Privacy policy

Effective 22 October 2026. This policy explains what personal data CardMax collects through the CardMax app (Android and iOS) and the website cardmaxrewards.com, why we collect it, who we share it with and the choices and rights you have. CardMax is operated by [legal name of the CardMax company], a company registered in the United Arab Emirates under licence number [licence number], with its address at [registered address] (“CardMax”, “we”, “us”).

We wrote this to be read, not skimmed past. If anything is unclear, email cardmax.uae@gmail.com.

The short version

• We never ask for your full card number, expiry date, CVV, PIN or online banking login, and we can’t make payments or apply for anything on your behalf.
• We use what you tell us (the cards you hold and the purchases you log) to tell you which card pays you most.
• Location, notifications and bank-alert reading are optional and only switched on with your permission.
• We don’t sell your personal data, we don’t show ads and we don’t pass your details to banks.
• You can delete your account and data from inside the app at any time.

1. Information we collect

Information you give us

• Account details: your name and email address. Your password is handled by our sign-in provider (Google Firebase Authentication) and is never visible to us.
• Your wallet: the card products you add (for example “ADCB 365 Cashback”). Optionally, the last four digits of a card so you can tell two cards apart, a payment due date and reminder settings.
• Purchases you log: the shop or merchant, its category, the amount (optional), the date and which card you used.
• Preferences: for example the goals you pick when you sign up (such as “know if my annual fee is worth it”), memberships you tell us you have (such as Careem Plus), spending budgets and saving goals, card perks you choose to track and mark as used, and your preferred reward type. We use your goals to choose which features to show you first.
• Things you send us: reports of wrong card data, requests to add a card, and emails to support.
• Website waiting list: your email address, the page you signed up on and the time.

Information collected with your permission

• Location (optional). With your permission, the app uses your device’s location to show nearby shops and which card to use there. If you ask for an arrival reminder at a shop you searched for, the app sets a geofence around that shop so it can remind you when you get there, including when the app is closed or not in use (background location). We use your location on your device to find nearby places; we don’t keep a history of where you have been. A reminder you set is stored (the shop and its coordinates) until it is used or expires. You can turn location off at any time in your device settings.
• Notifications (optional). To send payment-due and arrival reminders and service messages, we store a push-notification token for your device.
• Bank-alert logging (optional, Android only, not yet available to the public). If you switch it on, CardMax uses Android’s notification access to read transaction alerts posted by your own banks’ apps, so purchases can be logged without typing. Android gives an app with this permission every notification on the device; CardMax ignores and immediately discards anything that isn’t from a bank app on its list, and never reads text messages (SMS) or messaging apps. From a bank alert we keep the amount, currency, merchant, time, the last four digits of the card and the alert text with any remaining-balance figure removed. You can switch it off at any time in Android’s notification-access settings.

Information collected automatically

• App usage: we use Google Firebase Analytics to understand how the app is used, for example which screens are opened and when someone taps Apply. It records events together with an app-instance ID, device model, operating system, app version, language and an approximate location derived from your IP address. We don’t use it for advertising and we don’t link it to advertising IDs.
• Days you open the app: we record the date of each day you open CardMax, and when you last opened it (never where you were), so we can count how many people use it each day and month. It is stored with your account and deleted with it.
• Apply clicks: when you tap Apply on a card we record which card, when, from which screen, and a random click reference that may be passed to the bank or affiliate network so a resulting commission can be matched.
• Technical logs: like any online service, our hosting and database providers process your IP address and basic request information to deliver the service and keep it secure.

What we don’t collect

Full card numbers, expiry dates, CVV codes, PINs, online-banking passwords, bank statements, your contacts, photos, microphone, or your text messages. CardMax does not connect to your bank accounts.

2. How we use your information, and why we’re allowed to

We don’t make decisions about you that have legal or similarly significant effects based solely on automated processing. Card recommendations are suggestions; you decide which card to use or apply for.

3. Who we share it with

• Service providers that run parts of CardMax for us, under contracts that require them to protect it and use it only on our instructions: Google (Firebase Authentication, Cloud Firestore database, Firebase Analytics, Firebase Cloud Messaging, Firebase Hosting and, for testers, Firebase App Distribution); Apple and Google when you download the app or (if offered) pay for a subscription; and our email provider when you write to us.
• Banks and affiliate networks: only the click reference described above, when you choose to tap Apply. Anything you then enter on a bank’s site is between you and the bank, under its own privacy policy. We don’t send banks your name, email, wallet or purchases.
• De-identified statistics: we may share aggregated insights with banks, partners and investors, for example “cardholders using CardMax spend most on groceries”. These never identify you, and any group smaller than three people is not shown.
• Legal reasons: if the law, a court or a competent UAE authority requires it, or to protect the rights, safety or property of CardMax, our users or others.
• Business changes: if CardMax is merged, acquired or sells its assets, your information may transfer to the new owner, who must keep honouring this policy. We’ll tell you before that happens.

We do not sell your personal data, rent it, or share it for advertising.

4. Where your data is stored

Your account and app data are stored in Google Cloud Firestore in the europe-west6 region (Zurich, Switzerland). Some of our providers, including Google for analytics and sign-in, may process data in other countries, including the United States. Where personal data leaves the UAE we rely on the safeguards the UAE Personal Data Protection Law allows, including the provider’s data protection terms and standard contractual protections.

5. How long we keep it

We may keep information longer only where UAE law requires it.

6. Security

Data is encrypted in transit and at rest by our providers. Database access rules mean each signed-in user can only read and change their own records. Only a small number of CardMax staff can view user records, for support and operations. We never store full card numbers, expiry dates or CVVs. No system is perfectly secure; if a breach affects your personal data, we’ll notify you and the UAE Data Office as the law requires.

7. Your choices

• Location, notifications and bank-alert access can be turned on or off at any time in your device settings. The app keeps working without them, with fewer features.
• Marketing emails (if we send any) always include an unsubscribe link.
• Delete your account in the app under Profile → Delete account, or on the web at cardmaxrewards.com/delete-account.

8. Your rights under the UAE Personal Data Protection Law

Subject to the law, you can ask us to:

• tell you what personal data we hold about you and how we use it, and give you a copy;
• send your data to you, or to another provider, in a commonly used format;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or stop processing it;
• withdraw any consent you gave, without affecting what was done before;
• object to decisions made solely by automated processing that significantly affect you.

Most of this you can do yourself in the app. Otherwise email cardmax.uae@gmail.com from the address on your account. We may need to confirm it’s you, and we’ll reply within 30 days. If you’re unhappy with our answer you can complain to the UAE Data Office.

9. Withdrawing consent

You can withdraw consent at any time by switching the feature off, deleting your account, or emailing us. Some features need certain data to work; if you withdraw it, those features stop.

10. Children

CardMax is for adults aged 18 and over, because it is about credit cards. We don’t knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we’ll delete it.

11. The website and cookies

The website sets no advertising or analytics cookies. We count visits anonymously: each day we add up page views, visits, waiting-list sign-ups and where visits came from (for example Instagram or Google, from the link you followed). We don’t store your IP address or anything that identifies you; a note in your browser’s session storage, deleted when you close the tab, stops one visit being counted twice. Cards you add to the compare tray and figures you type into the calculator stay in your own browser and are never sent to us. Pages are served by Google Firebase Hosting and fonts load from Google Fonts, which receive your IP address and browser details to deliver them. If we ever add cookies or third-party analytics we’ll update this policy and, where required, ask you first.

12. Links to other sites

Bank websites, affiliate networks and other sites we link to have their own privacy policies. We’re not responsible for how they handle your information.

13. Changes to this policy

We’ll post any change here with a new effective date. If a change materially affects how we use your personal data, we’ll tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.

14. Contact us

CardMax is operated by [legal name of the CardMax company], a company registered in the United Arab Emirates under licence number [licence number], with its address at [registered address]. Questions, requests or complaints: cardmax.uae@gmail.com.