Privacy Policy
Last updated: 27 October 2026
Who we are
FunFi is a personal finance learning app for people who live in the United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Bahrain and Oman, provided by Vertex Tech Ltd ("we", "us"). We decide how the personal data described in this policy is used, so we are its controller under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
If you have a question about this policy or your data, email [email protected].
What this policy covers
This policy covers the FunFi app for iPhone and Android and the FunFi website. It explains what we collect, why we use it, who helps us, how long we keep it and what you can ask us to do.
What you give us
- Your first and last name, a display name and a username.
- Your email address or your phone number, depending on how you sign in. Sign-in by phone is offered only for UAE phone numbers. If you sign in with Apple or Google, they share your name and email address with us. Apple may give us a private relay address instead of your real one.
- Your date of birth, and your gender if you choose to add it.
- Your country of residence, which you pick when you join. If you live in the UAE, also the emirate you pick. A city, if you add one. We do not read your location from your phone.
- A security PIN. We store only a protected form of it (a hash), never the PIN itself.
- Your answers to the questions when you join, your avatar, your language and sound settings, and whether Sharia mode is on.
- The questions you ask Toro and the answers Toro gives you.
- If you redeem a gift card: a photo of a government ID (an Emirates ID, a driving licence or a passport) and a selfie.
- Anything you write to us, including the optional reason you give when you delete your account.
What is created when you use FunFi
- Your lesson answers, quiz results, streaks, coins, XP, hearts, badges, levels and leaderboard positions.
- Your gift-card orders and the codes issued to you.
- Records of invitations, when you invite a friend or join with a friend's code.
What comes from your device
- When you apply a friend's invitation code, an identifier created for your installation of FunFi and your IP address. We use them to stop one person claiming invitation rewards many times.
- When you ask for a code to reset your PIN, your IP address, stored with the request. We use it to limit repeated requests, and we delete it about 24 hours later.
- After you accept the Terms of Use, which features you use, the model of your phone, its operating system and language, and the app version. If FunFi crashes or hits an error, a report about it. See "Analytics and crash reports".
- If you allow notifications, the token your phone gives FunFi to deliver them, and your phone's language. See "Notifications".
What we do not collect
We do not collect your location from your device, your contacts, any photos other than the two you choose for an identity check, your browsing history, or payment card details. When you unlock FunFi with Face ID or a fingerprint, your phone does the check and tells FunFi only whether it matched. We never receive your face or fingerprint data.
Why we use it
- To run your account and the app: signing in, your profile, lessons, rewards, streaks, leaderboards, Toro and the Market. We need this to provide the service you signed up for.
- To check your age and identity before a gift-card redemption, and to apply the age limits. A member of our team looks at your ID and selfie and compares them by eye. We do not use automated face recognition.
- To keep FunFi fair, by detecting cheating, duplicate accounts and repeated invitation claims.
- To show you the right content: your language, Sharia mode, content for your country and, in the UAE, your emirate, the gift cards sold in your country with amounts in its currency, and sponsor promotions only if you are 18 or over. We use your date of birth to decide this.
- To reply when you contact us.
- To understand how FunFi is used and to fix problems, through analytics and crash reports.
- To meet our legal obligations and respond to lawful requests from UAE authorities.
Some of this data needs your consent, for example the ID and selfie photos, and Sharia mode, which can reveal a religious preference. We ask before we collect it, and you can withdraw your consent at any time. Withdrawing does not undo what happened before, and some features cannot work without the data. For example, a gift card cannot be redeemed without an identity check.
Analytics and crash reports
FunFi sends usage events to PostHog, hosted in the European Union. Usage events start only after you accept the Terms of Use. Each event says which feature you used, such as starting a lesson or opening the Market, and carries your FunFi account number, whether you are under or over 18, the model of your phone, its operating system and language, and the app version. Usage events never carry your name, email address, phone number, date of birth or whether Sharia mode is on. PostHog is set not to keep your IP address and not to work out your location from it. PostHog does not record which screens you open, when you open or close the app, or what is on your screen.
Crash reports go to Sentry. Sentry receives reports about crashes, errors and performance, and no usage events. A report describes the problem, the screens that led up to it and the phone it happened on (model, operating system and app version). Crash reports can be sent before you sign in; after you accept the Terms of Use they carry your account number, so we can find the problem.
We do not use advertising networks, we do not track you across other companies' apps or websites, and we do not sell your personal data.
Notifications
If you allow notifications, FunFi sends them through OneSignal. FunFi asks after you pass a lesson, and your phone shows its own prompt only if you choose Turn on. OneSignal receives your FunFi account number, the token your phone gives for notifications, your phone's language and the text of each notification, such as "Your gift card is ready". It does not receive your name, email address, phone number or date of birth, and FunFi does not share your location with it.
Every notification also appears in the inbox inside the app. You can turn notifications off in FunFi's settings or in your phone's settings. Sponsor notifications go only to learners aged 18 or over. When your account is deleted, we also delete your record at OneSignal.
Toro, the AI tutor
When you ask Toro a question, the text of your question is sent to OpenAI together with short excerpts from FunFi lessons, so that OpenAI's model can write the answer. We do not send your name, email address, phone number or account number with it. Please do not type personal details into Toro. We keep your conversations in your account so you can read them again.
Toro's answers are for learning only and are not financial advice.
Who we share it with
We do not sell your personal data, and we do not share it with sponsors. The following providers process data for us, under contract, only to provide their service to us:
- Supabase, which hosts our database, sign-in and file storage on Amazon Web Services.
- Twilio, which sends sign-in codes by SMS.
- Resend, which sends our emails, such as password reset links.
- Apple and Google, if you choose to sign in with them.
- OpenAI, which writes Toro's answers as described above.
- PostHog, for analytics.
- Sentry, for crash reports.
- OneSignal, which delivers notifications to your phone if you allow them.
- The gift-card supplier, YouGotaGift, which issues your card. It receives the card, its value, the country and the currency, and not your name or contact details.
Other learners can see your display name (or your username if you have no display name), your avatar and your scores on leaderboards.
We may also disclose personal data when UAE law requires it, to protect someone's safety, or to a buyer if the business is sold, who would have to protect it in the same way.
Where your data is stored
Our database is hosted by Supabase on Amazon Web Services, in a data centre outside the UAE. Some of our providers, such as OpenAI, Twilio, Resend, OneSignal, PostHog and Sentry, also process data outside the UAE, for example in the United States or the European Union. When personal data leaves the UAE, we rely on the grounds the PDPL allows for transfers abroad.
How long we keep it
- Your account data is kept while your account is open.
- When you delete your account, it is erased 24 hours later. See "Deleting your account" below for what is erased and what is kept.
- ID and selfie photos are kept in private storage until our team has reviewed them, and are deleted automatically 30 days after the review. If you delete your account first, they are deleted with your account. The record of the check (who reviewed it, the result, the reason and the type of document) stays with your account until your account is deleted.
- The IP address stored with a request for a PIN reset code is deleted, with the request, about 24 hours later.
- Analytics data is kept by PostHog and crash data by Sentry, for the period set in those services. They are linked only to your account number, which no longer points to anyone once your account is deleted.
- If you signed up for launch updates on the website, your email address and language are kept until you ask us to remove them, or until launch updates end.
- Backups kept by our hosting provider may contain your data until they are replaced in the normal backup cycle.
Deleting your account
You can delete your account in the app: open your Profile, then Pin & Security, then Delete My Account. Your account is erased 24 hours later, and you can cancel during those 24 hours. If you no longer have the app, email [email protected] from the email address or with the phone number on your account and ask us to delete it.
When your account is erased, we delete your profile, sign-in details, PIN, lesson history, coins, XP, streaks, badges, Toro conversations, gift-card orders and codes, identity check records, ID and selfie photos, and notifications, including your record at OneSignal. The photo files are removed from storage shortly after the account itself, normally within about 15 minutes. Any coins and unused gift-card codes are lost.
A few records are kept after deletion:
- Records of actions our team took on your account, such as the result of an identity review (including the date of birth checked), a manual coin adjustment, a suspension or a deletion request. They are kept in a log that cannot be edited, so we can account for what our team did.
- If you joined with a friend's invitation code, your friend's record of the invitation stays with their account, with your phone, device and network details removed.
Keeping your data safe
All traffic between the app and our servers is encrypted (HTTPS). Database access rules let each learner read only their own account data. ID and selfie photos are kept in private storage that only our administrators can open; people who write lessons cannot. Your PIN is stored only as a hash. No system is completely secure. If a breach affects your personal data, we will tell you and the UAE Data Office where the law requires it.
Age
FunFi is for ages 13 and up. Do not use FunFi if you are under 13. When you sign up, FunFi does not accept a date of birth that shows you are under 13 or that is in the future. If you are under 18, you should have a parent's or guardian's permission to use FunFi. Gift-card redemption is closed to anyone under 13, and learners aged 13 to 17 have lower monthly limits. If you think a child under 13 is using FunFi, email us and we will delete the account.
Your rights
Under the PDPL you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong;
- delete your data;
- restrict or stop using your data, or object to how we use it;
- give you your data in a structured form so you can move it;
- stop processing that relies on your consent.
You can edit most of your profile and delete your account yourself in the app. For anything else, email [email protected] from the email address or with the phone number on your account. We may ask you to confirm it is you, and we will reply within 30 days. If you are not happy with our answer, you can complain to the UAE Data Office.
Permissions on your phone
- Camera and photos: used only when you take or choose the photos for an identity check.
- Face ID or fingerprint: optional, and used only to unlock FunFi on your phone.
- Notifications: optional. FunFi asks after you pass a lesson, and you can turn them off at any time.
The website
The FunFi website sets no cookies and uses no analytics or trackers. It remembers your language choice in your browser's own storage. Like any website, the company that hosts it may record standard technical logs, such as IP addresses, to keep the site running and secure.
The launch updates form on the website collects only your email address and your language. We use them only to tell you when FunFi launches and to send you launch updates. You can stop these at any time by emailing [email protected]. Your email address is stored with our database provider, Supabase. We keep it until you ask us to remove it, or until launch updates end.
To stop the form being misused, we also keep a coded form of your IP address for a short time. It cannot be turned back into your IP address and is not linked to your email address.
Changes to this policy
When we change this policy we will update the date at the top. If a change is significant, we will tell you in the app before it applies.
Contact
Vertex Tech Ltd, for FunFi. Email: [email protected]