Privacy Policy
Last updated 26 Oct 2026
Daftar is an app that helps people who collect regular payments (for example tutors, landlords, building committees, gyms and clubs) keep track of who has paid and send payment requests from their own WhatsApp. This policy explains what information Daftar keeps, why, where it is stored, who helps us process it, and the choices you have. It was written with Jordan’s Personal Data Protection Law No. 24 of 2023 in mind.
Who is responsible
Daftar is responsible for your account information. For the people you add to your list, you decide who to add and what to record, and Daftar stores and processes that information on your behalf to provide the service.
Contact for privacy questions and requests: cibe@getdaftarapp.com
Information we collect
About you (the collector):
- Your name or business name and your email address.
- Your password, which is stored only in scrambled (hashed) form. We cannot read it.
- Your CliQ alias or CliQ phone number, which appears in your payment messages.
- If you allow notifications: a push notification token that identifies your phone to the notification service.
About the people you add:
- Their name, what the payment is for, and their WhatsApp number.
- The amount and schedule (weekly, monthly, yearly or one-time).
- Payment records you enter, including partial payments, extra amounts and amounts carried forward to the next payment.
- Messages sent to them: the type (request, reminder or remaining amount), when they were sent, how they were sent and their delivery status. We do not keep a copy of the message text.
- If they tap “I’ve paid” on their private payment page: that they did, and when.
- If automatic WhatsApp messages are turned on in the future: their “I’ve paid” and stop replies, and when these happened.
Daftar never receives bank details, card numbers or account balances, and never sees the payments themselves.
Why we use it
- To show your list, what is due, and who has paid.
- To prepare payment requests and reminders that you send from your own WhatsApp, and, if automatic sending is turned on in the future, to send them for you.
- To tell you when someone says they have paid, and to send you a reminder on collection days.
- To keep your account secure and the service working.
We do not sell your information, use it for advertising, or share it with anyone except the service providers listed below.
The private payment link
Each request and reminder ends with a private link for that one payment. Anyone who has the link can open a web page that shows only your name, what the payment is for, the amount due and the due date, with a button to say “I’ve paid”. The page never shows phone numbers or anyone else’s information. The link stops working once the payment is recorded as paid.
Only send a payment link to the person who owes that payment. To protect the page from abuse, we keep a scrambled (hashed) form of the visitor’s internet (IP) address for up to one day. It cannot be turned back into the address.
Your responsibility for the people you add
Only add people you have a real payment relationship with, and make sure they agree to receive payment messages from you on WhatsApp. Anyone who no longer wants messages can ask you to stop or to remove them, or contact us. If automatic messages are turned on in the future, they can also reply STOP.
Where it is stored
Your information is stored in a database run by Supabase, in its European data centre in Ireland (European Union). This means it is stored outside Jordan. Information is encrypted while it travels over the internet (HTTPS) and is protected by access rules that let each account see only its own data. A copy of your list is also kept on your phone so you can look at it when you are offline; signing out removes it.
Service providers
- Supabase (database, accounts and server functions): stores all the information described above.
- Meta / WhatsApp: when you open a message in WhatsApp, WhatsApp receives the person’s number and the message. WhatsApp’s own privacy policy applies to messages on WhatsApp. Daftar does not currently send messages through WhatsApp’s business service; if that is turned on in the future, WhatsApp will also receive the messages Daftar sends for you.
- Netlify (website hosting): hosts the payment page and these policy pages, and sees the visitor’s IP address and browser type when a page is opened.
- Expo push notification service: receives your push token and the text of notifications sent to your phone.
Each provider only receives what it needs to do its job.
How long we keep it
- Your account and list are kept for as long as your account exists.
- When you remove a person, their payment history and message records are deleted straight away.
- When you delete your account, everything is deleted straight away.
- Deleted information may stay in our provider’s backups for up to 30 days before it is overwritten.
- Push tokens are deleted when they stop working or when you delete your account.
- Payment links stop working when the payment is recorded as paid, and are deleted with the payment period.
- Scrambled (hashed) IP addresses used to limit tries on the payment page are deleted after one day.
Export and delete your data
- Export: Settings → Export my data creates a file (CSV) with your people, payment periods and payments.
- Remove one person: open the person and tap Delete.
- Delete your account: Settings → Delete account. This removes your account and all of your data.
Your rights
Under Jordan’s Personal Data Protection Law you can ask to see the information we hold about you, have it corrected or deleted, object to or limit how it is used, and withdraw your consent at any time. Most of this you can do yourself in the app. For anything else, or if you were added by a collector and want your information removed, email cibe@getdaftarapp.com. We will reply within 30 days. You can also complain to the Personal Data Protection Council in Jordan.
Security and data breaches
We use encryption in transit, strict per-account access rules, and keep secret keys only on the server. No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.
Children
Daftar accounts are for adults (18 or older). A collector may add payments that are for a child, such as lessons, but the contact number should belong to an adult.
Changes to this policy
If we change this policy, we will update the date above and tell you in the app before important changes take effect.