Privacy Policy

Winly Technologies Ltd (company number 17217900, registered in England and Wales, registered office at 2nd Floor, College House, 17 King Edwards Road, Ruislip, London, HA4 7AE, United Kingdom) is the controller of your personal data when you use the Winly platform at winlyonline.com or its provider and admin subdomains.

We collect the following categories of personal data:

• Account data: your mobile phone number, name, optional email, language preference, and any profile photo you upload.
• Order data: the orders you place through the app (venue, items, quantities, notes, totals, and the cashback percentage in effect at the time of order), and the orders that Providers record against your phone number when you buy in person.
• Delivery data: for delivery orders, the address you selected (street, city, coordinates, and any notes you added for the driver), plus the delivery status and PIN code we generate for handover.
• Payment data: your payment method choice (Whish Money). If you pay via Whish, we receive an anonymous transaction ID and settlement status from Whish. We do not receive or store your Whish credentials, card details, or bank details.
• Payout data: the Whish Money number you provide so we can send your cashback to you, plus the amount and status of each cashback payout.
• Game data: the picks you submit, when you submitted them, and the outcomes.
• Location data (optional): if you give your permission, we use your approximate device location to surface nearby venues, sort search results, and check whether a Provider delivers to where you are. You can revoke this at any time in your device settings; when you do, we fall back to your saved addresses.
• Saved addresses: the delivery addresses you save on your profile (label, street, city, coordinates).
• Identity verification data: where we are required to verify your identity before a cashback payout, the outcome of the check performed by our identity partner. The underlying identity documents are held by that partner, not by Winly.
• Communications: when you contact support, we keep a record of the message and our reply.
• Technical data: device, browser, IP address, language, time of access, and operational logs needed to run and secure the service.

We do not knowingly collect data from children under 18. If you believe a minor has registered, tell us and we will close the account.

We use your data to:

• create and maintain your account;
• process and fulfil the orders you place;
• pass the delivery address and order details to the Provider so their driver can reach you;
• compute delivery fees based on your address distance;
• attribute in-person sales recorded by Providers to your account;
• run the prediction game and resolve outcomes fairly;
• send your cashback to your Whish number when your pick wins;
• send you notifications related to your account and orders (order placed, order accepted, out for delivery, delivered, pick invitation, pick reminder, win notification, payout sent);
• detect, prevent, and investigate fraud and abuse of the platform;
• comply with our legal, regulatory, tax, and accounting obligations;
• improve the platform through aggregated and de-identified usage analysis.

Depending on the activity, we rely on one of the following: the performance of our contract with you (these Terms), our legitimate interests in running and protecting the platform, your consent (for example, for optional location use or marketing), and compliance with a legal obligation.

We share the minimum personal data needed with the following categories of partners, and only for the purposes set out here:

• Providers (venues you order from): when you place an order or a Provider records an in-person sale, the Provider sees your phone number, your first name, your delivery address (delivery orders only), and the details of that order. They do not see your order history at other venues, your saved addresses at other Providers, or your picks.
• Delivery drivers: the venue’s own driver sees your first name, phone number, delivery address, and the 4-digit delivery PIN needed to hand over the order. Winly is not the delivery operator.
• Whish Money processes your inbound payments and, once your Whish number is on file, delivers your cashback payouts. We share only the amount, order/payout reference, and your Whish number.
• Messaging providers: Twilio (SMS and OTP), Meta / WhatsApp (order and pick notifications), and Resend (email) deliver the messages listed above.
• Mapping and geocoding partners: OpenStreetMap & Nominatim (address search + reverse geocoding) and OSRM (real driving-distance routing for delivery fees). Only the coordinates being looked up are sent. No account data.
• Identity verification partner: when an identity check is required for a cashback payout, we use a regulated identity provider that processes your documents to confirm your identity.
• Hosting and infrastructure: Hetzner (servers), Cloudflare (edge, R2 file storage), Vercel (customer web hosting), and Neon-compatible Postgres (database).
• Error and operational monitoring: Sentry helps us detect technical errors. We strip personal data from error reports where we reasonably can.
• Law enforcement and regulators: where we are legally required to disclose data, or where it is necessary to protect rights or the safety of users.
• Professional advisors and successors: lawyers, auditors, and (in the case of a merger, acquisition, or sale) the acquiring party, under appropriate confidentiality terms.

We do not sell your personal data. We do not allow our partners to use it for their own marketing.

Some of our partners process data outside Lebanon and the United Kingdom. Where we transfer personal data internationally, we rely on the safeguards permitted under applicable law, including standard contractual clauses with the partner.

We keep account, order, delivery, payment, payout, and game data for as long as your account is active and for a reasonable period afterwards so we can meet legal obligations, resolve disputes, and enforce our agreements. Operational logs are kept for a shorter period (typically up to 12 months) and then deleted or aggregated. Identity-verification outcomes are kept for the period required by the laws that apply to us.

You have the right to access your personal data, to ask us to correct inaccurate data, to ask us to delete data we no longer have a reason to keep, to object to certain processing, and to ask for a copy of your data in a portable format. To exercise any of these rights, write to support@winlyonline.com from the email or phone we have on file. We may need to verify your identity before acting on a request.

If you are not happy with our response, you have the right to complain to your local data-protection authority.

We protect your data with the controls you would expect of a modern platform: encrypted connections, encrypted storage, tightly scoped access for our team, multi-factor authentication on administrative accounts, brute-force protection on the delivery PIN, and continuous monitoring. No system is perfect; please tell us at once if you believe your account has been compromised.

We use a small number of cookies and local-storage entries that are needed to keep you signed in, remember your language and location, cache your last delivery address, and run anti-abuse checks. We do not use third-party advertising cookies. You can clear cookies in your browser at any time; if you do, you may need to sign in again.

We may update this policy. If a change materially affects how we use your data, we will tell you in the app or by message. The "Last updated" date at the top of this page always reflects the current version.

Privacy questions go to support@winlyonline.com. Postal mail can be sent to our registered office in section 1.