Stallo App Privacy Policy
This is a translation of the Arabic privacy policy. If the two versions differ, the Arabic version prevails.
Data we collect
- Phone number, to sign in with a verification code sent by text message.
- Name or business name, shown to the other party in bookings and events.
- IBAN and bank name, for organizers only, to transfer their earnings when payment is made by card in the app.
- Event permit number and location, for organizers; both are shown publicly on the event page.
- Approximate location, only while the app is in use, to show nearby events and sort them by distance. We do not store it on our servers.
- Booking and payment data: the event, the stall, the amount, the payment method and its status, and the transaction ID at the payment gateway.
- Device token for notifications, to send booking decisions and payment alerts. It is deleted when you sign out or delete your account.
- App integrity attestation (App Attest) from Apple, to verify that requests come from a genuine copy of the app. It contains no personal data.
- The “Register your interest” form on stallo.ae: we keep your role (organizer or vendor), your name and mobile number, and your Instagram account and note if you enter them, only to contact you about joining Stallo, and Google reCAPTCHA checks on submission that the request is not automated.
Payment
When you pay by card or Apple Pay, card details are processed directly by the payment gateway Tap Payments; they do not pass through Stallo's servers and are not stored by us. We send Tap the vendor's name and phone number and the transaction amount and description so that it can issue the payment receipt and send it by text message. In direct payment mode, no money passes through Stallo.
Refunds
Cancellations and refunds are governed by section 9 of the Terms and Conditions.
Where and how long data is stored
Data is stored in Google's Firebase services in the Middle East region (Doha) and is encrypted in transit. We keep account data for as long as the account exists, and booking and payment records for the period required by law after that. We keep interest requests sent from the website for 12 months from the date they are sent, and the request-limit record linked to a mobile number for 2 days after the last request; both are then deleted automatically.
Sharing
We do not sell your data or share it for advertising purposes. The organizer sees the vendor's name and phone number when a booking is made, and the vendor sees the organizer's name. Stallo's administration reviews event details (including the permit number) before publication.
Account deletion
You can delete your account from within the app under “My account” ▸ “Delete account”. Your profile and notification token are deleted immediately, and your data in past booking records is anonymised. Deletion is not possible while you have an active booking or an event that has not ended. You can also request deletion by email at the address below.