Privacy Policy

This Privacy Policy describes how STLR for Technological Services ("STLR", "we", "us", or "our") collects, processes, retains, and discloses personal information when you use any of our applications, services, websites, and related communications (the "Services"), including the website https://st-lr.com.

• •Registered office: Administrative unit in building number 85 - Street 9, Maadi, Cairo
• •Country of incorporation: Egypt
• •Contact email: info@st-lr.com

STLR designs and operates customer engagement and loyalty technology. We currently offer the following products:

• •Loop by STLR — a food-ordering web application that lets shoppers place orders with participating restaurants and track those orders end-to-end. Loop uses WhatsApp to deliver order confirmations, tracking updates, and loyalty point reminders.
• •Stamps by STLR — a digital punch-card and rewards application that lets shoppers collect stamps, earn rewards, and redeem points across participating merchants. Stamps uses WhatsApp to deliver OTPs during sign-up and login, redemption confirmations, and loyalty point reminders.
• •Loyalty Programme Platform — a white-label enterprise loyalty solution enabling businesses to design and operate fully branded loyalty programmes, including points accrual, tiered rewards, and redemption management.
• •Bridge by STLR — a platform that allows corporate clients to offer their employees access to a curated network of partner merchants, providing exclusive discounts and offers as part of an employee benefits package.
• •Sync by STLR — a points-based loyalty widget that integrates directly into a merchant's website (including Shopify-powered stores), allowing shoppers to earn and redeem points as part of their online shopping experience.

STLR is an independent Tech Provider under Meta's WhatsApp Business Platform. We process and send messages on behalf of the merchants who contract with us; the merchant is the business with whom the shopper has a relationship.

This Policy applies to four categories of people:

Our role under data protection law. For data we process about merchants, website visitors, and job applicants, STLR is a data controller. For data we process about shoppers and end users on behalf of merchants — orders, stamps, points, benefits, WhatsApp messages — STLR is a data processor acting on the merchant's instructions; the merchant is the data controller. If you are a shopper or end user and want to exercise your rights, please contact the merchant whose programme you joined; we will assist that merchant in fulfilling your request.

This Policy does not apply to: (a) third-party websites linked from our applications or messages; (b) personal data a merchant collects or processes outside of our Services; or (c) WhatsApp's own processing of your data, which is governed by WhatsApp's Privacy Policy and the WhatsApp Business Solution Terms.

We process the categories of User Data described in this section only for the purposes set out in Section 4 and only in accordance with this Policy and applicable law.

3.1 Information you provide to us directly

• •Identification and contact information — your first name, last name, mobile phone number, email address, and (for Loop) delivery address.
• •Account credentials — your username, password hash (we never store passwords in plain text), and authentication tokens.
• •Order details (Loop) — items you order, quantities, prices, special instructions, and delivery preferences.
• •Stamp and reward details (Stamps) — stamps earned, rewards available, and redemption history.
• •Employee benefits details (Bridge) — your employer, benefit entitlements, and discount redemption history.
• •Loyalty and points details (Loyalty Platform / Sync) — your points balance, tier status, and redemption history.
• •Communications — emails, support tickets, and chat messages you send us.
• •Billing and tax information (merchants only) — billing contact details and tax identification numbers (VAT, GST, TRN). We do not store full payment card numbers; payments are handled by our payment processor and we receive only limited metadata such as the last four digits and payment status.
• •Job application information — your CV, cover letter, work history, and any other information you choose to share when applying for a role.

3.2 Information collected automatically when you use the Services

• •Device and connection information — device ID, advertising identifier (IDFA or AdID), device type, operating system, browser type and version, screen resolution, carrier, network type, and IP address.
• •Usage data — pages and screens you visit, features you use, buttons you tap, search queries, session timestamps, and time spent on screens.
• •Approximate location — city or country derived from your IP address. Precise GPS location is collected only with your permission and only while the application is in use.
• •Cookies and similar technologies — see Section 10 for the categories of cookies we use.

3.3 Information we receive from merchants about their shoppers

When a merchant or corporate client uses our applications to run a loyalty or benefits programme, they may upload or sync information about their shoppers or employees to our platform — for example, a phone-number list to migrate a paper punch-card programme into Stamps, or a customer database to enable order confirmations through Loop. STLR processes this information on behalf of the merchant.

3.4 Information we receive from WhatsApp and Meta

When a shopper interacts with a WhatsApp Business Account that STLR operates on behalf of a merchant, we receive:

• •The shopper's WhatsApp phone number and WhatsApp profile name.
• •The content of messages the shopper sends to the merchant's WhatsApp Business Account (for example, "yes, confirm my order").
• •Message metadata — timestamps, delivery status, read receipts, and conversation identifiers.
• •Opt-in and opt-out signals captured through WhatsApp's mechanisms.

We process this data solely to deliver the messaging service requested by the merchant and in accordance with the WhatsApp Business Solution Terms.

3.5 Information from third-party integrations

To deliver our Services, we may integrate with merchants' point-of-sale systems, e-commerce platforms (including Shopify), and payment processors. We receive only the data necessary to operate the loyalty or ordering flow — typically transaction amount, transaction ID, customer identifier, and timestamp.

3.6 Inferences

We may draw limited inferences from User Data — for example, that a shopper prefers a certain cuisine type in Loop based on their order history, or that a shopper is approaching a reward in Stamps based on their stamp balance. We use these inferences only to operate, personalise, and improve our Services. We do not create profiles for behavioural advertising and we do not share inferences with third parties for their own marketing.

We process User Data only for the specific purposes described below. Where the EU/UK GDPR, UAE PDPL, KSA PDPL, or similar laws apply, the relevant lawful basis for each purpose is shown.

We will not use your User Data for a new, unrelated purpose unless we tell you about it first and, where required, obtain your consent.

WhatsApp messaging is central to several STLR products, including Loop and Stamps. WhatsApp messaging is used primarily to communicate with shoppers. Website visitors are handled through web forms and email; job applications are handled through email and our careers portal.

5.1 The three types of WhatsApp messages we send

We use the WhatsApp Business Platform to send messages in three Meta-defined template categories, each sent strictly in line with WhatsApp's policy for that category.

5.2 How often you will hear from us

• •Authentication (OTPs): Only when you request one. Typically one message per sign-up or login attempt.
• •Utility messages: Only when triggered by an action you take. Placing a Loop order typically generates one confirmation and up to a few status updates. Redeeming a Stamps reward typically generates one confirmation.
• •Marketing and loyalty reminders: Only after you opt in. Frequency depends on the merchant whose programme you joined — typically no more than 4 marketing messages per merchant per month. We do not send daily marketing messages.

Messaging and data rates from your mobile carrier may apply.

5.3 How you opt in to marketing and loyalty reminders

You only receive marketing or loyalty-reminder messages after providing clear, affirmative consent. Consent is collected via:

• •A checkbox during Stamps sign-up: "I agree to receive loyalty reminders on WhatsApp from [merchant name]"
• •A checkbox during Loop checkout: "Send me my order updates and offers on WhatsApp"
• •A signed paper or digital form at the merchant's location
• •A click-to-WhatsApp ad you tap on
• •A keyword you send to the merchant's WhatsApp number (for example, texting "JOIN" to opt in)

In every case you are told (a) which business will be messaging you, (b) what kinds of messages you will receive, and (c) how to opt out. STLR retains a record of every opt-in for audit purposes.

You do not need to opt in to receive OTPs or order confirmation and tracking updates — those are part of the service you requested by signing up or placing an order.

5.4 How you opt out

You may stop receiving WhatsApp marketing or loyalty messages at any time by:

1. 1.Replying "STOP" (or the local-language equivalent such as "إيقاف") in any WhatsApp conversation with us.
2. 2.Contacting the merchant directly via the contact details they provide.
3. 3.Emailing STLR at info@st-lr.com with the phone number to be opted out.

We stop sending non-essential messages within 24 hours of opt-out and record the opt-out event. We will continue to send you essential service messages so long as you keep using our Services. We do not sell, rent, or share your mobile phone number with any third party or affiliate for their own marketing purposes.

5.5 Message retention

• •WhatsApp Cloud API (Meta's infrastructure) stores message content for up to 30 days, after which it is automatically deleted.
• •STLR's systems retain message metadata (delivery status, timestamps, conversation IDs) for 12 months for analytics and audit purposes.
• •OTPs are deleted from our systems within 24 hours of their expiry.
• •The content of utility and marketing messages is retained only for as long as needed to provide the Service and is then deleted or anonymised.

5.6 What we never do with WhatsApp data

In line with the WhatsApp Business Solution Terms, STLR does not:

• •Use WhatsApp message content for advertising
• •Sell, rent, or trade WhatsApp message data
• •Use WhatsApp data to train AI or machine-learning models
• •Combine WhatsApp data with data from unrelated sources to profile shoppers
• •Share WhatsApp data with anyone other than the merchant who owns the relationship and the sub-processors strictly necessary to deliver the Service

We share personal data only as described below.

6.1 With merchants (when we act as processor)

When STLR processes shopper or end-user data on behalf of a merchant or corporate client, we make that data available to the relevant party. For example, the restaurant whose Loop order you placed will see your name, phone number, delivery address, and order details. The coffee shop whose Stamps programme you joined will see your phone number, stamps accumulated, and redemption history. The corporate client whose Bridge by STLR benefits programme you use will see your benefit eligibility and redemption activity. Each merchant signs a Data Processing Addendum with STLR before being granted access.

6.2 With our sub-processors

We use carefully selected third-party service providers to operate the Services. Each one is bound by a written agreement that requires them to protect your data and use it only on our instructions.

A current, full list of our sub-processors is available on request by emailing info@st-lr.com.

6.3 With Meta Platforms

When you interact with a WhatsApp Business Account that STLR operates, Meta receives and processes data necessary to deliver the message. Meta's handling of that data is governed by the WhatsApp Business App Privacy Policy and the Meta Platform Terms.

6.4 For legal and regulatory reasons

We may disclose personal data when we believe in good faith that disclosure is necessary to (a) comply with applicable law, court order, or government request; (b) enforce our agreements; (c) protect the rights, property, or safety of STLR, our users, or others; or (d) detect, prevent, or address fraud or security issues.

6.5 In the context of a business transfer

If STLR is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of its assets, personal data may be transferred as part of that transaction. We will notify affected users and, where required by law, obtain their consent.

6.6 What we do not do

We do not sell your personal data. This statement is made specifically for the purposes of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), and we do not "sell" or "share" personal information as those terms are defined under those laws. We do not rent or trade personal data with third parties for their own marketing purposes.

STLR is established in Egypt. Some of our sub-processors are located in the European Economic Area, the United Kingdom, the United States, India, and other countries. When we transfer personal data internationally, we rely on one or more of the following safeguards:

• •Standard Contractual Clauses issued by the European Commission (and the UK International Data Transfer Addendum, where the UK GDPR applies)
• •Adequacy decisions issued by the relevant data protection authority
• •The GCC Common Data Protection Framework and equivalent bilateral instruments for transfers within the Gulf region
• •Explicit consent, where it is the only legally available basis

You may request a copy of the safeguards we apply to a specific transfer by emailing info@st-lr.com.

We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, including to meet legal, regulatory, tax, accounting, or reporting obligations.

When the retention period ends, we either securely delete the data or irreversibly anonymise it.

We maintain administrative, technical, and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These include:

• •Encryption in transit — TLS 1.2 or higher for all data moving over public networks
• •Encryption at rest — industry-standard encryption for stored data
• •Access controls — role-based access, multi-factor authentication for administrative accounts, least-privilege principles
• •Monitoring and logging — continuous monitoring for unauthorised access and suspicious activity
• •Vendor due diligence — security assessments of sub-processors before onboarding
• •Employee training — regular security and data-protection training for staff with access to personal data
• •Incident response — a documented procedure for detecting, investigating, and responding to security incidents

No method of transmission over the Internet or electronic storage is 100% secure. While we use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals without undue delay.

Our website and applications use cookies and similar technologies. A cookie is a small text file stored on your device that lets a website or application recognise you and remember information about your visit.

Categories we use

• •Strictly necessary cookies — required for the website and applications to function (session, authentication, security). Cannot be disabled.
• •Functional cookies — remember your preferences (language, region, saved delivery addresses in Loop).
• •Analytics cookies — help us understand how visitors and users behave. Placed only with your consent where required.
• •Marketing cookies — used to deliver relevant advertising and measure campaign effectiveness. Placed only with your consent where required.

Managing your preferences

A cookie banner on st-lr.com lets you accept or reject non-essential cookies on first visit. You can change your choice at any time using the "Cookie Preferences" link in the footer, or by adjusting your browser settings. Disabling some cookies may affect functionality.

We do not currently respond to "Do Not Track" browser signals because no consistent industry standard exists.

You have the right to ask us to delete your User Data at any time. There are three ways to do this.

11.1 Self-service deletion inside Loop

1. 1.Open the Loop application on your device or in your browser.
2. 2.Tap or click your profile icon in the top right.
3. 3.Select Account Settings.
4. 4.Scroll to the bottom and tap Delete my account.
5. 5.Confirm by entering the OTP we send to your WhatsApp number.

Your account, order history, and saved details are deleted from active systems immediately. Backups are purged within 30 days. We retain only the minimum data required for legal, tax, and fraud-prevention purposes (typically order metadata for 7 years, in line with applicable tax law).

11.2 Self-service deletion inside Stamps

1. 1.Open the Stamps application on your device.
2. 2.Tap your profile icon at the bottom.
3. 3.Select Account & Privacy.
4. 4.Tap Delete my account.
5. 5.Confirm by entering the OTP we send to your WhatsApp number.

Your account, stamp balance, and redemption history are deleted from active systems immediately. Backups are purged within 30 days. If your stamps belong to a merchant programme, that merchant may retain a record of your prior redemptions in line with their own retention policy.

11.3 Deletion by email

If you cannot access the application — for example, because you have lost your phone — email us at info@st-lr.com with the subject line "Privacy Request - Delete my account". Tell us the phone number or email address associated with your account, and which application or service you want deleted (Loop, Stamps, Bridge by STLR, Loyalty Programme, Sync by STLR, or all). We will verify your identity, action the request, and confirm by email — within 30 days at most.

11.4 What happens to your WhatsApp messages

When you delete your account, the WhatsApp messages we have sent to you remain in your own WhatsApp app on your phone until you delete them there — we cannot delete messages from your device. Meta deletes message content from its Cloud API infrastructure within 30 days as part of its standard retention.

11.5 If you are a merchant

Merchants and corporate clients who want to terminate their STLR contract and have their account data deleted should email info@st-lr.com with the subject line "Merchant Account Deletion". We will work with you to export any data you wish to retain before deletion.

In addition to the right to delete (Section 11), and depending on where you live, you have one or more of the following rights:

• •Right to be informed — to know what data we hold and how we use it (this Policy is how we honour that right)
• •Right of access — to receive a copy of the data we hold about you
• •Right to rectification — to correct inaccurate or incomplete data
• •Right to restrict processing — to ask us to limit how we use your data
• •Right to data portability — to receive your data in a structured, commonly used, machine-readable format
• •Right to object — to object to processing based on legitimate interest or to direct marketing
• •Right to withdraw consent — at any time, where processing is based on consent (for example, loyalty-reminder messages)
• •Right not to be subject to solely automated decisions with legal or similarly significant effects
• •Right to lodge a complaint with your local data protection authority (see Section 15)
• •Right to non-discrimination for exercising any of these rights (CCPA / CPRA)
• •Right to know what personal information we have collected, used, disclosed, or shared in the last 12 months (CCPA / CPRA)
• •Right to opt out of sale or sharing — we do not sell or share your data, but you may submit a request anyway

How to exercise your rights

Email us at info@st-lr.com with the subject line "Privacy Request". Tell us which right you wish to exercise and, if relevant, which account or data you are asking about. We may ask you to verify your identity before acting on a request. We respond within 30 days. We do not charge a fee for reasonable requests; we may charge a reasonable fee, or refuse, for repetitive or excessive requests.

If you are a shopper or end user whose data we process on behalf of a merchant, we forward your request to that merchant and assist them in fulfilling it.

Our Services are not directed to, and we do not knowingly collect personal data from, children under the age of 16 (or such higher age as applicable local law may require). If you believe we have collected personal data from a child under 16, please contact us at info@st-lr.com and we will delete that information promptly.

For the purposes of the US Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13.

Our website, applications, and messages may contain links to third-party websites or services that we do not operate. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policy of every site you visit before providing any personal information.

Regulatory complaints

You also have the right to lodge a complaint with your local data protection authority:

• •European Union — the data protection authority in your country (directory at edpb.europa.eu)
• •United Kingdom — the Information Commissioner's Office (ico.org.uk)
• •United Arab Emirates — the UAE Data Office (dataoffice.gov.ae)
• •Kingdom of Saudi Arabia — the Saudi Data and Artificial Intelligence Authority / SDAIA (sdaia.gov.sa)
• •California, USA — the California Privacy Protection Agency (cppa.ca.gov)

We would appreciate the chance to address your concerns directly before you approach a regulator.

We may update this Policy from time to time to reflect changes in our Services, technologies, or legal obligations. We retain all versions of this Privacy Policy in effect while we use the WhatsApp Business Platform and will provide them to Meta on request. When we make material changes, we will:

• •Update the "Last Updated" date at the top of this page
• •Post a notice on our website and within our applications
• •Where required by law, notify you by email or in-app message

Your continued use of the Services after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree, please stop using the Services and contact us if you have an active account.

This Policy is published in English. If we provide a translated version, the English version will control in the event of any conflict.