Legal document
Privacy Policy
Last updated:
Draft pending final legal review before launch. The clauses below are transcribed from the platform's approved business rules and have not yet been given final legal drafting.
This policy explains what data we collect and why, who can see it, and what rights you have over it. It forms part of the terms and conditions.
What we collect and why
Your Iraqi phone number is your identity on the platform. We use it for one-time-code verification and for contact. An email address is optional, for account recovery and notifications.
Your profile photo is optional. A business logo is required only for an approved provider, because it is part of how they present themselves publicly.
Provider upgrade documents — identity, commercial registration, and what accompanies them — are collected only in the upgrade flow, classified as highly sensitive, and used for nothing other than verifying the business before approval.
Damage assessment reports are private by default and become public only when you attach one to a listing yourself.
Location
We ask your browser for location permission so we can show the nearest providers and fill in your governorate. You grant that permission and can withdraw it from your browser settings at any time.
We keep no history of your coordinates. They are used at the moment of the request to derive only a governorate or a distance, and they are not written to our logs.
If location cannot be determined in an emergency, you can enter your governorate by hand and see emergency providers with their numbers.
Who can see your data
Your phone number is hidden from visitors. It appears only after signing in and only when you choose to reveal it, and every reveal is logged.
Upgrade documents are reachable only by administrative reviewers, at the least privilege needed, and every access to them is audited.
What we do not do
We do not sell your data, and we do not share it with any third party for marketing purposes without your explicit consent.
We collect no payment data and no card numbers, because the platform does not take money at all. We do not ask an ordinary user for identity documents either.
There is no messaging between users on the platform, so there is no conversation content for us to store or read.
Your rights
You can view and correct your data from your account settings.
You can pause your account at any time: your listings are hidden, nothing is deleted, and signing in brings it all back. You can also delete it. Your listings come off the marketplace at once but are not destroyed, the account is disabled for thirty days during which signing in undoes everything, and only after that is it erased for good.
You can withdraw location permission from your browser whenever you like. Only the features that depend on proximity stop working.
If you have a complaint about your data, you can raise it as a report from within the platform and it is handled under the complaints policy.
How long we keep it
Account data is erased permanently thirty days after a deletion request. The one exception is audit records we are required to keep for five years; access to them is restricted and they are used for nothing but auditing.
How we protect it
Traffic to the platform is fully encrypted, upgrade documents are stored encrypted and isolated, and administrative access is limited to the least privilege needed and fully logged.
Every uploaded file is checked for its true type before being accepted, and image metadata — including the coordinates a camera embeds — is stripped on upload.