Public Privacy Policy

1 Scope & who we are

ApKiShop operates an online marketplace at apkishop.com that connects buyers with sellers in Pakistan and internationally. Our model is similar to a classifieds-plus-storefront platform: registered businesses ("Vendors") open subscription-based stores, while individual home users may post advertisements free of charge. For most personal data described here, ApKiShop is the data controller. Where a Vendor independently processes data about their own customers, that Vendor is a separate controller responsible for their own privacy practices.

This policy covers our public website, vendor and buyer accounts, mobile-friendly services, customer support, and marketing communications. It does not cover third-party websites we link to, which have their own privacy policies.

2 Information we collect

We collect the following categories of personal data, depending on how you use ApKiShop:

You are not required to give us personal data, but some features (such as opening a store, using account-based contact tools, or claiming a discount) cannot function without the data marked as required at the point of collection.

3 How & why we use your data

• Create and administer your account, vendor store, or free advertisement.
• Process ApKiShop subscription fees, invoices and applicable taxes.
• Verify Vendor identity (KYC) and assess eligibility for the cottage-industry discount, and to prevent fraud and abuse.
• Operate marketplace features: storefronts, search, listings, enquiries, messaging, reviews and recommendations.
• Provide customer support and respond to your enquiries.
• Keep the platform secure, monitor for fraud, and enforce our Terms of Service.
• Send service messages (for example, account, subscription-billing and security notices) and marketing you can opt out of where permitted.
• Understand and improve our services using analytics.
• Comply with legal, tax, accounting and regulatory obligations.

4 Lawful bases for processing

Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the following lawful bases:

5 Cookies & analytics

We use strictly necessary cookies to run the site (e.g. sessions, security, cart) and, with your consent where required, analytics and preference cookies. We use analytics tools such as Google Analytics 4 to understand aggregate usage. You can control non-essential cookies through our cookie settings and your browser. For EU/UK visitors, non-essential cookies are set only after consent in line with the ePrivacy rules (PECR in the UK).

6 How we share your data

We share personal data only as needed, with:

• Service providers (processors) acting on our instructions, including hosting and storage, subscription-payment processors, identity-verification, email/SMS delivery, analytics and customer-support tools.
• Vendors and buyers, when one party chooses to share information through a listing, enquiry or contact tool. The parties arrange product payment and delivery directly.
• Professional advisers and authorities — where required by law, regulation, legal process, or to protect our rights, users and the public.
• Successors — in connection with a merger, acquisition or asset sale, subject to this policy.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising in exchange for value.

7 International data transfers

ApKiShop serves users in Pakistan and abroad, and some of our providers operate outside your country. Where we transfer personal data internationally, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or transfers to jurisdictions recognised as providing adequate protection. You may request a copy of the relevant safeguards using the contact details below.

8 Data retention

We keep personal data only as long as necessary for the purposes described above, including to meet legal, tax and accounting requirements and to resolve disputes. As a general rule, account and subscription-billing, enquiry and support records are retained for the life of your account and for a limited period afterwards as required by law; marketing preferences are kept until you opt out; and verification documents are kept only as long as needed to satisfy our compliance obligations. When data is no longer needed, we delete or anonymise it.

9 How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS), encryption of sensitive stored credentials and access tokens, hashed passwords, access controls on a need-to-know basis, and monitoring. No method of transmission or storage is completely secure, but we work continuously to protect your information and will notify you and the relevant authority of a personal-data breach where the law requires.

10 Your privacy rights

If you are in the EU or UK (GDPR / UK GDPR)

• Access a copy of your personal data and information about how we process it.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") where applicable.
• Restrict or object to certain processing, including direct marketing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time, and lodge a complaint with your supervisory authority (e.g. the UK ICO or your local EU authority).

If you are in California (CCPA/CPRA)

• Know, access and delete the personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of any "sale" or "sharing" of personal information (note: we do not sell or share it for cross-context behavioural advertising).
• Non-discrimination for exercising your rights.

If you are in Pakistan

We honour the protections of the Prevention of Electronic Crimes Act 2016 and will comply with the Personal Data Protection Act once in force, including giving you reasonable access to, and correction of, your personal data. To exercise any right, contact us using the details below. We will verify your request and respond within the timeframes required by applicable law (generally within 30 days). These services are free unless your request is manifestly unfounded or excessive.

11 Vendor stores & third-party services

Each Vendor store on ApKiShop is operated by an independent seller who may collect data directly from their customers and is responsible for their own privacy practices. Our website may link to third-party sites and integrate optional third-party tools (for example, analytics linked to a Vendor's own account). We are not responsible for the privacy practices of those third parties; please review their policies before sharing personal data with them.

Buyers and sellers also arrange product payment, delivery, returns, warranties and disputes directly. ApKiShop does not receive, hold or distribute the money paid by a buyer to a seller for a product.

12 Google account data & API Limited Use

ApKiShop offers Vendors an optional feature that lets them connect their own Google account to bring their Google Analytics (GA4) figures into their private Vendor Intelligence Hub, alongside ApKiShop's own marketplace analytics. This integration is strictly opt-in: nothing is accessed unless a Vendor explicitly clicks "Connect Google Analytics" and grants consent on Google's screen.

What Google user data we access

• We request a single, read-only scope — https://www.googleapis.com/auth/analytics.readonly — and nothing more.
• We read only aggregate reporting figures for the GA4 property the Vendor selects: for example sessions, users, traffic by channel, top landing pages and configured conversions. We do not request, read, write or delete any other Google data, and we never have the ability to change the Vendor's Google account or Analytics configuration.

How we use it

• The figures are shown only to that Vendor, inside their own authenticated Vendor Intelligence Hub, to help them understand their store's performance. No other Vendor or buyer can see them.
• We do not use Google user data for advertising, and we do not use, transfer, or process it to develop, train or improve any generalised or foundational machine-learning or artificial-intelligence model.
• We do not sell Google user data, and we do not transfer it to third parties except as needed to provide this feature, for security, or where required by law.

How we store, protect, retain and delete it

• The OAuth access and refresh tokens that authorise this read-only access are encrypted at rest and are never exposed to other Vendors, shown in our interface, or written to our logs.
• The Analytics figures themselves are cached only briefly to keep the Hub fast, and are refreshed on a schedule; they are tied to the Vendor's own store and isolated from every other account.
• A Vendor can disconnect at any time from the Hub. On disconnect we delete the stored tokens and cached figures and ask Google to revoke our access. A Vendor may also revoke access directly at any time from their Google Account permissions at myaccount.google.com/permissions.

13 Children's privacy

ApKiShop is not directed to children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

14 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services or the law. We will post the updated version here with a new "Last updated" date and, where changes are material, provide a more prominent notice. Your continued use of ApKiShop after an update constitutes acceptance of the revised policy.

15 How to contact us