Privacy Policy

Awshta is a multi-vendor online marketplace that connects buyers with independent sellers. This Privacy Policy applies to our website at https://awshta.com and to the Awshta mobile app (together, the "Platform"), and describes how we handle personal information processed through them.

Where the website and the mobile app behave differently — most notably in the analytics they use and the payment methods they offer — this policy says so rather than describing them as one product.

By creating an account, placing an order, or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Platform.

We collect the following categories of information, and only the specific fields described below.

Account information

• Your name, email address and a password when you register. Passwords are stored only as a cryptographic hash — we never hold the password itself.
• Your phone number, which you can add or update from your profile.
• A profile photo, if you choose to upload one.
• A one-time code sent to your email address when you ask to reset your password.
• Sign-in tokens issued to your device, and a record of the refresh tokens we have issued so a session can be revoked.

Order and delivery information

• Shipping addresses you save (label, street, city, province, country and postal code).
• A contact phone number for each order, which the courier uses to reach you before delivery.
• The delivery city you choose from the courier's list of serviceable cities.
• Order details, including the products, quantities, selected variants, prices and any order notes you add.
• If you check out as a guest, the name, email address and phone number you provide for that order.

Payment information

• Cash on Delivery is currently the only payment method available on the website, and it collects no payment credentials at all — you pay the rider on delivery.
• No card details are collected anywhere on the Platform. There is no card form and no card gateway behind one.
• Where a mobile-wallet payment is made available in future, we would send the order reference and the wallet identifier you enter to the provider in order to raise the payment request. We would never ask for or hold your wallet PIN — that is entered inside your wallet provider's own app.
• For every payment attempt we keep a transaction record — the amount, the provider, our reference, the provider's reference and the outcome — with sensitive values redacted before they are stored.

Messages and content you submit

• Product reviews — a star rating, an optional title and comment, any images attached to the review, and whether it is linked to a completed purchase.
• Questions you ask sellers about a product, and their answers.
• Messages you exchange with a seller in Awshta chat, including any attachment, and whether and when a message was read.
• Anything you send through our contact form: your name, email address, phone number, subject and message.
• Your email address, if you subscribe to our newsletter.

Seller information

If you apply to sell on Awshta we collect additional information, including identity documents and bank details. This is described in the Seller Information section below.

Information stored on your device

Some information is kept in your browser's local storage (or, in the mobile app, in the app's own storage on your device) and is not sent to our servers unless you act on it:

• Your sign-in tokens, so you stay signed in between visits.
• Your shopping cart and your wishlist.
• A checkout draft — the name, email address, phone number, address, delivery city and order note you have typed — so a reload or a mis-tapped back button does not wipe the form. It is deleted as soon as the order is placed.
• Your chosen delivery city, so the cart and product pages can quote delivery for the same destination.
• A copy of your most recent order confirmation, so the confirmation page can render it.
• In the mobile app, a flag recording that you have completed the introduction screens.

Technical information

When the Platform communicates with our servers, standard connection information — such as your IP address, the request your device makes and the time it was made — is processed to deliver the service, apply rate limits and keep the Platform secure. Our analytics providers also receive usage information, described in the Analytics section.

We use the information we collect to:

• Create and manage your account and sign you in securely.
• Process your orders, split them per seller, and have them delivered.
• Book shipments with our courier and keep you and the seller informed of their progress.
• Let you and sellers message each other, and let sellers answer your questions about their products.
• Publish the reviews and questions you choose to post.
• Answer contact-form enquiries and provide customer support.
• Send you service messages about your account and your orders, and — where you have opted in or bought from us — occasional marketing emails you can stop at any time.
• Settle sellers' earnings, apply commission and delivery charges, and process payouts.
• Understand how the Platform is used so we can improve it, as described in the Analytics section.
• Maintain security, prevent fraud and abuse, and comply with our legal obligations.

As a buyer, the information you provide — your account details, saved addresses, order contents and the contact phone number for each order — is used to process and deliver your purchases.

Because Awshta is a multi-vendor marketplace, a basket containing items from more than one seller is split into a separate order per seller. Each seller receives only what they need to fulfil their own parcel, including your name, delivery address and the contact phone number for that order. Sellers can also see the name, email address, phone number and profile photo of customers who have ordered from them, so they can provide support on those orders.

When you request to become a seller you submit a store name and a description. Once approved, you can add further details through the seller dashboard. Some of it is published on your storefront; some of it is used only to verify you and to pay you.

Shown publicly on your storefront

• Store name and description.
• Store branding — your primary and secondary colours.
• Store media you upload, such as a logo, banner, background image and promotional video.
• Contact and social links you choose to add (WhatsApp number, Facebook, Instagram and YouTube).

Used for verification and payment only

• Images of the front and back of your CNIC, which you upload so we can verify your store. These are never shown on your storefront and are not returned by our public API.
• Your bank details for payouts — bank name, account title, account number and IBAN — which we hold so approved earnings can be paid to you.
• The shipper details we register with the courier on your behalf, which may include your name, email address, phone number, pickup address and CNIC number.

As a seller, you can see information about customers who have ordered from you — their name, email address, phone number, profile photo and the delivery details for their order. You must handle that information responsibly, use it only for fulfilling and supporting those orders, and not disclose it to anyone else.

Cash on Delivery is the only payment method a buyer can currently select on the Awshta website. You pay the courier in cash when your parcel arrives, and no payment credentials are collected or stored by us.

JazzCash and EasyPaisa are shown at checkout as coming soon and cannot be selected. Our systems are integrated with both providers but the channels are switched off, so no payment data is sent to them today. If we enable them we will update this Policy first, and the wallet PIN would in any case be entered only inside the provider's own app — never on Awshta.

We record each payment attempt so that orders can be reconciled and disputes investigated. Provider request and response payloads are redacted before they are stored and are never returned by our API.

Deliveries are carried out by Leopards Courier Service. To quote and then book your delivery, we send the courier the information needed to move the parcel: the pickup and delivery cities, your name, delivery address and contact phone number, the parcel's weight and dimensions, and — for a Cash on Delivery order — the amount to collect from you.

The courier sends us status updates as your parcel moves, which we store against your order and show you. Leopards processes this information under its own privacy practices, and we recommend reviewing them if you would like to know more.

Anyone holding an Awshta order number can look up that order's delivery status on our order tracking page without signing in. That lookup deliberately returns no personal details — no name, phone number, address, email address or item list.

Email

• Service emails we send because you asked us to or because you have an order with us: password-reset codes, the temporary password for an account created at guest checkout, a notice when an order is linked to your existing account, and order-related messages.
• Marketing emails about offers and campaigns, sent to newsletter subscribers, customers and sellers. Every marketing opt-out we record applies across all of those lists, not just the newsletter.

In-app notifications

When you are signed in, the Platform keeps a live connection to our servers so your notification feed and your chat messages update in real time. Notifications are created for events such as an order being placed, an order or payment status changing, a new review, a product question being asked or answered, and seller-application decisions. You can read, mark as read and delete them from your account.

The Awshta website uses cookies set by Google Analytics to measure how the site is used. These are analytics cookies, described in the Analytics section below. Apart from those, the website does not set cookies of its own.

Everything the website needs to remember about you between visits — your sign-in tokens, cart, wishlist, checkout draft, delivery city and last order confirmation — is kept in your browser's local storage rather than in a cookie. Clearing your browser's site data removes all of it and signs you out.

The Awshta mobile app does not use cookies. The equivalent information is stored on your device by the app itself, and is removed when you sign out, clear the app's data or uninstall it.

We do not use advertising cookies, retargeting pixels or session-recording tools. You can block or delete cookies in your browser settings; doing so will not prevent you from shopping on Awshta.

We use analytics to understand which parts of Awshta people use, so we can fix what is not working and improve what is. Both of the tools we use are provided by Google.

On the website

The website loads Google Analytics 4 on every page. It records the pages you visit, approximate location derived from your IP address, and general device and browser information, and it sets first-party cookies to recognise a returning browser. This runs from the moment a page loads; we do not currently offer an on-site control to switch it off, so if you would rather not be measured, use your browser's cookie or tracking controls.

In the mobile app

The Awshta mobile app uses Firebase Analytics, also from Google. It records the screens you open and a fixed set of shopping events — signing in, registering, searching (including the search term), viewing a product or a product list, adding to or removing from the cart or wishlist, starting checkout, completing a purchase, sharing a product, submitting a review, asking a question, and the equivalent actions in the seller tools. When you are signed in, your Awshta account identifier is attached to those events so that a single person's journey can be followed across screens.

We use this information to measure and improve the Platform. We do not sell it, we do not use it to serve advertising, and we do not combine it with data from other companies to profile you. Google processes it as our analytics provider under its own terms, and its handling of the data is governed by Google's privacy policy.

We rely on a limited number of third parties to run the Platform:

• Google — Google Analytics 4 on the website and Firebase Analytics in the mobile app, as described above.
• Leopards Courier Service — quoting, booking and tracking your deliveries.
• Our email provider, which delivers the service and marketing emails we send.
• Our hosting and infrastructure providers, which run the servers and store the marketplace data described in this Policy.
• JazzCash and EasyPaisa — payment providers we are integrated with, but which are not currently enabled for buyers and therefore receive no data today.

Each of these receives only the information it needs to perform its function. Sellers may also link from their storefronts to their own social media pages; those sites are operated by others and governed by their own privacy policies.

We do not sell your personal information. We share it only in the following circumstances:

• With sellers, so they can fulfil and support the orders you place with them.
• With our courier, so your parcel can be quoted, booked, delivered and tracked.
• With our analytics, email, hosting and payment providers, acting on our behalf and only for the purposes described in this Policy.
• With our own staff and administrators, who can access accounts, orders, reviews, contact messages and financial records in order to operate and support the marketplace.
• Where required to comply with applicable law, legal process or a lawful government request, or to protect the rights, safety and property of Awshta, our users or the public.
• In connection with a merger, acquisition, financing or sale of assets, in which case we will take steps to ensure your information remains protected.

We take reasonable technical and organisational measures to protect your information. Traffic between the Platform and our servers travels over encrypted HTTPS connections; passwords are stored only as salted hashes; access to your account is controlled by short-lived tokens that are refreshed automatically and revoked when you sign out; uploads are validated before they are written to disk; and sensitive request and response data from payment providers is redacted before it is stored.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your password confidential and for activity that occurs under your account. Tell us promptly if you believe your account has been accessed by someone else.

We retain your personal information for as long as your account is active and for as long as we need it to run the marketplace, complete your orders, resolve disputes, settle sellers, enforce our agreements and meet our legal obligations. Order, delivery and financial records are kept even after an account is closed, because they are the record of transactions that actually happened and may be required for tax, accounting and dispute purposes.

Each order stores a snapshot of the products it contained, so your order history stays accurate even if a seller later edits or removes the listing.

Information kept only on your device — your cart, wishlist, checkout draft and stored delivery city — is removed when you clear it, sign out, clear your browser's site data, or uninstall the app.

You can do the following yourself, while signed in:

• View and update your name and phone number, replace your profile photo, and change your password.
• Add, update or remove your saved shipping addresses.
• Edit or delete reviews you have written.
• Read, mark as read and delete notifications, and delete messages you have sent in chat.
• Manage the items in your cart and wishlist.
• Sign out of your account at any time.

To stop receiving marketing email, use the unsubscribe option in the email or ask us using the contact details below. An opt-out is applied across all of our marketing lists. Service messages about your account and your orders are not marketing and will continue.

To close your account, contact us using the details below. Closing an account deactivates it, revokes every active session and prevents further sign-in; order and financial records associated with it are retained as described in Data Retention.

Depending on where you live, you may also have rights to access, correct, delete or export your personal information, or to object to or restrict certain processing. Contact us and we will respond in accordance with applicable law.

Awshta is not directed to children. The Platform is intended for users who are at least 18 years old, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date shown at the top of this document. Where a change materially affects how we handle your information — for example if we introduce a new payment provider or a new analytics tool — we will make that clear on the Platform. Your continued use of Awshta after an update takes effect means you accept the revised Policy.

If you have questions about this Privacy Policy, want to exercise a right described above, or would like your account closed, you can reach us at: