Privacy Policy — CardWafir

Effective date: 21 June 2026 · Last updated: 16 July 2026

This Privacy Policy explains how Bytxpedition (“we”, “us”, “our”) collects, uses, shares, and protects your information when you use the CardWafir mobile application (the “App”). By using the App, you agree to the practices described here.

If you do not agree with this policy, please discontinue use of the App.

1. Who we are

CardWafir is an informational app that aggregates and displays bank, credit-card, and merchant offers available in the United Arab Emirates. The App is operated by Bytxpedition. We act as the data controller for the personal information described in this policy.

2. Information we collect

We collect the following categories of information:

a) Account information

If you sign in with Google, we receive your name, email address, profile photo, and profile identifier from Google via Firebase Authentication to create and secure your account.
You may also use parts of the App as a guest, in which case a randomly generated, non-identifying guest identifier may be used.

b) Profile & preferences

Your selected interests/categories, saved/favorite offers, and recently viewed offers.
App settings such as theme and notification preferences.

c) Saved card information

Limited card metadata you choose to add: bank name, card name/product, card network (e.g., Visa/Mastercard), and an optional payment due date and reminder preferences.
We do not collect or store full card numbers, CVV/security codes, PINs, expiry dates, or any payment credentials. See section 3.

d) Device & technical information

Device model, operating system and version, app version, and platform (iOS/Android).
If you enable notifications, a push notification token issued by Google Firebase Cloud Messaging, used solely to deliver notifications to your device.
Diagnostic and crash data (see section 7 — Sentry), which may include device state, error/stack-trace details, and approximate technical identifiers such as IP address at the time of an error.

e) Usage & activity data

In-app actions such as offers viewed, searches, filters applied, and features used, which help us improve the App. This data is associated with your account or guest identifier.

f) Location data

If you grant location permission, we access your device’s approximate or precise location to show offers near you (“Nearby”) and may attach an approximate reading to your app session. See section 8.

g) Feedback & reviews

Any feedback, reports, or messages you choose to submit through the App.
Ratings and review text you choose to submit about offers.

3. About your saved cards

Important: The App is an offers aggregator, not a payment app. When you “add a card,” you are only saving non-sensitive metadata (bank name, card product name, network, and optional due-date reminders) so we can match relevant offers to you. We never ask for or store your full card number, CVV, PIN, or expiry, and we cannot make payments or access your bank account.

Card metadata is stored locally on your device and, if you are signed in, synced to your account on our backend so it is available across your devices.

4. How we use information

To provide, operate, and personalize the App (e.g., matching offers to your saved cards and interests).
To authenticate you and keep your account secure.
To send notifications you have enabled (e.g., payment-due and offer-expiry reminders).
To show location-based offers when you use Nearby.
To diagnose crashes, monitor stability, and improve performance and features.
To respond to your feedback and support requests.
To comply with legal obligations and enforce our terms.

We do not sell your personal information.

5. Legal bases (where applicable)

Where data-protection laws such as the EU/UK GDPR or the UAE Personal Data Protection Law apply, we process your information under one or more of the following bases: consent (e.g., location, notifications), performance of a contract (providing the App you requested), legitimate interests (improving and securing the App), and legal obligation.

We share information only as follows:

With service providers/processors who operate the App on our behalf (section 7).
To comply with the law, respond to lawful requests, or protect rights, safety, and security.
In connection with a business transfer (merger, acquisition, or asset sale), subject to this policy.

7. Third-party service providers

We rely on the following providers, who process data on our behalf under their own privacy terms:

Provider	Purpose	Data involved
Google Firebase (Authentication & Cloud Messaging)	Account sign-in and delivery of push notifications	Name, email, profile photo, profile identifier, push notification token
Supabase	Backend database and server functions (offers, preferences, favorites, sync)	Account identifier, preferences, saved-card metadata, favorites, reviews, activity
Sentry	Crash & error monitoring	Device/OS/app info, error details, IP at time of error
wsrv.nl (images.weserv.nl)	Image resizing proxy for faster, lighter offer images	Requested image URL and technical request data (e.g., IP); no account data
Map/tile provider	Displaying the Nearby map	Approximate location, technical request data

We encourage you to review these providers’ privacy policies for details on their processing.

8. Location data

Location access is optional. If you grant permission, your location is used for the Nearby feature to display offers around you, and an approximate location reading may also be attached to your app session to help us understand regional usage. You can grant or revoke location permission at any time in your device settings. If you deny permission, Nearby may be unavailable or limited, but the rest of the App continues to work.

9. Notifications

With your permission, the App sends notifications of two kinds: local reminders scheduled on your device (e.g., payment-due and offer-expiry reminders) and push notifications about offers, delivered via Google Firebase Cloud Messaging using a device push token. You can disable notifications at any time in the App settings or your device settings.

10. Data retention

We keep personal information for as long as your account is active or as needed to provide the App, and thereafter only as required for legitimate business or legal purposes. Diagnostic/crash data is retained for a limited period for stability analysis. You can request deletion at any time (section 14).

11. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS/TLS), authenticated access, and provider-side access controls. Card metadata stored on your device remains under your device’s own security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. International transfers

Your information may be processed and stored on servers located outside your country of residence (for example, in the European Union or other regions used by our providers). Where required, we rely on appropriate safeguards for such transfers.

13. Your rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you;
Correct inaccurate or incomplete information;
Delete your information (“right to be forgotten”);
Object to or restrict certain processing;
Withdraw consent (e.g., for location or notifications);
Request a copy of your data (portability);
Lodge a complaint with a data-protection authority.

To exercise any of these rights, contact us using the details in section 18.

14. Deleting your data

You can delete saved cards and preferences within the App. To request deletion of your account and associated personal data, email us at support@bytxpedition.com with the subject “Data Deletion Request.” We will verify your request and delete the data within a reasonable period, subject to any legal retention requirements.

15. Children

The App is not directed to children under the age of 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

16. Third-party offers & links

Offers displayed in the App originate from banks, financial institutions, and merchants. Offer details are subject to change at their discretion, and the App does not independently verify or endorse them. Links to third-party websites are governed by those parties’ own privacy policies and terms; we are not responsible for their practices.

17. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you in the App. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.

18. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, contact us at:

Email: support@bytxpedition.com
Website: https://bytxpedition.com/

Contents