Privacy Policy

1. Who we are

This policy explains how Athar Al-Sa’i Company (شركة أثر السعي), the operator of Cardy, collects, uses and protects your information, and what control you have over it.

For anything about your data, write to info@cardyiq.com or call +964 777 500 5603.

2. What this policy covers

It covers the Cardy app and the services behind it.

It does not cover a partner venue's own systems, for example its own membership records or cameras, or the licensed payment providers you pay through. Those are governed by their own policies.

3. Information you give us

• Your phone number, verified with a one-time code sent by SMS. This is what identifies your account.
• Profile details you choose to add: name, date of birth, gender and profile photo.
• What you submit in the app: reviews, problem reports and any screenshots attached to them, and your messages to support.
• The choices you make when paying, such as the payment method and the package you select.

4. Information collected automatically

• Device and app data: platform, app version, app language, a device identifier, the push token if you allow notifications, and when you were last active.
• Your activity in the service: scans and visits, points and wallet movements, subscriptions, favourites, recent searches, goals and streaks.
• Technical records: request and error logs, crash diagnostics, and the network address your requests come from. We use these for security, fraud prevention and fixing faults.

5. Location

With your permission, the app uses your device's location while it is open, to show venues near you and sort them by distance, and it records the city and country your session started in.

• Cardy does not track your location in the background or when the app is closed.
• You can turn location off in device settings; nearby venues and distance sorting will then stop working.

6. Payment information

Payments are handled by licensed payment providers. Cardy does not receive or store your card number, wallet PIN or banking credentials.

We do keep the record of each transaction (amount, currency, method, status, provider reference and time) because it is your receipt and our accounting record.

7. How we use your information

• To create your account, sign you in and keep the account secure.
• To confirm your entry at a venue and record the visit and the points it spent.
• To sell and deliver points and venue subscriptions, and to settle with venues.
• To provide support, investigate reports and handle refunds.
• To send service messages and, if you allow notifications, offers.
• To detect and prevent fraud, abuse and unauthorised access.
• To see which features are used, so we can improve them.
• To meet our legal, tax and accounting obligations.

We do not use your data to make automated decisions that have a legal effect on you.

8. When we share information

We do not sell your personal data. We share it only in these cases:

• Partner venues: what is needed to confirm and record your visit or subscription (see the next section).
• Payment providers: what is needed to process and reconcile your payment.
• Providers that run parts of our service under contract: Firebase for crash diagnostics and push delivery, and NotifyX for notifications. They receive your Cardy user ID, app language, device ID, platform and push token, never your payment details.
• Microsoft Clarity, to understand how the app is used: it records how screens are used, such as taps, scrolls and screen views, so we can find and fix problems.
• Meta (Facebook), to measure our advertising: we send events such as sign-up, purchases and visits, with your user ID and phone number in hashed form. On iPhone they are used for ad tracking only if you allow tracking when the app asks.
• Authorities or our legal advisers, where the law requires it or where it is necessary to establish or defend a legal claim.
• A successor, if the business is reorganised or transferred, with this policy continuing to apply.

9. What partner venues see

A venue sees only what it needs to admit you and to be paid: that your entry is valid, the visit or subscription it belongs to, your name, and the last 4 digits of your phone number.

• Your full phone number is not shown to venue staff, and it is never shown to other members.
• Venues do not receive your payment details, your points balance history at other venues, or your location.

10. Notifications

Push notifications need a token issued by your device. We store it with your device record and use it to deliver visit, payment and subscription updates, service messages and offers.

You can turn notifications off at any time in your device settings. You may still receive essential messages such as one-time sign-in codes by SMS.

11. How long we keep information

• Account and activity data is kept while your account exists.
• Deactivating your account does not erase it: access stops, your phone number stays reserved to you, and the records stay so that visits, payments and settlements with venues remain accurate.
• Financial records are kept for the period Iraqi tax and commercial law requires.
• Technical logs and crash diagnostics are kept for a short period and then removed or aggregated.
• You can ask us to erase data we are not required to keep (see the next section).

12. Your choices and your rights

• View and update your profile in the app at any time.
• Turn location, camera and notification permissions on or off in your device settings.
• Deactivate your account from the app whenever you want.
• Ask us for a copy of your data, for a correction, or for erasure of what we are not legally required to keep, by writing to info@cardyiq.com with the phone number on your account.

We answer these requests within 30 days and may ask you to confirm your identity first.

13. How we protect your information

• Traffic between the app and Cardy is encrypted in transit.
• Signing in uses one-time codes, and supported devices can use a passkey kept securely on the device itself.
• Access to production data is limited to staff who need it, and sensitive actions are logged.

No system is perfectly secure. If a breach affects your data, we will act on it and inform you as the law requires.

14. Children

Cardy is for people aged 15 and over. We do not knowingly collect data from anyone younger. If we learn that an account belongs to someone under 15, we deactivate it and remove the data we are not required to keep.

15. Where your data is processed

Cardy operates in Iraq. Some of the providers we rely on, for example crash reporting and push delivery, process data on servers outside Iraq. We only use providers that commit to protecting the data they process for us, and we share the minimum they need.

16. This website

cardyiq.com is an information site. It sets no cookies and runs no analytics or advertising trackers.

• Our web server keeps standard access logs (network address, browser and the page requested) for a short time, for security.
• The contact and venue forms do not send anything to our servers. They open WhatsApp or your email app with your message filled in, and nothing leaves your device until you press send there.
• The venue map on the home page loads public venue details (name, place, price, photo) from our servers and the map itself from OpenFreeMap (map data © OpenStreetMap contributors). Your browser contacts those servers directly, so they see your network address, and it may keep a copy of map tiles so the map loads faster. The "my location" button asks your browser for your position only when you press it; it is used on your device to centre the map and show distances, and it is not sent to us.
• Links to the App Store and Google Play take you to those stores, which have their own privacy policies.

17. Changes to this policy

We may update this policy. The version shown in the app is always the current one, with its effective date. If a change materially affects you, we will highlight it in the app or send a notification.

18. Contact us

Athar Al-Sa’i Company (شركة أثر السعي)

• Email: info@cardyiq.com
• Phone and WhatsApp: +964 777 500 5603

Write to us about anything in this policy, or from Help in the app.