Privacy Policy

To create your account: your name, email address and mobile number. We verify your email with a one-time code — we do not store a password, because we do not use one.

To deliver your orders: the delivery addresses you add, the contact name and phone on each order, and any delivery notes you write.

To run the coin programme: a record of every coin you earn, spend, or have reversed, including which partner offer credited it.

From the mobile app: a randomly generated install identifier, the platform you are on, and whether the app is running on an emulator or a rooted device. This is used to detect coin fraud. It is not a hardware identifier and it does not identify your device to anyone else.

If you register as a seller: your business details, CNIC number, photographs of both sides of your CNIC, and your bank account details. See *Seller information* below.

• We never ask for or store card numbers. Orders are cash on delivery or manual bank transfer.
• We do not track your location.
• We do not read your contacts, photos, or messages.
• We do not sell your personal information to anyone.

CNIC numbers and bank details are encrypted at rest and are visible only to ShopItt staff who need them to verify an application or to pay you. They are never returned by any buyer-facing or seller-facing part of the site or app, and CNIC images are never reachable by a public link.

We hold this information for as long as your seller account exists, and afterwards only as long as tax and accounting law requires.

• Sellers see only what they need to fulfil your order: the items, your delivery address and the contact name and phone for that delivery. They do not see your email or your coin balance.
• Reward partners (survey and offer providers) receive an anonymous identifier so they can tell us a task was completed. They do not receive your name, email or phone number from us. What they collect themselves is governed by their own privacy policies.
• Our email provider receives your email address in order to send verification codes and order updates.
• Authorities, where we are legally required to disclose.

Account and order records are kept while your account is open, and afterwards for as long as tax, accounting and dispute-resolution obligations require. Coin ledger entries are append-only — we do not delete or rewrite them, because your balance is calculated from them. Unused coins expire as described in the Terms of Service.

• You can view and edit your addresses and profile at any time from your account.
• You can ask us for a copy of the personal data we hold about you.
• You can ask us to delete your account. We will remove your personal details, but we must keep order and financial records where the law requires it, and coin ledger entries are retained in anonymised form.

To make any of these requests, contact us.

Sessions are held in a signed, HTTP-only cookie. Sensitive seller fields are encrypted at rest. Restricted images — CNIC scans, exchange evidence and payment receipts — are served only through authenticated routes, never from a public URL. No system is perfectly secure, but we do not treat any of the above as optional.

If we change how we handle your information, we will update this page and change the date at the top. Continuing to use ShopItt after a change means you accept the updated policy.