Privacy policy

Who we are

Passkaar (“we”, “us”) is a loyalty card platform run by Mujahid Muhammad, trading as PASSKAAR, a sole proprietorship, 69-C, Nishtar Street, Etihad Colony, Iqbal Town, Lahore, Punjab, Pakistan. For any question about this policy or your information, write to [email protected].

We play two different roles. For the businesses that use Passkaar, and for visitors to passkaar.com, we decide how your information is used. For a shop’s customers, the shop decides: we hold and process the card details on the shop’s behalf, and only to run its loyalty card. Our terms of service set out how we handle a shop’s customers’ details on its behalf.

Businesses using Passkaar

When a business applies for and uses an account, we collect:

• the name, email address and mobile number of each person on the account, and a password, which we store only as a one-way hash;
• the business’s name and legal name, category, city, address, contact number, branches, logo, colours, website, social links and privacy policy link;
• a copy of the business’s registration or the owner’s CNIC, to prove the business is real, and proof of bank transfer for plan payments, with the payer’s name and bank reference. These documents are stored privately and opened only by the Passkaar staff who review them;
• a record of sign-ins (the IP address and browser of each session) and of important actions taken in the account, kept for security and to settle disputes;
• which version of our terms the owner accepted, and when.

We use this to review the application, run the account, take payment, send account and billing emails, answer support requests, and keep the platform secure.

If you report a problem from your account, we keep what you write, the page you were on, your browser, the card it is about and any screenshot you add, and it also reaches our support inbox, so that we can answer you.

A shop’s customers

When you join a shop’s loyalty card, you fill in the form the shop chose. It always asks for your first name and a mobile number or email address, and may ask for your last name, date of birth, gender or answers to the shop’s own questions. We also record your card’s balance and history — stamps, points, rewards, visits — and when the card was added to or removed from a wallet.

Your card shows your name, your balance and a card ID. Its QR code holds only an internal number, never your phone number or email. If you add the card to Apple Wallet, your iPhone gives us an identifier for its wallet and a token for sending updates, and may send us error messages about the card. If you add it to Google Wallet, Google tells us when the card is saved or removed. We receive no other information about your phone. A copy of your card — your name (first, and last if the shop asked), balance, card ID and the shop’s messages — is kept by Google if you add it to Google Wallet, and on your iPhone if you add it to Apple Wallet.

The shop can see your details and card history in its account, and can send messages that appear on your card and on your lock screen. It may not sell your details, and we never do. To stop messages, turn off notifications for the card in your wallet app or remove the card.

To have your details removed, ask the shop, or write to us at [email protected] and we will pass your request to the shop. Once the request is approved, the shop no longer sees you and sends you no messages, and 30 days later your name, number, email, date of birth and answers are erased for good and your card is cancelled. Your card’s history stays, with nothing in it that names you. A card already on your phone may keep showing what it last showed until you remove it.

Visitors to passkaar.com

• If you ask us to call you back about your business, we keep the name, business, city, phone number and message you send.
• If you join our waiting list, we keep your name, phone number and email, and your business name and social media or website if you give them, to tell you when Passkaar opens. Each signup is also emailed to our team’s inbox.
• If you try a demo card, we keep the name, mobile number and anything else you chose to give. We contact you about Passkaar only if you ticked the box agreeing to it.
• Our forms are protected by Cloudflare Turnstile, which checks that a visitor is a person and may process your IP address and browser details to do so.

We do not use advertising or analytics trackers, and we do not sell anyone’s information.

Cookies and your browser

We set cookies only to keep you signed in to your business account. They cannot be read by the page’s scripts and are not used for advertising. Our pages also keep a few things in your own browser, so that a dropped connection does not cost you twice: when you join a card, what you sent stays in that browser tab until the card is on your phone, and is not used after 30 minutes; a demo card is remembered in your browser until the page sees it has ended. None of it is used to track you. Cloudflare may set a cookie needed for its security check.

Who else processes your information

• Apple, to put cards into Apple Wallet. We send Apple only a signal to update; your iPhone then fetches the card from us.
• Google, to put cards into Google Wallet. Google keeps the card’s contents on its servers.
• Google Cloud, which runs our servers and stores the data.
• Cloudflare, which carries traffic to our servers and runs the security check on our forms.
• Zoho, whose ZeptoMail sends our emails to businesses and whose Zoho Mail holds our support mailbox. We never email a shop’s customers.
• WhatsApp, if you message our support number, +92 342 8845163.
• Google’s Gmail, which holds the inbox our waiting-list signups are emailed to.

These companies process information where they run their services, so some of it leaves Pakistan. We share information with anyone else only when the law requires it.

How long we keep it

• Business accounts and their customers’ cards: for as long as the account is open. After an account closes, for 12 months, to answer disputes and for our accounts; then the customers’ personal details are erased.
• Card balances and history are an append-only record: a correction is added as a new entry rather than changing the old one. When a customer’s details are erased, these entries stay with nothing in them that names the customer.
• A customer whose removal is approved: erased 30 days after approval.
• Problems reported from a business account: two years after they are sent.
• Call-back requests: the name, phone number and message are removed 90 days after we close them, and never more than a year after they arrive.
• Waiting-list signups: the same, with the email and social media or website. We delete the copy emailed to our team’s inbox when we close the signup.
• Demo cards: the name on our copy becomes “Guest” within a day of the demo ending. A demo card already on your phone, or saved to Google Wallet, keeps showing your name until you remove it. The details you left for a call back: up to a year after the card ends, or sooner once we have followed up.
• Sign-in sessions: deleted when they expire, a week after the last sign-in at most.
• Records of the emails we send: 180 days. A copy queued for sending is removed 90 days after it was queued once delivered, or a year after we gave up sending it.
• Records of a card being added to or removed from a wallet: the first and last for good, the rest 90 days. Error messages from iPhones about a card: 30 days.
• Records of important account actions, which name the person who acted: kept at least 24 months and never deleted, because they settle disputes.

Keeping it safe

All traffic is encrypted. Passwords are hashed, each business can see only its own customers, and access to the platform’s internal tools is limited to Passkaar staff who need it. Business documents and payment receipts are stored privately and opened only through links that expire.

Your choices

You can ask us for a copy of the information we hold about you, to correct it, or to delete it, by writing to [email protected]. If you are a shop’s customer, the shop decides, and we act on its approval. Some records cannot be deleted: a card’s history, payments between a business and us, and the record of important account actions, which names the person who acted. Passkaar is not meant for children under 13.

Changes

If we change this policy, we will update the date at the top of this page and, for changes that matter, tell businesses using Passkaar in their account when they next sign in.