Skip to content

Draft, pending legal review. This text may change before it takes effect.

Privacy Policy

Last updated: 11 October 2026

This policy explains how [Legal entity name] ("Valyak", "we") handles personal data when you use the Valyak, Valyak Valet and Valyak Merchant apps, the Valyak web portals and this website. We are the controller of guest data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021); for data about venue teams we act with, or on behalf of, the venue that employs them. [Legal to confirm the controller and processor roles.]

Who we are

[Legal entity name], [Registered address, Dubai, United Arab Emirates], trade licence [Trade licence number]. For any privacy question, write to privacy@valyak.com.

The data we collect

Guests:

  • your mobile number, used to sign you in with a one-time code and to send your ticket link;
  • your name and email address, if you add them;
  • your cars: plate number, make, model and colour;
  • your valet tickets: venue, times, where your car was parked, and photos of your car taken at check-in;
  • payments and tips: amounts, dates, venue, and the card brand and last four digits (your full card number is held by our payment provider, Stripe, never by us);
  • membership, offers and referral credits you use;
  • your device's push notification token and the notifications we sent you;
  • your consents and language choice.

Valet staff and venue teams:

  • name, mobile number and email address;
  • venue, shifts, breaks, assignments and performance points;
  • tips received and their shares, and the bank account used for withdrawals (stored encrypted).

Everyone: technical records of sign-ins and actions in our systems (time, action and device type), kept for security; and any message you send our support team.

How we use it, and why

  • To run the valet service you asked for: checking your car in and out, sending your ticket link, telling you when your car is on its way. Basis: performing our contract with you.
  • To take payments and pay tips to staff. Basis: contract, and our legal duty to keep financial records.
  • To keep accounts secure and prevent fraud. Basis: our legitimate interest in a safe service.
  • To send offers or news, only if you agreed. Basis: your consent, which you can withdraw at any time.
  • To answer you when you contact us. Basis: your request.

We do not sell personal data, and we do not use it for automated decisions that have legal effects on you. [Legal to confirm.]

Who we share it with

  • The venue and valet operator serving you, so they can run the service.
  • Stripe, which processes card payments.
  • Providers that send SMS, WhatsApp, email and push notifications for us.
  • Our hosting and infrastructure providers.
  • Authorities, when the law requires it.

Every provider works under a written agreement and only on our instructions. Some providers process data outside the UAE; where they do, we rely on the safeguards the PDPL allows. [Legal to list the countries and safeguards.]

How long we keep it

  • Your account, cars, devices and consents: until you delete your account. A saved card is held by Stripe until you remove it or delete your account.
  • Tickets: the ticket record is kept for [N] years for the venue's and our records; when you delete your account, its plate number, car make, model, colour and year, description, photos and comments are erased.
  • Payments and tips: [N] years, as UAE law requires for financial records.
  • Notifications: 90 days.
  • Sign-in and action records: [N] months.
  • Messages sent through our contact form: 90 days after we mark your request handled, and in any case no more than 180 days after you sent it. Copies in our support mailbox: [Legal to set the mailbox period.]
  • Valet staff and venue teams: while you work with a venue on Valyak; afterwards, shifts, tips and withdrawals are kept for [N] years for payroll and financial records, without your contact details.
  • When an account is deleted, a minimal record remains with no name, number or email, so the payments and tickets linked to it stay valid. It cannot be used to identify you, and it is deleted with the last of those records.

Your rights

Under the PDPL you can ask us to:

  • give you a copy of your data (in the app or on the guest portal: Profile → Your data → Download);
  • correct data that is wrong;
  • erase your data (see Delete your account);
  • restrict how we use it;
  • send it to you, or another provider, in a machine-readable format;
  • stop using it, where we rely on our legitimate interests or for marketing.

Write to privacy@valyak.com from the phone number or email on your account. We reply within [30] days.

Where we rely on your consent, you can withdraw it at any time in your profile settings or by writing to us. Withdrawing it does not affect what we did before.

How we protect it

Data travels over encrypted connections (HTTPS), access is limited to the people who need it, bank details are stored encrypted, and sensitive actions are recorded in an audit log. [Legal to confirm against the security review.]

Children

Our services are not meant for anyone under 18, and we do not knowingly collect their data.

Complaints

If you are unhappy with how we handled your data, write to privacy@valyak.com first. You can also complain to the UAE Data Office.

Changes to this policy

We will post any change here with a new date, and tell you in the app before a significant change takes effect.