XPASS PRIVACY POLICY

Effective Date: 28/02/2026

Xpass (“App”, “Platform”) is operated by Darb Al Tibana For Software Development Co. LLC , a company

duly registered in the Hashemite Kingdom of Jordan under Registration No. 78252 and National Entity

No. 200208005, with its registered office in Amman, Jordan (“Company”, “we”, “us”, or “our”).

If you have any questions regarding this Privacy Policy, you may contact us at:

support@xpassjo.com

1. INTRODUCTION

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information

when you use the Xpass mobile application and related services.

By creating an account or using the App, you agree to the practices described in this Privacy Policy.

2. INFORMATION WE COLLECT

We collect the following categories of information:

2.1 Information You Provide Directly

●Full name

●Email address

●Phone number

●Profile photo

●Subscription tier selection

●Account login credentials

2.2 Location Data

With your permission, we collect precise GPS location data to:

●Display nearby gyms and fitness partners

●Improve user experience and service functionality

Location access can be disabled through your device settings, but certain features may not function

properly.

2.3 Check-In & Usage Data

●QR code check-in logs

●Visit history

●Gym attendance frequency

●Subscription activity

2.4 Payment Information

All payments are securely processed through Network International (MPGS –Mastercard Payment

Gateway Services).

We do NOT store:

●Full card numbers

●CVV codes

We may store limited payment metadata such as:

●Transaction reference ID

●Payment status

●Subscription duration

Apple Pay and Google Pay transactions are processed securely through Network International’s

payment infrastructure.

2.5 Technical & Analytics Data

Through Firebase (Google Cloud services), we may collect:

●Device type

●Operating system

●App version

●Crash reports

●Usage analytics

This helps us improve performance and security.

3. HOW WE USE YOUR INFORMATION

We use your data to:

●Create and manage your account

●Process subscriptions and payments

●Provide gym access via QR code

●Track visits and subscription usage

●Calculate partner gym payouts

●Improve app functionality

●Provide customer support

●Send marketing communications (only if you opt-in)

●Prevent fraud and misuse

4. INFORMATION SHARED WITH PARTNER GYMS

When you check in at a partner gym, the following information may be visible to that gym:

●Full name

●Profile photo

●Subscription tier

●Check-in logs and visit history

Additionally, gyms receive payout information from us based on total check-ins generated through the

platform.

Partner gyms are considered independent third-party service providersand are responsible for

handling any personal data they access in accordance with applicable laws.

5. DATA SHARING WITH THIRD PARTIES

We may share information with:

5.1 Payment Providers

● Network International (MPGS)

5.2 Cloud & Infrastructure Providers

● Firebase (Google Cloud services)

5.3 Legal Authorities

If required by Jordanian law or court order.

We do not sell, rent, or trade your personal data to third parties.

6. DATA RETENTION

We retain personal data:

●For the duration of your active account

●As required for legal, accounting, or regulatory purposes in Jordan

●To resolve disputes and enforce agreements

If you delete your account, we will delete or anonymize your personal data except where retention is

legally required.

7. ACCOUNT DELETION

Users may delete their accounts directly within the App.

Upon deletion:

●Your profile will be removed

●Access to the service will terminate

●Certain transactional records may be retained for legal compliance

8. MARKETING COMMUNICATIONS

You may receive promotional communications only if you opt-in within your profile settings.

You may withdraw consent at any time by:

●Disabling marketing toggle inside the app

●Contacting support@xpassjo.com

9. SECURITY

We implement reasonable technical and organizational security measures to protect your data,

including:

●Secure payment processing

●Encrypted data transmission

●Restricted administrative access

●Cloud security standards via Firebase

However, no system can guarantee absolute security.

10. CHILDREN UNDER 13

Xpass is not directed toward children under the age of 13.

We do not knowingly collect personal information from children under 13. If we become

aware that such data has been collected, it will be deleted promptly.

11. YOUR RIGHTS

Subject to applicable laws, you may:

●Access your personal data

●Correct inaccurate data

●Request deletion

●Withdraw marketing consent

Requests may be submitted to support@xpassjo.com.

12. INTERNATIONAL DATA TRANSFERS

Your data may be processed on cloud servers operated by Firebase (Google), which may be

located outside Jordan.

By using the App, you consent to such transfers.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically.

Changes will be effective once posted in the App or on our website.

14. CONTACT INFORMATION

Darb Al Tibana For Software Development Co. LLC

Amman, Hashemite Kingdom of Jordan

Email: support@xpassjo.com