This Policy explains how the Shorja application and platform ("we", "the Platform"), operated by «Shorja», collects, uses, discloses and protects your personal data when you use our services. By using the Platform you acknowledge that you have read and understood this Policy.
1. Information We Collect
a) Information you provide
- Account data: username, email, phone number, and password (stored encrypted; we cannot read it).
- Store and listing data: item title, description, price, images, category and location.
- Communications: chat messages, ratings and reviews, and dispute details and attachments.
- Verification data we may request to confirm identity or store ownership when needed.
b) Information collected automatically
- Device data: type, operating system, device identifier and app language.
- Usage and logs: IP address, sections you visit, and access times.
- Push notification token (FCM) to send you alerts.
c) Location
With your permission, we use your device location to show nearby listings and stores, determine your governorate, and facilitate delivery. You may withdraw this permission at any time from your device settings.
d) Financial and transaction data
- Wallet balance, deposit and withdrawal requests, and a history of transactions, auctions, bids and purchases.
- For payments/withdrawals we process only the last four digits of the card and a transaction reference; we do not store your full card number — payment data is handled by the secure payment provider.
e) Third-party sign-in
If you sign in with Google or Facebook, we receive a unique identifier, your email and public name per your permissions there.
2. How We Use Your Information
- Create and operate your account and enable you to list, buy, sell and bid.
- Process payments, the wallet, deposits, withdrawals, fees and commissions.
- Show relevant nearby content, listings and stores.
- Send operational notifications (messages, bids, order status) and security alerts.
- Prevent fraud and abuse, secure the Platform, and resolve disputes.
- Improve our services, analyse performance and fix crashes.
- Comply with legal and regulatory obligations.
3. Legal Bases for Processing
We process your data based on: performance of our contract with you, your consent (e.g. location and marketing), our legitimate interests (security, fraud prevention, service improvement), and compliance with legal obligations.
4. Sharing of Information
We do not sell your personal data. We may share it, only as necessary, with:
- Service providers: the payment processor (Stripe), Google Firebase services (notifications, analytics, crash reporting and authentication), the live-streaming provider (Agora), OpenStreetMap maps, delivery companies, and hosting/email providers — to operate the service on our behalf.
- Other users: content you post publicly (listings, store name, reviews) is visible to others, and necessary contact information is shared with the counterparty upon a transaction or delivery.
- Legal reasons: upon a lawful request from a competent authority in the Republic of Iraq, or to protect our rights and users.
- Business transfers: in a merger, acquisition or asset sale, with your data remaining subject to this Policy.
5. Data Retention
We retain your data while your account is active and for any additional period required by law, dispute resolution, fraud prevention or financial record-keeping. When no longer needed, we delete or anonymise it.
6. Data Security
We apply reasonable technical and organisational measures including password hashing, short-lived access tokens (JWT), and two-factor authentication for the admin panel. However, no method of transmission or storage is 100% secure and we cannot guarantee absolute security.
7. Your Rights
Subject to applicable law, you may access, correct or update your data, request deletion, withdraw consent, and object to certain processing. To exercise these rights, contact us at the email below.
8. Account Deletion
You can delete your account in-app via "Settings". This removes or hides your personal data, except the minimum we must legally retain (e.g. financial records or data relating to an open dispute).
9. Children's Privacy
Our services are intended for users aged 18 and over. We do not knowingly collect data from anyone younger, and will delete such data if collected without a lawful basis.
10. Notifications and Marketing
You can turn off notifications from your device or app settings. We may still send essential operational messages even if you opt out of marketing.
11. International Transfers
Your data may be processed or stored on our providers' servers that may be located outside the Republic of Iraq. We take reasonable steps to protect it under this Policy.
12. Changes to this Policy
We may update this Policy from time to time. For material changes we will notify you in-app and may ask you to accept again before continuing to use the service.
13. Contact Us
For any privacy inquiry: email [email protected] — website https://shorja.com — address: «Dhyala — Iraq».