Privacy Policy
Last updated: 14 juin 2026
1. Introduction
This Privacy Policy describes how Muwali Inc. ("Muwali", "we", "our") collects, uses, shares, and protects the personal data of users of the Muwali mobile application (the "Application").
We are committed to protecting the privacy of our users in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25 on the protection of personal information in the private sector, and any other applicable legislation.
2. Data Collected
We collect different types of data to provide and improve our service.
2.1 Data Provided by the User
| Data | Purpose | Required |
|---|---|---|
| Email address | Authentication, communications | Yes |
| Last name / First name | Profile identification | Yes |
| Profile picture | Account personalization | No |
| Phone number | Contact (organizers/owners) | No |
| Language preferences | FR/EN/AR/ES display | Yes |
2.2 Automatically Collected Data
| Data | Purpose |
|---|---|
| Geolocation (if authorized) | Display of nearby establishments |
| Device identifier | Push notifications, analytics |
| Usage data | Application improvement |
| IP address | Security, fraud prevention |
2.3 Payment Data
- Credit card information is collected and processed exclusively by Stripe, Inc. Muwali never stores, accesses, or processes credit card numbers.
- Transaction data (amount, date, status) is retained for order management and accounting purposes.
2.4 Organizer and Owner Data
- Identity information for KYC (Know Your Customer) verification, processed by Stripe
- Banking information for transfers, processed by Stripe
- Data about published events or establishments
3. Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Account creation and management | Performance of contract (Terms of Service) |
| Payment processing | Performance of contract |
| Transactional notifications | Legitimate interest |
| Geolocation | Explicit consent |
| Push notifications | Explicit consent |
| Fraud prevention | Legitimate interest / Legal obligation |
| Application improvement | Legitimate interest |
| Marketing communications | Explicit consent |
4. Data Sharing
We share your data with the following partners:
- We never sell your personal data to third parties.
- We do not share your data for advertising purposes with third parties.
Stripe, Inc.
Payment processing and Connected Account management. KYC/AML (anti-money laundering) compliance. See Stripe's Privacy Policy (stripe.com/privacy).
Firebase (Google)
User authentication. Push notifications (Firebase Cloud Messaging). See Google's Privacy Policy (policies.google.com/privacy).
Event Organizers
When you purchase a ticket, the Organizer receives your name and email for event management purposes.
Competent Authorities
If required by law or by a court order.
5. Storage and Security
5.1 Data Location
- Backend: Servers hosted in Canada (MongoDB)
- Authentication: Firebase (Google Cloud, North American servers)
- Payments: Stripe (PCI DSS-compliant secure servers)
5.2 Security Measures
- Data encryption in transit (HTTPS/TLS)
- Secure authentication via Firebase Auth
- Temporary access tokens with automatic renewal
- No sensitive data stored on the device (no passwords, no persistent tokens in plain text)
- PCI DSS compliance via Stripe (no card data passes through our servers)
5.3 Retention Period
| Data | Duration |
|---|---|
| User account | Until account deletion |
| Transaction data | 7 years (accounting obligations) |
| Security logs | 12 months |
| Geolocation data | Not retained (used in real time only) |
6. Your Rights
In accordance with applicable laws (PIPEDA, Quebec's Law 25), you have the following rights:
6.1 Right of Access
You may request a copy of all personal data we hold about you.
6.2 Right of Rectification
You may modify your personal information directly in the Application or contact us for a correction.
6.3 Right of Deletion
You may request the deletion of your account and personal data. Certain data may be retained to comply with our legal obligations (transaction data for 7 years).
6.4 Right to Withdraw Consent
You may withdraw your consent at any time for:
- Geolocation (via your device settings)
- Push notifications (via your device settings)
- Marketing communications (via the Application settings)
6.5 Right to Portability
You may request to receive your personal data in a structured and commonly used format.
6.6 Right to File a Complaint
You may file a complaint with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada.
7. Cookies and Tracking Technologies
The mobile Application does not use cookies. However, we use:
- Firebase Analytics: to understand Application usage (aggregated and anonymized data)
- Expo Updates: for over-the-air updates of the Application
8. Minors
The Application is not intended for persons under 13 years of age. We do not knowingly collect personal data from minors under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.
9. Data Protection Officer
For any questions regarding the protection of your personal data:
- Email: support@muwali.io
- Address: Muwali Inc., Montreal, Quebec, Canada
10. Modifications
We reserve the right to modify this Privacy Policy. Modifications will be notified via the Application. Continued use of the Application after notification constitutes acceptance of the modified policy.
11. Links to Other Policies
- Stripe Privacy Policy (stripe.com/privacy)
- Google/Firebase Privacy Policy (policies.google.com/privacy)
- Muwali Terms of Service (/terms)
- Muwali Refund Policy (/refund-policy)