your account, enters your name and mobile number, and issues you a code.
Your code is stored hashed, not as text. Neither a colleague, nor the shop owner, nor we can read it.
Every stamp and every reward is recorded under your name so that it is known who did it, and the shop owner sees that.
Code attempts are recorded with an IP address, and your account locks after five wrong attempts at your sign-in or on the shop's own screens.
Your working relationship is with the shop, not with us. For anything about your account, ask the shop owner. For anything we hold, write to nine9pass@gmail.com.
We may update this page. The date of the last update appears at the bottom.
If we change what we collect, who sees it, how long we keep it, or where it goes, we will say so on your card page before it takes effect.
If we want to use your information for a new purpose, we will tell you before we start. Continuing to use the service is not consent to a new purpose.
We keep previous versions, and you may ask nine9pass@gmail.com for any of them.