Privacy Policy

YallaTonight ("Data Controller") collects personal data strictly necessary for the provision of its technical booking and payment facilitation services. Data collected includes:

• Identity Data: Full name, phone number, and email address.
• Transactional Data: Booking history, ticket details, loyalty points.
• Payment Data: Payment reference numbers only. Card details are processed and stored exclusively by PCI-DSS compliant payment processors. YallaTonight does not store card numbers.
• Technical Data: IP address, browser type, device ID, and session data for security and fraud prevention purposes.
• KYC Data (Partners only): Government-issued ID documents for identity verification, stored with restricted access.

YallaTonight processes personal data on the following legal bases: (i) contractual necessity — to execute bookings and deliver tickets; (ii) legitimate interests — to prevent fraud, maintain platform security, and improve services; (iii) legal obligation — to comply with Egyptian financial regulations and anti-money laundering requirements; and (iv) consent — for marketing communications, which may be withdrawn at any time.

Data is used exclusively to: process and confirm bookings; issue digital tickets; facilitate secure payments; send transaction and event notifications; prevent fraudulent activity; and improve platform functionality.

YallaTonight does not sell, rent, or trade personal data to any third party. Data is shared only with:

• Event Organizers: Guest name, ticket quantity, and booking reference — solely for event entry management.
• Payment Processors (Paymob, Fawry): Transaction-specific data required to process payments securely.
• Competent Legal Authorities: When required by Egyptian law, judicial order, or regulatory authority.

All third-party processors are contractually bound to handle your data in accordance with applicable data protection standards.

YallaTonight implements industry-standard technical and organizational security measures including TLS/SSL encryption for data in transit, bcrypt password hashing, CSRF token protection, rate limiting, and role-based access control. Despite these measures, no internet system is 100% secure, and YallaTonight cannot guarantee absolute security against all threats.

Retention: Active account and booking data is retained for the duration of your account plus 3 years for legal and accounting compliance. KYC documents are retained for 5 years. Access logs are purged after 90 days. You may request deletion of non-legally-required data by contacting our support team.

The Platform uses only functional, first-party session cookies strictly necessary for authentication, language preferences, and security (CSRF tokens). We do not deploy any third-party advertising, analytics, or tracking cookies. Disabling cookies in your browser will prevent you from using authenticated features of the Platform.

In accordance with applicable Egyptian data protection principles and international best practices, you have the right to:

• Access: Request a copy of personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of data where it is no longer necessary, subject to legal retention obligations.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, submit a request via our Support page. We will respond within 30 calendar days.

Your data is primarily stored and processed within the Arab Republic of Egypt. Where data processing involves systems operated by internationally-based payment processors, such transfers are governed by the respective processor's data transfer agreements and are conducted under appropriate safeguards. By using the Platform, you consent to such transfers as necessary for the provision of our payment facilitation services.

YallaTonight may update this Privacy Policy to reflect changes in applicable law or our data processing activities. Material changes will be announced via email to registered users and/or a prominent notice on the Platform. The date of the last revision is displayed at the top of this page. Continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

When you upload images — profile photos, event flyers, venue galleries, or KYC documents — we store them to provide the service and run them through automated moderation to detect prohibited, unsafe, or off-platform content. This includes automated text recognition (OCR) on flyers to catch external contact details or disallowed material. Please do not upload images of other people without their consent, or content you do not hold the rights to.

We also process location information: the city and venue address attached to a listing or booking, and — only if you explicitly grant your device's location permission — your approximate location to show nearby events. We do not track your precise location in the background, and you can revoke location permission at any time from your device settings.

You may request deletion of your account at any time. Send a request from the email address registered to your account via our Support page (subject: "Account Deletion"). We will verify the request and permanently erase your personal profile data.

Some records must be retained after deletion to meet legal, tax, anti-fraud, and accounting obligations — for example transaction and invoice records and dispute history — and are kept only for as long as the applicable law requires before being erased. Deleting your account does not cancel active bookings and does not entitle you to any refund outside the Refund Policy.