1Who we are

Ishterelak Merchant («اشتريلك - التاجر») is the merchant app of the Ishterelak platform, operated by Ibhar Company, Baghdad, Iraq. Registered merchants use it to receive, prepare and hand over orders, scan pickup codes, and manage their products. This policy explains what data the app collects and how we use and protect it.

2Data we collect

The app does not access your device location or contacts, shows no ads, and does not track you across other apps.

3Permissions the app asks for

• Camera: to scan the customer's QR code at pickup, and to take product photos. Scanned images are not stored or sent.
• Photos: to pick a product image from your gallery; the app only receives the photo you choose.
• Notifications: to alert you about new orders and order updates.

You can turn any permission off in your device settings; the feature that needs it may then stop working.

4How we use data

• To sign you in and run your account and store.
• To show orders, update their status, verify pickup codes and settle payments.
• To send order notifications.
• To detect and fix crashes and keep the app stable.
• To comply with applicable law and prevent fraud and misuse.

We do not sell your data or use it for advertising.

5Sharing

• The Ishterelak platform: your store and product details are shown to customers on the platform, and order data is exchanged between you and the platform to complete orders.
• Service providers: Google Firebase (notifications and crash reports), our push-notification provider, and hosting providers, only as needed to run the service.
• Partners linked to an order: such as partner delivery or payment platforms when an order involves them.
• Authorities: when required by law.

6Your duty toward customer data

The app shows you customers' names, phone numbers and delivery addresses for one purpose: preparing and delivering their order. By accepting this policy you agree not to use this data for anything else, and not to share it or keep it outside the app once the order is complete.

7Security and retention

• All traffic between the app and our servers is encrypted (HTTPS).
• Your sign-in token is kept in your device's secure storage and removed when you sign out.
• We keep account data while the account is active, and order and payment records for as long as accounting and legal rules require, after which they are deleted or anonymised.

8Your rights and account deletion

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account and its data. Send the request from your registered phone number to the email below and we will reply within 30 days. Some order and payment records may be kept for as long as the law requires.

9Children

The app is for adult merchants (18+). It is not directed at children, and we do not knowingly collect children's data.

10Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and tell you in the app if a change is significant.

11Contact us