Privacy Policy

1. Who we are

Machiavelli Marketing L.L.C., trading as Loyalla, is the controller of the personal data described in this policy. Its business address is Office G06-434, The Exchange Tower, Al Mustaqbal Street, Business Bay, Dubai, United Arab Emirates. For privacy matters, contact viralapp@hotmail.com.

2. The data we collect

We collect only what the programme needs to work:

• Apple account identifier or email address — used to create and secure your membership. Apple may provide a private relay email address.
• Mobile number — optional, collected when you choose WhatsApp communications or add it to your profile.
• Name — so venues can welcome you properly and staff can confirm they are serving the right member.
• Birthday — if it is already part of your membership profile. No birthday reward is active at launch.
• Preferred language and communication choices.
• Transaction history — the venue, date, bill reference and eligible amounts recorded by staff, your Use now or Double it choice, and points earned, redeemed, expired or corrected.
• Device identifier and push notification token, stored if device-level notification permission is granted, so the app can deliver notifications when your in-app push preference is also enabled.
• Support correspondence, when you contact us.

3. Why we use your data

• To operate your membership: one points balance across participating venues, including calculating points, applying the six-month expiry, and honouring redemptions.
• To verify transactions and prevent fraud, including staff verification of the paid bill at the venue and risk checks on unusual activity.
• To send available service communications about your account and points choices, where the channel is enabled.
• To send marketing communications, only on the channels you have consented to (see section 4).
• To produce internal accounting reports by funding venue from points transactions. The app does not process payments or settle venue accounts.
• To comply with legal, tax and audit obligations in the United Arab Emirates.

4. Marketing consent, channel by channel

Push and WhatsApp choices are presented during signup, are optional and are off by default. Consent is stored separately for each channel with its purpose, policy version, source and grant or withdrawal time. Consenting to one channel never opts you into another.

You may withdraw consent at any time in the app under Settings → Notifications. Authentication messages needed to sign in are service messages, not marketing. WATI/WhatsApp marketing will remain disabled until the service and its approved message templates are launched.

5. Who we share data with

We do not sell personal data. We share it only with:

• Participating OCCO venues, so authorized staff can serve your membership and verify bills at the venue you are visiting.
• Service providers who process data on our instructions — hosting, messaging delivery, and analytics strictly for operating the programme.
• A booking provider when you open a venue's external reservation page. You enter any booking details on that provider's page, not into Loyalla's points system.
• Public authorities, where the law of the United Arab Emirates requires it.

6. How long we keep data

We keep your profile and points ledger while your membership is active.

When your account is deleted, personal data is erased or irreversibly anonymised, except for records we need to retain for legal, tax or audit obligations. Those records are limited to those purposes; contact us for details of the applicable retention period.

7. Security

Data is encrypted in transit. Staff access requires an authorized account; staff actions on member points are logged and auditable.

8. Your rights

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you have the right to access the personal data we hold about you, to correct it, to ask for it to be deleted, and to withdraw any consent you have given. To exercise any of these rights, use the app or write to viralapp@hotmail.com. We respond to every request.

9. Deleting your account

You can delete your account yourself, in the app, at any time: Settings → Delete account. Deletion is permanent and any remaining points are forfeited, as points have no cash value. You do not need to call anyone or give a reason.

10. Age

Loyalla membership is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone younger.

11. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change takes effect. The date at the top always shows the current version.

12. Contact

For anything relating to your personal data: viralapp@hotmail.com.