Privacy Policy

This policy explains what personal data WorldRetail collects, why, who we share it with, and the rights you have. It applies to members, visitors and the people who manage businesses on WorldRetail.

Who is responsible for your data

World Retail Group LLC is the controller of the personal data described in this policy. WorldRetail is operated by World Retail Group LLC, a limited liability company registered in the Sharjah Media City Free Zone (Shams), United Arab Emirates, licence number 2648691.01, with its registered address at Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab Emirates.

Questions or requests: privacy@worldretail.group.

What we collect

Account information. Your name, email address and password (stored only as a one-way hash), your member number, your chosen country and home city, and, if you sign in with Google, your Google account identifier and verified email address.

Membership and payments. Your plan, trial and renewal dates, payment status, invoices and refunds. Card details are collected and stored by our payment provider, Stripe; we receive only limited details such as the card brand and the last four digits.

Pass and redemptions. When you use an offer: the business, location, offer, time, reference number, the redemption method, the estimated saving and, if staff entered it, your bill amount. We also record pass scans, including failed or reused codes, to protect members and businesses from misuse.

Location. Only when you tap "Near me" or "Use my location". Your browser shares your approximate position for that search. We do not store it in your account.

Saved items, preferences and messages. Offers and businesses you save, your notification settings, the notifications we send you, and emails you send to us.

Device and security information. Your browser type, and a keyed hash of your IP address (not the address itself) used for rate limiting, fraud prevention and security records.

Product analytics. Which pages and features are used, searches you make, and actions such as saving or redeeming an offer. For visitors who are not signed in, we use a random identifier only if you choose "Allow" in the cookie banner.

Business users. If you manage a business on WorldRetail: your name, email, role, the business details you provide, and the actions you take in the business dashboard.

Why we use it

• To provide the service you signed up for (contract): running your account and membership, showing your pass, confirming redemptions, taking payments, sending service and receipt emails, and customer support.
• To keep WorldRetail safe (legitimate interests and legal obligation): preventing pass sharing, fraud, scraping and abuse; securing accounts; keeping audit records of administrative actions.
• To improve WorldRetail (legitimate interests, or consent for anonymous visitor analytics): understanding which features and offers are used, and fixing problems.
• To send updates you asked for (consent): new offers from businesses you saved, offers near you, and occasional WorldRetail news. You can change these in Account → Notifications at any time. Messages about your membership and payments are always sent.
• To meet legal and tax obligations (legal obligation): keeping financial records and responding to lawful requests from authorities.

We do not sell your personal data, and we do not use it for third-party advertising.

Automated checks

To prevent pass sharing and fraud, our systems look for unusual patterns, such as many redemptions in a short time or redemptions in two cities too far apart to travel between. These checks can flag a redemption for review. They never close or suspend an account on their own: a person at WorldRetail reviews flagged activity before any action is taken.

Who we share it with

Participating businesses. When you redeem an offer, the business sees your name, member number, membership tier and status, and the details of that redemption. Businesses may only use this to confirm redemptions and keep their own records. Under our Merchant Terms they may not use it to contact or market to you.

Service providers who process data for us, under contracts that limit their use of it:

• MongoDB, Inc. (MongoDB Atlas): database hosting
• Stripe: payments and billing
• Netlify: website hosting, file storage and scheduled tasks
• Resend: sending email
• Google: sign-in, only if you choose "Continue with Google"
• Sentry: error monitoring, if enabled
• OpenFreeMap: map tiles; your browser requests map images directly from their servers, which see your IP address

Others, when required. Courts, regulators or law enforcement where the law requires it, and a buyer or successor if WorldRetail is reorganised or sold, under the same protections.

International transfers

WorldRetail serves members in many countries, and our providers run servers in several regions. Your data may therefore be processed outside the country where you live, including in the United Arab Emirates, the European Union and the United States. Where the law requires it, we use recognised safeguards for these transfers, such as standard contractual clauses.

How long we keep it

• Account and saved items: while your account is open. When you delete your account we remove your name and email straight away.
• Redemption and payment records: for 6 years, for accounting and tax purposes. After account deletion they are kept without your name or email.
• Product analytics events: 13 months.
• Pass scan records and email delivery logs: 30 days.
• Sign-in sessions: up to 30 days of inactivity.
• Notifications: 180 days.

How we protect it

Passwords are hashed with a memory-hard algorithm, sign-in tokens are stored only as hashes, connections use HTTPS, and access to personal data inside WorldRetail is limited by role and recorded in an audit log. No system is completely secure; if a breach affects your data, we will tell you and the relevant authorities where the law requires.

Your rights

Depending on where you live, you can:

• ask for a copy of your data, or for it in a portable format
• correct inaccurate data (most details can be changed in Account → Settings)
• delete your account and data (Account → Settings → Delete account), subject to the records we must keep
• object to or restrict certain uses, including product analytics
• withdraw consent at any time, for example to marketing emails or analytics
• complain to a data protection authority

To use these rights, write to privacy@worldretail.group. We reply within 30 days and may need to confirm your identity first.

WorldRetail processes personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). If you are in the European Union or the United Kingdom, the GDPR or UK GDPR also applies, and you may complain to your local supervisory authority.

Children

WorldRetail is for adults. You must be 18 or over to create an account, and we do not knowingly collect data from children. If you think a child has given us personal data, contact privacy@worldretail.group and we will delete it.

Cookies

We use one essential cookie to keep you signed in and a few others for specific features. Details are in our Cookie Policy.

Changes

We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the app before it applies.

Contact

World Retail Group LLC, Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab Emirates. Privacy: privacy@worldretail.group