Privacy Policy

Last updated: October 9, 2026

This policy explains how Sabbar Alqahwa Trading Establishment (“CACTUS”, “we”) collects, uses, and protects your personal data when you use the CACTUS iPhone app and the ordering page at cactus-sa.com, in accordance with Saudi Arabia’s Personal Data Protection Law.

Data we collect

• Account details: first and last name, mobile number, and preferred app language. Optionally: email address, gender, and date of birth.
• Order details: items and add-ons, branch, arrival time, amount, and order status.
• Friends card: membership number, stamps and rewards, and in-store purchases recorded by the cashier using your membership number.
• Support messages: the feedback and support tickets you send us.
• Notifications: if you allow notifications, we store the device token provided by Apple, linked to your account, to send you order status updates and Live Activity updates on your Lock Screen.
• App performance (optional): anonymous counts such as opening the menu, starting or failing a payment, and crashes, with a random session ID that changes each time you open the app. They do not include your name, phone number, orders, or any device identifier, and are deleted within 30 days. You can turn this off in “Account → Preferences → Share app performance”.
• Location: optional. The app asks only when you tap “Nearest to me” to find your closest branch, or turn on the “passing a branch” alert (a local notification, at most one a day). Your location is used on your phone only; we do not collect it or send it to our servers, and you can turn the alert off or remove access in Settings at any time.
• Camera: not used by the customer app. Only the branch staff app uses it to scan a customer’s membership code. Images are not saved or sent.
• Payment: you enter card or Apple Pay details directly with our payment provider, Moyasar. Card numbers do not reach our servers and we do not store them.

We do not use the app to track you across other apps or websites, display advertising, or sell your data.

How we use your data

• To fulfil your order, notify the branch, and track its status.
• To sign you in by sending a verification code to your number by SMS or WhatsApp.
• To calculate stamps and award rewards, including birthday gifts.
• To send offer and greeting notifications to customers who turned on “Offers & greetings” in the app; we may target them by gender or occasion (such as your birthday) if you added them. You can turn them off in the app at any time.
• To respond to feedback and support tickets.
• To prevent fraud and abuse of offers, and meet legal and accounting obligations.

Who we share data with

We share only the minimum necessary data with service providers working on our behalf:

• Moyasar for payment processing.
• Loyverse (our point-of-sale system) to record sales and link them to your Friends card.
• Our SMS provider (Msegat) and Meta (WhatsApp) to send verification codes to your number.
• Apple to deliver notifications to your device.
• Cloudflare for service and database hosting.

We may also disclose data when required by a competent authority in accordance with applicable laws.

Website visitor statistics

We count visits to cactus-sa.com pages and clicks on links such as “Order” and “Menu” to understand which sections are useful. To distinguish visitors within the same day, we use an irreversible hashed fingerprint derived from the IP address and browser type. This fingerprint changes daily, has no identifying information stored alongside it, and we do not store the IP address itself. We do not use cookies or third-party analytics or advertising tools. We delete these fingerprints after 90 days and retain only daily totals.

Retention

We retain your account data while your account exists. We may keep order and sales records for the period required by accounting and tax laws, without linking them to your identity after account deletion.

Your rights

• View and edit your data in “Account” in the app.
• Delete your account at any time through “Account → Delete account”. We permanently erase your name, email address, gender, date of birth, stamps, and rewards.
• Contact us to request a copy of your data or object to its processing.

Data security

Data is transmitted over an encrypted HTTPS connection. Your session token is stored in the device’s Keychain. Access to data is limited to those who need it to provide the service.

Children

The service is not directed at children under 13, and we do not knowingly collect their data.

Contact

For privacy questions, email info@cactus-sa.com or contact us on WhatsApp at 050 990 2830.

We may update this policy. We will publish changes here with the update date and notify you in the app if a change is material.