Staff accounts in Waya: who gets to see what

Start with what a cashier should never touch

In Waya, a staff account is a sub-account under your shop, and its access is controlled by seven permission checkboxes. Billing, your subscription, branch setup, shop details, and the team panel itself are not on that list. Those screens exist only behind the owner login, so there's no combination of checkboxes that hands a cashier your payment page.

The seven grants are: view dashboard, view customers, notifications (view and send), campaigns, add points and redeem, deduct points, and card designer. A staff member only sees the sidebar tabs their role opens. A classic cashier ends up with three: the Scan and Redeem screen, a how-to tab, and the staff guide.

Two things Waya doesn't do are worth saying here. There's no POS integration, so there are no till or refund permissions to reason about — staff work from an ordinary phone next to whatever terminal you already use. And the permission check isn't just a hidden menu item: the server re-checks the grant on every stamp, redemption, and correction, so an account without deduct rights can't remove a stamp even if the request bypasses the interface.

Adding a new hire takes about two minutes

Open Settings, then Team, then add a member. You fill in four things: a display name, a username, a password you choose, and the role. Optionally you pick the branch the person works at.

There's no email address field, and that's deliberate. A staff account is identified by a handle: 3 to 30 characters, lowercase letters, numbers, and underscores, checked for availability as you type. Your new hire signs in at trywaya.com/login with that handle instead of an email, which means you never have to ask a part-time cashier for access to a personal inbox.

Waya shows the username and the password once, immediately after the account is created. Copy them and hand them over in person. No invitation email goes out, because the account isn't attached to a mailbox to send one to.

If you assign the member to a branch, their scan screen is pinned to that branch and the branch selector disappears. A cashier in Jeddah then can't accidentally record a visit against your Riyadh location, which is the single most common source of messy branch numbers.

Use roles, not one-off checkboxes

Permissions live on named roles, not on individual people. The first time you open the Team panel, Waya seeds two starter roles: a cashier role with add and deduct rights, and a branch-manager role that has every permission except campaigns. Rename either one, or build your own from a blank set of checkboxes.

Editing a role rewrites the access of everyone assigned to it. If you have six cashiers and you decide none of them should be removing stamps anymore, that's one checkbox, once, not six edits. This is the whole reason to resist the temptation to give each person a bespoke setup.

Campaign creation is left out of the branch-manager template on purpose. Campaigns change how fast rewards are earned across the whole shop, so it's an explicit grant rather than something a manager inherits by default.

One gotcha to know before you tidy up: deleting a role does not strip access from the people on it. They keep the permissions they had and simply end up with no role attached, which makes them harder to manage later. Move members to a different role first, then delete the empty one.

The three grants worth thinking hard about

Deduct points is the first. Corrections need it — a double stamp, a mis-scanned card, a reward marked used by mistake. It's also the quiet way a stamp disappears without a trace. The cashier template ships with both add and deduct switched on so existing teams saw no change in behavior, so if you want stricter cashiers, untick deduct and handle corrections yourself.

Notifications is the second, and it's the expensive one. Anyone with that grant can send a wallet message to your entire customer base, and messages are the metered resource on Waya: 100 a month on Free, 5,000 a month on Growth. One curious staff member testing a message to everyone spends real quota.

View customers is the third. It opens the full customer list, including the mobile number each person typed when they enrolled. A branch manager who runs win-back messaging needs it. A weekend cashier who only stamps cards does not, and giving it out by reflex is how customer contact details end up on more phones than you intended.

An honest limitation: the activity log records the action and the branch, not the individual account that performed it. There's no per-person audit trail today. The closest workaround is assigning each member to their own branch, which at least tells locations apart in your reports.

Offboarding on the day, not at the end of the week

Removing a staff account is one button in Settings, then Team. It deletes the membership record and the login itself, and it takes effect immediately — the next sign-in attempt with that handle fails. The handle is then free for you to use again.

Nothing happens to your customers when someone leaves. Every stamp that person added stays where it is, the wallet passes keep updating, and your activity history stays complete. Removing a person removes access, not data.

Staff have no settings screen of their own, so they can't change their own password, and password resets run over email that a staff handle doesn't have. In practice that means a forgotten password is solved by removing the account and creating a fresh one, reusing the same handle if you like. It's the same two minutes it took the first time.

The rule that actually protects a small shop is duller than any permission setting: one handle per person, never a shared cashier login the whole floor knows. When someone leaves, their handle leaves with them, and you don't have to think about who still remembers the password.

Train a new hire without standing next to them

Waya has a printable staff sheet at trywaya.com/guide. It covers the five things a cashier actually does: log in, open Scan and Redeem, type the customer's mobile number starting with 05, add one stamp per visit, and tap redeem when the reward is earned. It also notes that a brand-new customer's card is created the moment their number is entered for the first time.

The sheet comes in five languages — English, Arabic, Urdu, Hindi, and Bengali — and you can print two of them side by side, then save the result as a PDF. Shop floors in Riyadh and Jeddah frequently run on staff whose first language is Urdu, Hindi, or Bengali, and a two-language sheet taped near the register outperforms a verbal explanation on a busy Thursday evening.

Say the one operational rule out loud anyway: one stamp per visit, not one per item. That single sentence prevents most of the reward-math complaints a loyalty program generates in its first month.

What staff accounts cost

The Free plan is a single login: yours. It stays 0 SAR forever, with up to 100 customers, 100 wallet messages a month, one stamp card, one branch, your own card design, and the full dashboard. No credit card is required, and enrolled customers keep their cards and keep collecting even after you hit the 100-customer stop.

Growth is 85 SAR a month, or 867 SAR a year, and includes 5 staff accounts, 3 branches, up to 10 cards, all card types, 5,000 messages a month, advanced analytics, and Excel import. Premium is 149 SAR a month, or 1,520 SAR a year, with unlimited staff, branches, cards, and messages. Annual billing is 15% off either way.

There's no per-seat charge beyond those plan limits, no commission on sales, no per-card fee, and no setup fee. If you're a single-location shop with two cashiers, Growth is the line you cross, and it's the same 85 SAR whether you use one staff account or five.

If you're setting this up for the first time, create the shop on the free plan, add one cashier account, and watch what they actually need for a week before you hand out anything else.