Privacy policy

Retaylo is a sales game that a company offers to its own staff. Your employer decides who plays, which sales count, and who can see the leaderboard.

For data about players and company admins inside the product, your company is the controller. We process that data on the company's instructions, as its processor. That includes your profile, sales, coins, challenges, quests, withdrawals and support requests.

We are the controller for this website, for the contact form, and for the security logs we keep to protect the service.

We are established in the United Arab Emirates, in Meydan Free Zone. Meydan is not the DIFC or ADGM, so the federal personal data law applies to us: Federal Decree-Law No. 45 of 2021 and its executive regulations. If you are in the European Economic Area, the GDPR also applies to processing about you. If you are in the United Kingdom, the UK GDPR applies. A law in the country where you work can give you extra rights. Your company is responsible for meeting the employment and privacy duties it owes its staff.

Account. First name, last name, username, email, a hashed password and your language. Your company sends the name and email when it invites you. You do not open an account on your own.

Work and play. Sales the company imports, the store and products they relate to, coins, experience, streaks, avatar items, challenges, quests, rankings and withdrawal requests. A withdrawal records the amount, the currency and the status. We do not ask for your bank details. Your company pays you outside the app after it approves a request.

Device. Your language, and a push token for this device if you turn notifications on. We also store the IP address and browser of a signed-in session.

Support. The area, urgency and message you send from Help & support, files you attach, and a copy of your name, username and email so the company can still see who wrote if you later leave.

Website. If you write to us from the contact form: first name, last name, email, phone number and your message. The site also keeps a cookie with your language choice, and short technical logs such as IP address, browser and the page requested.

We do not use a product-analytics service. We do not access your location, contacts, camera, photo library or microphone. A file you attach to a support message is one you choose to send.

We use player and admin data to run the account, apply the company's rules, show rankings to the people the company allows, record coins and withdrawal requests, send the notifications you chose, and answer support.

We use website data to show the site in your language, reply to a message you send, and protect the service against abuse.

We use security logs to investigate faults and misuse. Error reports go to our monitoring provider without the body of a request, cookies, query strings or the contents of a database query.

When your company is the controller, it chooses the legal basis for its staff. That is often the employment relationship, or the company's legitimate interest in running a sales programme. We only process that data on the company's instructions.

When we are the controller, we rely on one of these. A contract, or steps you ask for before one, when we reply to a contact message or provide an account we operate ourselves. A legal duty, when we must keep a record. Our legitimate interest in keeping the service secure, preventing abuse and understanding a fault. The language cookie is strictly necessary to remember the language you chose.

We do not sell personal data, and we do not use it for advertising.

Your company. Admins, and the people your company allows, can see profiles, sales, rankings, coins and withdrawal requests. Support messages are visible to the company staff who handle them.

Providers who host the product for us: Vercel (website, admin and dashboard), Railway (the API), Neon (the database), Cloudflare R2 in the European Union (files, including support attachments and invoice PDFs), Upstash (session cache and rate limits), Resend (email), Inngest (background jobs), Sentry (errors and technical logs) and Expo (push notifications).

Authorities, when the law requires it. A buyer of the business, if we sell or restructure it, and only under a duty to protect the data.

We do not sell personal data.

We are in the United Arab Emirates. Customers and players can be anywhere. Providers may process data in the UAE, the European Union, the United Kingdom, the United States and other countries where they operate. Files on Cloudflare R2 are stored in the European Union.

When a law requires a safeguard for a transfer, we use one. For personal data that the GDPR or the UK GDPR protects, that is typically a contract with the standard clauses approved for that transfer, unless the destination is already recognised as adequate. Your company can ask us for a summary of those safeguards.

This website stores one cookie so it can remember the language you picked. The admin panel and the dashboard store a session cookie so you stay signed in. These cookies are necessary to run the service.

We do not use advertising cookies or a third-party analytics cookie.

We keep a player account while the company still lets that person play. If you ask to delete the account and you have an open challenge, we wait until that challenge has finished, then delete it. A pending withdrawal is cancelled when you confirm deletion.

After you leave, or the account is deleted, we delete or anonymise what we no longer need. We keep what the law, a dispute, or your company's instructions still require. That can include invoices, an audit of a correction, a security investigation, and the history of sales and coins the company needs for its own records.

Contact messages stay while we handle the request and for a short time afterwards. Technical logs are kept for a short time, then deleted or anonymised, unless we need them for a security investigation.

You can ask to access your data, correct it, delete it, limit how it is used, or object to some processing. Where the law gives you portability, you can ask for a copy in a portable form. Where we rely on consent, you can withdraw it.

For data your company controls, ask your company first. We will help them answer, or we will answer if we are the controller.

You can also complain to a regulator. In the UAE that is the UAE Data Office. In the European Economic Area it is the authority in your country. In the United Kingdom it is the Information Commissioner's Office. If another country gives you a regulator, you can use that too.

Write to privacy@retaylo.com, or use Help & support in the app. We reply within the time the applicable law sets.

Retaylo is for people a customer company employs. It is not directed at children, and we do not market it to them.

A company may invite only its own staff. Staff are almost always 18 or older. If a company employs someone younger, that company is responsible for any permission the law in that country requires before the person uses the app.

Retaylo FZ-LLC, Meydan Free Zone, Dubai, United Arab Emirates. Trade license: to be issued.

Privacy: privacy@retaylo.com. Other legal questions: legal@retaylo.com. Players can also use Help & support in the app, or ask the admin at their company.