Privacy Policy

ZUBUN (part of RENTOLIC Group) provides a mobile customer-loyalty and staff time-&-attendance service for venues in the United Arab Emirates. This policy explains what personal data we process and how. We handle data in line with the UAE Personal Data Protection Law (PDPL). For loyalty data, the venue is the data controller and ZUBUN is the processoracting on the venue's behalf.

• Venue owners: name, business name, email, phone, and billing details (billing is processed by Stripe — we do not store card numbers).
• Customers (loyalty members): phone number, optional name, and — if they use the ZUBUN app — email address and Apple sign-in identifier. We also process marketing opt-in status, stamps/points, visits, rewards, optional birthday, optional feedback ratings, and a push notification token used to deliver alerts to their device.
• Staff: name, a hashed PIN, a device identifier (for clock-in security), shifts and attendance records, and clock-in/out photos used to verify presence.
• Technical: log and usage data needed to operate and secure the service.

To run the loyalty program (issue stamps/points and rewards), send service and — only with opt-in — marketing notifications, keep loyalty cards updated in Apple Wallet, manage staff scheduling, attendance and payroll records, provide analytics to the venue, and keep the service secure. We do not sell personal data.

Notifications are delivered as push notifications to the ZUBUN app through the Apple Push Notification service (APNs). Customers opt in to marketing notifications and can opt out at any time in the app's settings; essential messages relate only to their own loyalty activity (for example, a stamp added or a reward earned). Customers may also add their loyalty card to Apple Wallet, which updates automatically as they earn.

We share data only with the infrastructure providers that run the service, acting under our instructions: Supabase (database/storage), Vercel (hosting), Apple (push notifications and Apple Wallet passes), and Stripe(billing). We may disclose data where required by law.

We keep personal data while the venue's account is active. Clock-in/out photos are stored privately and auto-deleted after 60 days. On account closure or a valid erasure request, data is deleted or anonymised except where the law requires us to retain it.

Subject to UAE PDPL, individuals may request access to, correction of, or erasure of their personal data. Customers can opt out of marketing at any time in the app settings, and can request erasure from within the app or by contacting the venue; owners and others can contact us at info@zubun.io. We respond within a reasonable period.

Data is encrypted in transit, access is restricted by role-based controls, and sensitive secrets are never exposed to client devices. No system is perfectly secure, but we take reasonable measures appropriate to the data we hold.

We may update this policy and will revise the date above. Questions or requests: info@zubun.io. See also our Terms & Conditions.