In short: we use your phone number to sign you in, your membership and activity to run the club, and your device details to keep your account secure. Partner venues see what is needed to honour a redemption and anonymous totals — never your phone number. We do not sell your data, we do not show ads, and you can delete your account in the app at any time.
1. Who we are
Privium is a members club that gives members exclusive offers and loyalty rewards at partner venues, plus a monthly raffle. Privium is operated by Ahmed Alabbasi in the Kingdom of Bahrain (“Privium”, “we”, “us”), who is the data controller for the personal data described here.
This policy covers the Privium app for iPhone and Android, our website privium.online, and the partner portal at portal.privium.online. It is written to meet Bahrain's Personal Data Protection Law (Law No. 30 of 2018).
2. Information we collect
Your account
- Phone number — the main way to sign in. We verify it with a one-time SMS code. Members never set a password.
- Name — the name you give when you join or edit your profile.
- Sign in with Apple or Google — if you choose one, we receive the name and email address that Apple or Google shares with us. With Apple you can choose “Hide My Email”, in which case we receive an Apple private relay address instead of your real email.
- Optional profile details — age and gender, only if you add them in Edit Profile. You can remove them at any time.
Your membership and purchases
- Your plan, start and expiry dates, renewal status, and any gift code you redeem.
- On iPhone, memberships are bought through Apple In-App Purchase. Apple processes the payment. We never receive your card or Apple Account payment details — only the transaction identifiers, product, purchase and expiry dates, renewal and refund status, and whether a free introductory offer applies.
- We do not currently take card payments anywhere else. If we add another payment option, a payment provider will handle your card details and we will update this policy first.
How you use Privium
- Offers you reveal and redeem (offer, venue, branch, time and the amount you saved), loyalty cards and stamps, your monthly stamp count, rewards you claim, favourite places, and which notifications you have read.
- Raffle entries: if you qualify for the monthly raffle, we record your name, email address, phone number, stamp count and plan for that month's draw.
- Free raffle entries: if you enter the raffle for free by email, we record the full name and the phone number or email address you send us, and the month you entered. You do not need a Privium account for this.
- Anonymous counters on partner pages, such as page views and taps on a venue's phone, website or Instagram links.
Your device
- A random identifier for this install and your last sign-in time. Privium allows one active device per account; this is how we know which device that is.
- Push notification token (Apple Push Notification service or Firebase Cloud Messaging). Only if you turn on Offers & partner news (in Settings, or when the app asks you once on the Home screen) does your device join our offers notification topic. We store that choice (on or off, and when you last changed it) on your profile, so it follows you to a new phone.
- App integrity checks through Firebase App Check (Apple App Attest on iPhone, Google Play Integrity on Android), which confirm requests come from the genuine app.
- Apple Wallet — if you add a loyalty card to Wallet, Apple sends us your device's Wallet identifier and a push token so the card can update itself. The card shows your first name and your loyalty progress.
- Crash reports and diagnostics from Firebase Crashlytics, which are not linked to your account.
Location
If you allow location access, “Near You” and distance sorting use your device's location on your device to show nearby venues. We do not send your location to our servers or store it on your profile. To show it, the app uses Google Maps to draw your position on the map and Apple's geocoding service to turn coordinates into an area name; those providers process it under their own policies. If you use Google Sign-In, Google may also receive your approximate location as part of that sign-in. You can turn location off at any time in your device settings.
On our website
- If you redeem a gift code on privium.online, we collect your phone number (to verify it by SMS), your name if you are new to Privium, and the code. The page uses Google reCAPTCHA to block automated abuse, and Google's Privacy Policy and Terms apply to it.
- If you send a “Partner with us” request, we collect your business name, your name, email, phone, category and message, and email them to our partner team.
Partner (venue) accounts
For venues that partner with Privium, we also store business details, logos, photos and videos, branch addresses and the map pins they set from their device, offers and loyalty-card designs, and the names and logins of their staff and cashier accounts.
3. How we use your information
- To create your account, sign you in and keep your membership running (contract).
- To generate your offer and loyalty codes, record redemptions and stamps, and give you rewards (contract).
- To run the monthly raffle, choose the winner and contact them in the app and by phone (contract, and our raffle rules).
- To show you account, membership and raffle messages in the app's notifications list (contract), and, only if you turn on Offers & partner news, to send you push notifications about club announcements and partner offers (your consent, which you can withdraw at any time in the app's Settings or in your device settings).
- To include free email entries in the monthly raffle draw and contact the winner (our raffle rules).
- To understand how Privium is used in aggregate and to give partner venues anonymous reports about their offers (legitimate interests).
- To keep accounts secure, enforce the one-device rule, prevent fraud and abuse, and fix crashes (legitimate interests).
- To meet legal, tax and accounting obligations (legal obligation).
We do not sell your personal information, we do not use it for advertising, and we do not track you across other companies' apps or websites. Privium contains no advertising SDKs.
4. What partner venues see
- When you reveal or redeem an offer or loyalty reward at a venue, that venue sees the redemption record: the code, the offer, the branch, the time, the amount, and a customer identifier (not your phone number or email).
- The cashier sees your first name while confirming a redemption.
- If you added your age or gender, venues see them only as anonymous totals — for example, how many redemptions came from each age group — never with your name or phone number.
5. Service providers and international transfers
We use these providers to run Privium. They process data on our behalf or provide part of the service you use:
- Google Firebase — Authentication, Cloud Firestore database, Cloud Functions, Cloud Storage, Cloud Messaging, Crashlytics and App Check.
- Google — Google Maps Platform (maps), Google Sign-In, reCAPTCHA (website), and Google Workspace email for partner enquiries.
- Apple — Sign in with Apple, In-App Purchase, the Apple Push Notification service, Apple Wallet, App Attest and location geocoding.
Our database is hosted in Google Cloud's region in Dammam, Saudi Arabia, and our server code runs in the United States. Google and Apple may process data in other countries. When data leaves Bahrain we rely on these providers' contractual and security safeguards.
6. How long we keep data
- Your account — for as long as you keep it.
- When you delete your account — we immediately delete your profile, loyalty cards, favourites, notifications, Apple Wallet registrations and your sign-in account.
- Records we keep after deletion — redemption and offer-code records (customer identifier, offer, venue, branch, time, amount saved and, if you added them, age and gender), loyalty-code records, the record of a gift code you redeemed (with your identifier and email, if any), past raffle draws (name, email, phone number and stamp count of member entrants, and the name and phone number or email of free entrants), and Apple subscription records. These do not include your profile, but they can still identify you. We keep them only as long as needed for partners' business records, accounting, fraud prevention and resolving disputes, and then delete or anonymise them.
- Free raffle entries — kept with that month's raffle record as long as needed to run the draw, contact and verify the winner and resolve disputes, and then deleted.
- Server logs — about 30 days. Crash reports — up to 90 days.
- Partner enquiries — while we handle the enquiry and for as long as we work with that venue.
7. Your rights and choices
- Delete your account in the app at any time: Settings → Delete Account. If you can't use the app, email partner@privium.online with the subject “Delete my account” and the phone number or email on your account; we may ask you to confirm the request from that number or address.
- Access, correct or get a copy of your data, object to or ask us to restrict how we use it, or withdraw consent — email us. You can correct your name and add or remove your age and gender in Edit Profile.
- Notifications — turn off Offers & partner news in the app's Settings to stop offer and announcement pushes, or turn all Privium notifications off in your device's Settings → Notifications → Privium.
- Location — turn it off in your device settings; the rest of the app keeps working.
- Apple subscription — manage or cancel it in your App Store account settings. Deleting your Privium account does not cancel it.
We reply to requests within 30 days. If you are not satisfied, you can complain to the Personal Data Protection Authority in the Kingdom of Bahrain.
8. Security
Data is sent over encrypted connections and protected by access rules, app integrity checks and server-side checks on everything that grants a membership. No method of transmission or storage is 100% secure, but we work to protect your information.
9. Children
Privium is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has given us personal data, contact us and we will delete it. The monthly raffle is open only to adults aged 18 and over.
10. Changes to this policy
We may update this policy from time to time. We will post the new version here, update the “Last updated” date above and, for significant changes, tell you in the app.
11. Contact us
Questions about this policy or your data? Email partner@privium.online or message us on WhatsApp.