Draft for lawyer review, not legal advice. This text was prepared on 3 October 2026 for review by Jordanian counsel. It is not final and must not be relied on. Items in [square brackets] are still to be completed. It will be replaced by the approved Arabic and English versions.
1. Who is responsible for your data
1.1 [Company legal name], registered in Jordan under number [registration number], [address] ("Layali", "we"), is the controller (المسؤول) of the personal data described in this policy.
1.2 Our Data Protection Officer (المراقب): [name], privacy@getlayali.com, [phone]. Write to the DPO for any question, request or complaint about your data.
1.3 This policy covers the Layali app and the website getlayali.com. It applies to buyers and users, and to people who act for organizers (owners, managers, finance and door staff) and artists who claim a page.
2. The short version
- We collect what we need to give you an account, sell and deliver tickets, keep the service safe and meet our legal duties.
- We ask for your consent, and we record it. You can withdraw it; some features then stop working.
- When you buy a ticket, the organizer of that event receives your name and ticket details so it can admit you. Not your phone number, unless you choose to share it.
- Card details are entered with the payment provider, not with us.
- Our systems are hosted outside Jordan. We tell you this and ask for your consent before you create an account.
- We do not sell personal data. We do not send marketing unless you switch it on.
- You can delete your account in the app at any time.
3. What we collect, why, and for how long
| Data | Purpose | How we get it | Kept for |
|---|---|---|---|
| Mobile number; one-time-code records | Create and secure your account; sign you in; deliver tickets; contact you about an order or an event you hold a ticket to | From you | While the account exists; code records [90 days] |
| Name; language; city | Show your name on tickets and at the door; show you events near you; speak to you in your language | From you | While the account exists |
| Date of birth | Confirm you are 18 or over and meet an event's minimum age, as the law on minors requires | From you | While the account exists |
| Email (only if you use Apple or Google sign-in, or give it) | Sign-in; receipts | From you or the sign-in provider | While the account exists |
| Profile picture (optional) | Display on your profile | From you | Until you remove it or delete the account |
| Orders, tickets, order codes, amounts, payment references, refund records | Sell and deliver tickets; refunds; statements to organizers; accounting and tax records; disputes | Created when you buy | [7] years after the order, as accounting and tax law require |
| Check-in records (which ticket was scanned, when, by whom) | Admission; preventing reuse; evidence in disputes and chargebacks; safety enquiries | Created at the door | [7] years with the order |
| Saved events, follows, RSVPs | The features you use | From you | Until you remove them or delete the account |
| Reports you send; support messages | Handle your report or request; keep the service lawful and safe | From you | [3] years after the matter is closed |
| Credits, referral and promo records | Run promotions fairly; prevent abuse | Created by use | [24] months |
| Device type, operating system, app version, crash reports | Fix errors and keep the service working. Not linked to your identity | Automatically | [90 days] |
| Usage events (screens opened, actions taken), linked to your account id | Understand and improve the service. Only if you consent; off otherwise | Automatically | [12] months |
| Push notification token | Send notifications you asked for | From your device, if you allow | Until you turn notifications off |
| Marketing preference | Send news and offers. Off unless you turn it on | From you | Until you turn it off |
| Organizer members and artists: role, organizer name, verification documents and ID copies, payout details | Verify who may sell tickets and receive money; pay settlements; prevent fraud | From you or your organizer | The relationship plus [10] years; ID copies [deleted [ ] after the relationship ends] |
| Records of the consents you gave and the terms you accepted | Prove consent and acceptance, as the law requires | Created when you accept | As long as the data they relate to, plus [3] years |
We do not collect your precise location, your contacts, or your browsing outside Layali. We do not make decisions about you by automated profiling.
Optional identity verification (not yet offered): if we offer an "ID-verified" badge, we will ask for a separate consent, process a photo of your ID and a selfie only to confirm your age and identity, and delete the images within [30] days of the decision. These are sensitive data under the law.
4. The basis for processing
4.1 Your consent. We process your data on the basis of the consent you give when you create your account and at the specific points where we ask (buying a ticket, switching on notifications, analytics or marketing). Each request says what it is for and for how long. We keep a record of it.
4.2 Where the law allows processing without consent. Some processing is required or authorised by legislation or a court, for example keeping accounting and tax records, complying with the law on minors, answering a lawful order of a court or public prosecutor, or helping a competent authority prevent or detect a crime. Payment processing is carried out by providers supervised by the Central Bank of Jordan under their own rules.
4.3 Withdrawing consent. You may withdraw a consent at any time in the app (Profile, Privacy) or by writing to the DPO. Withdrawal does not affect what was done before it. If you withdraw the consent that the account itself depends on, we cannot keep the account open and will treat it as a request to delete it. Data we must keep by law is kept, restricted to that purpose.
5. Who receives your data
5.1 The organizer of an event you hold a ticket to. When you buy or receive a ticket, we share with that Organizer, with your consent given at checkout: your name, the ticket type and quantity, the order code, whether the ticket has been used, and your declared age band where the event has an age rule. The Organizer uses it to admit you, run the event safely, serve you (for example a table booking) and meet its legal duties. The Organizer is named on the event page and at checkout, and is itself responsible under the law for the data it receives. We do not give Organizers your phone number or email unless you choose to share it for that event. Organizers may not use this data for marketing unless you gave a separate consent through Layali.
5.2 Door staff. People the Organizer authorises to scan tickets see the holder's name and the ticket status at the moment of the scan.
5.3 Payment providers. [PayTabs / MEPS] and banks process your payment on their own systems. We receive a payment reference, the result, and limited details such as the card type and last four digits.
5.4 Service providers acting for us (processors). They process data only on our instructions and under contract:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | [Frankfurt, Germany (EU)] |
| [SMS / WhatsApp provider] | Delivering one-time codes and service messages | [country] |
| Sentry | Crash and error reports (no user identity) | [EU / USA] |
| PostHog (EU cloud) | Usage analytics, only with your consent | [EU] |
| Expo (EAS Update) | Delivering app updates | [USA] |
| Netlify; Cloudflare | Hosting the website; DNS and email routing | [USA / global] |
| Apple; Google | App distribution; sign-in if you choose it; push notifications | [USA / global] |
5.5 Authorities. We disclose data to a court, public prosecutor or other competent authority where the law requires it or on a lawful order. We keep a record of each disclosure.
5.6 A successor. If the business is transferred, your data may pass to the new operator under this policy; we will tell you beforehand.
5.7 We keep a record of the data we share, with whom and why, as the law requires. We do not sell personal data and do not share it for anyone else's marketing.
6. Storage outside Jordan
6.1 Our database and several of the providers above are located outside Jordan (see the table). The Personal Data Protection Council has [not yet published] a list of countries it regards as providing sufficient protection. The level of legal protection in those places may therefore be lower than under Jordanian law.
6.2 We ask for your explicit consent to this transfer when you create your account, after telling you the above. Before using a provider we check its security and data-protection commitments and bind it by contract.
6.3 If the Council publishes an adequacy list or other rules, we will follow them and update this section.
7. How we protect data
Access to personal data is limited to people who need it; data is encrypted in transit and at rest; database rules restrict each user and each organizer to their own data; ticket codes are readable only by the holder; phone numbers and codes are removed from error reports on your device before they are sent; administrator actions are logged; we test our security and review access regularly.
8. If something goes wrong
If a breach of security is likely to cause you serious harm, we will tell you within 24 hours of discovering it, with what happened and what you can do, and we will notify the Personal Data Protection Unit within 72 hours, as the law requires.
9. Your rights
Under the law you have the right to:
- know what data we hold about you, access it and obtain a copy;
- correct, complete or update it (most of it you can edit in the app);
- withdraw your consent;
- restrict processing to a specific scope;
- have your data erased or hidden in the cases the law provides;
- object to processing or profiling that is unnecessary, excessive, discriminatory or unlawful;
- have a copy of your data transferred to another controller;
- be told of any breach affecting your data.
To exercise a right, use the app or write to privacy@getlayali.com. We answer within [30] days [or the period set by the 2025 Regulation on data subject rights]. Exercising your rights costs nothing and carries no penalty. You may complain to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship: [contact details].
10. Deleting your account
In the app: Profile, then Delete account. Without the app: https://getlayali.com/account/delete, where we first send a code to the number on the account. Deletion is immediate and cannot be undone. If you last signed in more than a day ago, we ask for a fresh code first.
- Erased at once: your name, phone number, picture, date of birth and city; saved events and RSVPs; the organizers and artists you follow; device tokens; your place on organizer teams; your sign-in.
- Kept without your name, number or email, because the law requires accounting records: orders, tickets and payment references for [7] years; the door check-in log attached to those tickets; credit and referral records for [24] months; a record that the account was deleted. Payment-provider payloads are trimmed after [13] months. Statements already issued to organizers remain, with no buyer name.
- Lost: valid tickets to future events are cancelled without refund, remaining credit is forfeited and unpaid orders are cancelled. The app shows you exactly what you will lose and asks you to confirm.
- Organizer owners: if you are the only owner of an organizer with a team or upcoming events, transfer ownership first.
- Coming back: you may sign up again with the same number; it is a new account with no link to the old one.
11. Messages
- Service messages (codes, order confirmations, changes to an event you hold a ticket to, refunds, security notices) are part of the service.
- Notifications about artists and organizers you follow are sent only if you allow notifications.
- News and offers are off unless you turn them on in Profile, and you can turn them off at any time.
12. Children
Layali is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a person under 18 we close it and erase the data, keeping only what the law requires.
13. Changes
We will tell you in the app before a material change takes effect, and where a change needs your consent we will ask for it. Earlier versions are available on request.
Effective date: [date]. Version: 0.1-draft-2026-10-03.