Privacy Policy

Zewards (zewards.app) is a rewards marketplace that connects consumers in the United Arab Emirates with real, licensed businesses through free giveaways, instant wins and verified draws. This Privacy Policy explains what personal data we collect, how we use it, and the choices you have.

Zewards is operated by Zewards Portal, Dubai Department of Economy and Tourism (DET) Professional Licence No. 1658007, Dubai, United Arab Emirates. Commercial Register No. 2937416. That entity is the data controller for the personal data described in this policy, and can be reached at support@zewards.app.

Account and profile information. When you sign up and complete onboarding, we collect your name, email address, date of birth, emirate and mobile number. Date of birth and mobile number are used to verify eligibility and are never shown to businesses.

Participation information. When you enter a giveaway we store your entries, task completions, answers you submit, and any proof files (such as screenshots or documents) you upload to verify a task.

Claim information. When you win and claim a reward, you choose which delivery details to share (for example a shipping address, phone number or bank details). These details are shared only with the business offering that reward.

Lead-form information. Some giveaways include a form asking for details the business requests (for example your name, email or phone). What you enter is shared with that business, which can view and export it to verify participation and fulfil the giveaway. Businesses must use it only for that purpose unless you separately agreed to more.

Connected social accounts. If you choose to connect a social account (Instagram, Facebook, TikTok or LinkedIn) to Zewards, we access your basic profile information through that platform's own consent flow, subject to their terms. You can disconnect at any time.

Business information. Business users provide company details, trade licence documents and contact information. Licence documents are stored privately and are only accessible to Zewards administrators.

Business verification. Business verification is carried out by our verification provider, Didit, which checks the company against official registries and confirms the person applying is authorised to act for it. Didit receives the company and applicant details needed for that check and returns the result to us.

Support conversations. Messages you send through support tickets are stored so we can help you. The first reply on a ticket may come from the Zewards Assistant, an automated AI assistant that reads your ticket and our help articles to suggest an answer. Its replies are clearly labelled, and you can ask for a person at any time.

Technical information. We collect standard device and usage information (such as log data and analytics events) needed to run and secure the platform.

• •Operating giveaways: recording your entries, verifying task completion and confirming eligibility (including your age).
• •Delivering rewards: processing and tracking your claims and sharing your delivery details with the relevant business.
• •Verifying proofs: reviewing the evidence you submit, including with automated (AI) checks described below.
• •Notifications: telling you about wins, claim deadlines, fulfilment updates and (if you opt in) new giveaways, by in-app notification, email, SMS or WhatsApp.
• •Safety and integrity: detecting fraud, duplicate accounts and misuse, and enforcing our Terms & Conditions.
• •Improving Zewards: understanding how the platform is used so we can make it better.

Proof files you upload may be analysed by automated tools to check whether the task was genuinely completed. If an automated check is inconclusive or you disagree with it, your proof can be reviewed manually by the business or by Zewards moderators. Original filenames are kept for reference and shown only to reviewers.

With businesses. A business only receives information that is needed for their giveaway: the proofs and answers you submit to them, your public display name and profile photo, and the delivery details you provide when claiming a reward you won. Your date of birth and mobile number are never shared with businesses.

Service providers. We use trusted providers under contracts that protect your data: hosting and file storage; email delivery; Twilio and Infobip for SMS verification codes and WhatsApp messages; Meta's WhatsApp Business platform for WhatsApp notifications and giveaway broadcasts (sent only if you opted in to WhatsApp messages); Didit for business verification; AI providers for proof checks and the support assistant; analytics; and Stripe for business payments.

Legal requirements. We may disclose information if required by law or to protect the rights, safety or security of our users.

We do not sell your personal data.

• •Account and profile information: for as long as your account is open. When you delete your account, your profile is removed and remaining records are anonymised.
• •Entries, task completions, answers and proof files: for 12 months after the giveaway ends, so results can be audited and disputes resolved.
• •Claim and delivery details: for 12 months after the claim is closed.
• •Draw records (seed, entry count and anonymised winners): kept permanently, so every draw stays verifiable.
• •Business verification results and licence documents: for as long as the business account is open, and 5 years after it closes, to meet legal and accounting requirements.
• •Billing records and invoices: 5 years, as required for tax and accounting.
• •Support tickets: 24 months after the ticket is resolved.
• •Analytics events: 24 months.

We may keep information longer where the law requires it or where it is needed to resolve an open dispute or investigation.

We apply appropriate technical and organisational measures to protect your data, including access controls, private file storage with time-limited signed links for sensitive documents, and row-level permissions on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

• •Access and update your information from your profile page at any time.
• •Delete your account by contacting us, subject to records we must retain for legal or giveaway-integrity reasons.
• •Opt out of marketing notifications at any time — you will still receive essential notices about your entries, wins and claims.
• •Disconnect a connected social account at any time from your profile.

We use essential cookies to keep you signed in and remember your preferences, and analytics to understand how the platform is used. You can control cookies through your browser settings; disabling essential cookies may affect your ability to use Zewards.

With your consent, we use the Meta Pixel, a tool provided by Meta Platforms, to measure the performance of our advertising. It shares information such as the pages you visit and your device and browser details with Meta. The pixel only loads after you tap Accept on our cookie banner. You can withdraw consent at any time via "Cookie settings" in the site footer, and we never sell your personal data.

Zewards accounts are only available to people aged 13 and over, and we do not knowingly collect data from anyone under 13. Individual giveaways may set a higher minimum age, which is shown on the giveaway page and checked before you can enter.

We may update this Privacy Policy from time to time. The 'last updated' date at the top of this page shows the current version, and material changes will be announced in the app.

Questions about this policy or your data? Contact us at support@zewards.app or through the app's support and report features.