Privacy Policy

UAE Trade Licence No. 1640980

Last updated 18 Oct 2026

These documents are published in Arabic and English. If the two versions differ, the Arabic version prevails.

Who we are

Legacy International Club (the "Club") is operated by Legacy inter Online Seller, holder of trade licence no. 1640980 issued by the Department of Economy and Tourism – Dubai (DET), Dubai, United Arab Emirates ("we", "us"). We are the controller of the personal data described in this policy. Our company details are on the Company information page.

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations.

This policy alone governs how we process your personal data and prevails over anything in the Terms and Conditions that says otherwise about personal data. We rely on your consent only where this policy expressly says so.

Scope of this policy

This policy covers the Club's website, member portal and mobile applications (the "Service"), our contact form, and our communications with you. It does not cover partner businesses: when you use an offer at a partner, the partner handles any data it collects under its own policy.

The personal data we collect

Identity and contact data: first and last name, email address, your UAE mobile number when you add one to your account, and your preferred language.
Account data: login details (your password is stored only in hashed form by our authentication provider; we cannot read it), phone verification status, referral code, the sponsor recorded at registration, membership status, card serial number and account history.
Payment data: payment references, amount, method (card, or Tabby instalments where offered), status, refunds and disputes. Card numbers are entered directly with Stripe and are never stored by us. Tabby handles any checks it makes for instalment payments.
Payout data: the bank account holder name, bank name and IBAN you give us for withdrawals, your withdrawal requests and the bank references of transfers we make.
Wallet and privileges data: referral rewards, reservations and reversals in your wallet, and the offers you claim, including the partner branch and time of use.
Communications: messages you send through the contact form (name, email, optional phone, country and subject, the message, your language and the IP address), and notifications we send you.
Device and technical data: IP address, browser and device type, pages requested and error information, used to run and secure the Service. Before error reports are sent to our error-monitoring provider, names, email addresses, phone numbers and bank details are removed; they keep at most a pseudonymous identifier of your account.
Analytics data: how the Service is used (pages viewed, features used) and page-performance measurements; collected only if you accept analytics.

We do not collect special categories of personal data, and we do not use your data for automated decisions that produce legal effects for you.

How we use your data and our legal bases

Purpose	Data used	Legal basis
Create and secure your account, verify your phone	Identity, contact, account, technical	Performance of our contract with you
Take payment, activate the membership, issue the digital card	Identity, account, payment	Performance of our contract; legal obligations (tax records)
Record referrals, credit and reverse rewards, process withdrawals	Account, wallet, payout	Performance of our contract (Compensation Plan Rules)
Issue and verify partner vouchers	Account, privileges	Performance of our contract
Answer your messages	Communications	Taking steps at your request; performance of our contract with you where you are a member
Prevent fraud and abuse, keep the Service secure	Technical, account, payment	Legal obligations; performance of our contract; establishing or defending legal claims
Protect your withdrawals: when phone verification is available, ask you to re-verify your phone with a code before you save bank details, request a withdrawal or change your password in the app; pause withdrawals for 24 hours after you add a bank account or change its IBAN, and pause withdrawals and IBAN changes for 24 hours after a phone number is added to or changed on your account (our administrators may lift the phone pause early after confirming the change with you); show the dates of these changes to the staff who review withdrawals and support your account	Identity and contact (mobile number), account, payout, technical	Performance of our contract; legal obligations; establishing or defending legal claims
Improve the Service with usage analytics	Analytics	Your consent (you can withdraw it at any time)
Meet tax, accounting and legal requirements	Payment, payout, account	Legal obligations

We do not sell your personal data and we do not share it with partners for their marketing.

Payments and payouts

Stripe processes card payments and, where we offer instalments, Tabby processes them; each acts under its own terms and privacy policy for the checks it performs. We receive only the references and status needed to activate your membership and to handle refunds. Your IBAN is used only to pay your withdrawals; audit logs store it masked (last four digits only), and only staff processing your withdrawal see it in full.

Service providers

We use the following providers to run the Service. They process personal data on our behalf, under contracts that require them to protect it and use it only on our instructions:

Provider	What it does	Data involved
Supabase	Database, authentication and file storage	Account, payment references, wallet, payout, privileges and communications data
Stripe	Card payments, payment receipts and tax invoices	Payment data, and your name and email address for the receipt and tax invoice; card details are handled by Stripe only
Tabby	Instalment payments, where we offer them	Identity, contact and payment data needed for the instalment plan
Twilio	Sending SMS verification codes (and WhatsApp codes, where we offer them)	Mobile number, message content
Resend	Sending account and security emails	Email address, message content
Upstash	Rate limiting to protect sign-in, verification codes and forms	IP address, account identifier (kept for minutes)
Cloudflare	Bot protection on forms (Turnstile) and network security	IP address, browser signals
Sentry	Error monitoring	Technical data and, at most, a pseudonymous account identifier
PostHog	Usage analytics, only after your consent	Usage statistics with a random identifier, without your name, account or IP address
Vercel	Website hosting and delivery; and, only after your consent, visit analytics and page-performance measurement (Vercel Web Analytics and Speed Insights)	IP address and technical data; analytics and performance data after your consent

Where we offer verification codes by WhatsApp and you choose that option, the code is delivered through WhatsApp, a service of Meta, which processes the message under its own terms and privacy policy.

We use a small number of essential cookies that the Service needs to work. They are always on:

Cookie	Purpose	Duration
Session cookies set by our authentication provider (`sb-…`)	Keep you signed in	Until you sign out or the session expires
`NEXT_LOCALE`	Remember your language	Up to 12 months
`theme`	Remember light or dark display	Up to 12 months
`llc_ref`	Remember the referral code from a link you opened	30 days
`llc_consent`	Remember your cookie choice	12 months
`__Host-llc_stepup` (`llc_stepup` on test systems)	Confirms you recently entered a code sent to your phone before you save bank details, request a withdrawal or change your password	10 minutes
Cloudflare Turnstile	Tell people and bots apart on our forms	Short-lived

Analytics are optional and cover PostHog and Vercel's Web Analytics and Speed Insights tools. When you first visit, a banner asks you to choose Accept analytics or Essential only. None of these tools loads until you accept. If you accept, PostHog stores a cookie (ph_…_posthog) that recognises your visits for analytics, for up to 12 months. You can change your choice at any time with the "Cookie settings" link in the website footer; if you withdraw consent, analytics collection stops. Error monitoring (Sentry) is treated as essential for the security and reliability of the Service and receives only technical data and, at most, a pseudonymous account identifier, with names, email addresses, phone numbers and bank details removed.

International transfers

We store and process your data mainly outside the United Arab Emirates. Our database, authentication and file storage (Supabase), our web servers (Vercel) and our rate-limiting service (Upstash) are hosted in Mumbai, India (Vercel also delivers pages through its global network). Our error monitoring (Sentry) and, if you accept analytics, our usage analytics (PostHog) are hosted in the European Union. Some of the other providers listed above process data in the United States, the European Union or through global content-delivery networks. We transfer personal data only as the PDPL permits: where the transfer is needed to perform our contract with you, to countries with adequate protection, under contractual safeguards that require the provider to protect the data, or on another lawful ground.

How long we keep your data

Account, membership, payment and payout records: for as long as your account exists, and afterwards for as long as UAE law requires us to keep financial and tax records (at least five years).
Raw payment provider data (notifications received from Stripe and Tabby): deleted after 90 days; the payment record itself is kept as above.
IP addresses stored with contact messages and voucher redemption logs: deleted after 90 days.
If your account is deleted: we anonymise it. Your name, email address, phone number and bank details are removed and you can no longer sign in. We keep your membership, payment, payout and referral reward records, and the internal log of actions our staff took on your account, for as long as stated in the first item above, because the law requires us to keep financial records and we need them to prevent fraud. The raw data we received from payment providers and the content of your notifications are erased at that point, and the messages you sent us are kept without your name, email address, phone number or IP address.
Authentication service logs: our authentication provider, Supabase, keeps its own authentication audit log (sign-in events). It may still contain the email address or phone number you used before your account was deleted, and we cannot edit it.
Contact messages: kept for 24 months after the last message about them, and deleted within 3 months after that period, unless we need them for an open complaint or dispute. The IP address stored with them is deleted after 90 days.
Error reports: Sentry keeps error reports for 30 days.
Analytics data: If you accept analytics, we collect usage statistics without your name, your account or your IP address, and they cannot be linked back to you. We use them only for statistics, and they are available to us for up to 1 year, the retention period of our analytics provider's (PostHog, EU) Free plan. You can withdraw analytics consent at any time in Cookie settings. Vercel keeps Web Analytics and Speed Insights data for at most 12 months.

When data is no longer needed we delete it or make it anonymous.

Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, access controls based on roles, row-level security in our database, multi-factor authentication for administrators, a code sent to your phone, when phone verification is available, before bank detail, withdrawal and password changes, a 24-hour pause on withdrawals after bank or phone changes, security notices when your bank details or phone change, masking of bank details in audit logs, and audit logs of sensitive actions. No system is completely secure; if a data breach affects you, we will notify you and the authorities as the PDPL requires.

Your rights

Under the PDPL, and subject to its conditions and exceptions, you have the right to:

obtain information about, and a copy of, the personal data we hold about you;
have inaccurate data corrected and incomplete data completed;
have your data erased where it is no longer needed or was processed unlawfully;
restrict or stop the processing of your data in the cases the PDPL allows;
object to processing, including processing for direct marketing;
receive your data in a structured, machine-readable format and have it transferred to another controller where technically feasible; and
withdraw your consent at any time, without affecting processing already carried out.

Some data must be kept even if you ask us to delete it, for example payment records we must keep by law, or data needed to handle an open withdrawal, refund or dispute.

How to exercise your rights

Send your request through our Contact page from the email address on your account, or tell us how we can verify your identity. We will answer within the time the PDPL allows. Exercising your rights is free, unless a request is clearly unfounded or excessive. If you are not satisfied with our answer, you may complain to the UAE Data Office.