Privacy Policy
Mukhtar runs an employee and member perks network. Businesses and membership organisations (our clients) choose who is covered. Their people get perks at participating brands (our partners), and Mukhtar runs the platform in between. This policy explains what personal information we hold, why we hold it, who can see it, how long we keep it and the choices you have.
It covers this website, the Mukhtar app, the Corporate Portal, the Partner Portal, the till, our support chat and the emails we send. "Mukhtar", "we" and "us" mean Mukhtar Concierge & Management Services (Private) Limited, 541-A/1, Ghalib Market, Block A-1, Gulberg III, Lahore.
This version is dated 22 October 2026. It replaces all earlier versions of this policy, which described services we no longer offer.
The short version
- We hold what we need to run the perks platform: who is covered, the visits they make, and the people who manage the platform.
- Your organisation sees your visits. When you show your code, a partner sees your first name, the first letter of your last name and the name of your organisation. Partners never see your email address, phone number or CNIC.
- We do not sell personal information and we do not use it for advertising.
- You sign in with a six-digit code sent to your email. There are no passwords.
- Questions and requests go to care@mukhtar.com.pk.
What we collect
If your organisation gives you perks
Your organisation, whether it is your employer or a membership organisation, gives us the list of people it covers. Before it can add anyone, it must confirm to us in writing that it may share that list with us, and that it has told its people what we keep.
- From your organisation: your name, your email address and, if it includes it, your employee or member ID. Nothing else.
- Your visits: each time you use a perk, the brand and outlet, the date and time, the bill, the discount and what you paid. These add up to the savings shown in the app.
- When you open a code: the time, the offer and outlet, your internet (IP) address and, if you allow it, your phone's approximate location. We use these only to spot misuse. Your code works without your location.
- Your account: when you were added, when you signed in, and when your organisation switched you on or off.
If you manage perks for your organisation
- Your name, your work email address and your role in the Corporate Portal.
- When you last signed in.
- What you do in the Corporate Portal, for example adding people or switching someone off. These go into an activity log that your organisation can see.
If you work for a partner brand
- Your brand's details: its outlets, offers and photographs, and its statements, invoices and payments.
- For each member of your team: their name, role and the outlets they work at, an email address for anyone who signs in to the Partner Portal, and a mobile number if you add one.
- Till PINs. We never store a PIN itself, only a scrambled version used to check it.
- Till sign-ins: the outlet, the time, whether it worked and the network address, so that repeated wrong PINs lock the till.
- The till uses the counter device's camera only to read the code on the customer's phone. It does not keep pictures.
If you use the support chat
- Your messages, any photos or PDF files you attach, your name and the organisation or brand you belong to.
- If you link a conversation to a visit, the details of that visit.
If you contact us through this website
- The enquiry form: your name, your organisation or brand, your email address, your phone number, the rough size of your organisation if you give it, and your message.
- The workplace survey: your answers, the kind of device you used (phone, tablet or computer) and how long the survey took. It does not ask for your name, email address or phone number, and it does not store your internet address.
- To stop the form and the survey being flooded, we count submissions from each network under a scrambled code that changes every day. Counts more than two days old are cleared out the next time someone uses the form or the survey.
Technical information
- Sign-in records: when a code was asked for and used, the address it was sent to, the network address and the type of browser. Sign-in codes are stored only in scrambled form.
- The activity log: each successful sign-in to the Mukhtar app or the Corporate Portal is also recorded in our activity log, with the time and the internet (IP) address it came from. Your organisation sees when you signed in, but not the address.
- Emails: a record of the emails we send you (the address, the kind of email and whether it was delivered).
- On your device: our apps keep you signed in by storing a sign-in key on your device, and remember a few settings there, such as the city you chose in the Mukhtar app. The survey keeps your unfinished answers in your browser until you close the tab, and notes there that you have already answered it. This website and our apps do not use advertising or tracking cookies.
- Fonts and scripts: this website and our apps load their fonts from Google Fonts, and this website loads one small script from jsDelivr. Like any website, those services receive the usual details your browser sends, such as your internet address.
Why we use it
- To run the platform: to check who is covered, issue codes, let the partner check them at the counter, and apply the discount and the limits agreed with your organisation.
- To prepare statements and invoices for partners, and usage and savings for organisations.
- To send the emails the service needs: sign-in codes, invitations, weekly statements and replies to support messages.
- To answer support messages and enquiries.
- To protect the service and the people who use it: limits on sign-in attempts, locking a till after wrong PINs, and spotting codes used where they should not be.
- To keep our business and tax records and to meet our legal duties.
- To understand what people want and improve the service, for example from survey answers.
We do not sell personal information, and we do not use it for advertising.
Who can see it
Your organisation
The people who look after your organisation on the platform, in the Corporate Portal, can see the details your organisation gave us, when you have signed in, and each of your visits: the date and time, the brand and outlet, the bill, the discount and what you paid. If your organisation supplied them, they see the last four digits of your CNIC and whether a mobile number is on file, but not the number itself. They do not see your support conversations with us.
Partners
When you show your code, the cashier sees your first name, the first letter of your last name and the name of your organisation. In the Partner Portal, a partner sees the visits at its own outlets (the time, the bill, the discount and its statement) without names. Partners never see your email address, phone number or CNIC.
Colleagues on the same account
A support conversation started in the Corporate Portal can be read by everyone who looks after that organisation on the platform. One started in the Partner Portal can be read by the brand's owners and managers. A conversation started in the Mukhtar app is seen only by you and Mukhtar staff.
Mukhtar staff
Our staff see what they need to set up organisations and partners, run the platform, prepare statements and answer support messages.
Companies that help us run the service
Other companies host and run parts of the service for us. They handle information only to provide their service to us:
- Supabase hosts our database, sign-in, stored files and server functions. Our database is held on servers in Australia.
- Vercel hosts this website and our apps.
- Resend sends our emails.
Because these companies work from outside Pakistan, your information is stored and handled outside Pakistan.
When the law requires it
We may share information when the law requires it, or when we need to protect people or the service from fraud or misuse.
How long we keep it
- A sign-in code stops working after 10 minutes. Codes, and the records of each attempt to sign in to the Mukhtar app or the Corporate Portal, are deleted after 30 days.
- Visits, statements and invoices are part of the accounts we keep with organisations and partners. Once recorded they are not changed: a correction is added as a new entry. We keep them for as long as we need them for those accounts and for as long as the law requires.
- If your organisation switches you off, your account stops working that day and you are signed out everywhere. Your details and past visits stay on record, so that statements already sent stay correct.
- The activity log is kept as a lasting record of who did what. That includes each successful sign-in to the Mukhtar app or the Corporate Portal, with its time and internet address.
- Other information, such as support conversations, enquiries, team details and the sign-in records of the Partner Portal and the till, is kept while your organisation or brand works with us, and after that only for as long as we need it for our records or the law requires.
- The counts that protect the enquiry form and the survey are cleared out once they are more than two days old, the next time someone uses the form or the survey.
How we protect it
- Each person sees only what their role allows. These rules are enforced inside our database, not only in the apps.
- Sign-in codes, till PINs and CNICs are stored only in scrambled form. The key used to scramble CNICs is kept outside the database.
- Files attached to support messages are private. Only Mukhtar staff and the people in that conversation can open them.
- No CNIC or phone number is ever part of a code.
No system is perfectly secure. If we learn of a problem that affects your information, we will tell the people and organisations affected.
Your choices
- Location is up to you. You can refuse it on your phone and your codes still work.
- You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Some records we must keep, such as visits on statements already sent. If we cannot delete something, we will tell you why.
- Your name, email address and other details come from your organisation. You can ask it to correct them, or write to us.
- If you no longer want to be covered, tell your organisation, which can switch you off. You can sign out of the app at any time.
- To make a request, write to care@mukhtar.com.pk from the email address we hold for you, so we know the request is yours.
Organisations and partners
An organisation that gives us its list of people is responsible for having the right to share it and for telling its people what we keep. A partner is responsible for the details it adds about its own team. Each one's written agreement with us sets out the rest.
Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If a change is significant, we will also tell the organisations and partners we work with.
Contact
Mukhtar Concierge & Management Services (Private) Limited
541-A/1, Ghalib Market, Block A-1, Gulberg III, Lahore, Pakistan
care@mukhtar.com.pk