✦ Privacy Policy

This Privacy Policy describes how taaray (the "Site" or "we") collects, uses, and discloses your Personal Information when you visit, register an account with, or make a purchase or sale through the Site.

Collecting Personal Information

When you visit or use the Site, we collect certain information necessary to create your account, operate your shop (if you are a seller), process transactions, and provide our services. See below for more information about what Personal Information we collect and why.

Account information

Examples of Personal Information collected: name, email address, proof of address, phone number, city, cnic, password, profile image.

Purpose of collection: to create and identify your account, allow you to log in, communicate with you, and to prevent scammers on the website.

Source of collection: collected from you when you register an account.

Disclosure for a business purpose: your password and cnic are hashed and stored securely. Your name, email, and account data are stored in our database, Neon.

Seller information

Examples of Personal Information collected: brand name, shop bio, header image, Instagram handle, shop categories, address, payout details.

Purpose of collection: to set up and identify your shop on the marketplace, arrange courier delivery of orders, and process payouts to you.

Source of collection: collected from you when you register as a seller and set up your shop.

Disclosure for a business purpose: shared internally to operate the marketplace.

Order information

Examples of Personal Information collected: name, email, delivery address, phone number, products purchased, reviews left.

Purpose of collection: to fulfil orders, maintain transaction records, and allow buyers and sellers to leave and read feedback.

Source of collection: collected from you when you place an order.

Disclosure for a business purpose: shared between the relevant buyer, seller and courier as needed to complete the transaction.

Images and media

Examples of Personal Information collected: profile images, shop header images, product images.

Purpose of collection: to display your profile, shop, and product listings on the Site.

Source of collection: uploaded by you.

Disclosure for a business purpose: shared with our image hosting processor, Cloudinary.

Usage information

Examples of Personal Information collected: product views, shop views, product orders.

Purpose of collection: to track product popularity and shop visitor analytics, and to improve the Site.

Source of collection: collected automatically as you browse the Site.

Disclosure for a business purpose: not disclosed to third parties.

Sharing Personal Information

We share your Personal Information with service providers to help us provide our services, as described above. For example:

• We use Neon to host our database, where account, shop, and order data is stored (encrypted at rest).
• We use Cloudinary to host and deliver images, such as profile photos, shop banners, and product photos.
• We use Mailtrap to deliver transactional emails, such as order confirmations and account notifications.

We may share your Personal Information to comply with applicable laws and regulations, to respond to a lawful request for information, or to otherwise protect our rights.

How We Protect Your Information

We use the following measures to help keep your Personal Information secure:

• Passwords are hashed using bcrypt and never stored in plain text.
• CNIC is hashed with HMAC-SHA256, and encrypted with a private key so that it is accessible only by admins.
• Login sessions use JWT tokens stored in HttpOnly cookies, which cannot be accessed by JavaScript running in your browser.
• All connections to the Site are encrypted using HTTPS.
• User-submitted content is sanitized to remove scripts, malicious HTML, and event handlers, to protect against cross-site scripting.
• Database queries are handled through a parameterized ORM to protect against SQL injection.
• Uploaded images are validated for file type, size, and malicious content before storage.
• Login attempts and file uploads are rate-limited to prevent brute-force attacks and abuse.
• Security headers are applied to guard against common web attacks.
• Cross-origin requests are restricted to a whitelist of approved domains.

Retention

When you create an account we retain your Personal Information for our records for as long as your account remains active. If you delete your account, your Personal Information is permanently deleted, except where we are required to retain certain records (such as order and transaction history) for tax or legal record-keeping purposes.

Cookies

A cookie is a small amount of information that's downloaded to your device when you visit our Site. We use an authentication cookie to keep you securely logged in.

Do Not Track

Please note that because there is no consistent industry understanding of how to respond to "Do Not Track" signals, we do not alter our data collection and usage practices when we detect such a signal from your browser.

Your Rights

You have the right to access a copy of the Personal Information we hold about you, correct inaccurate information, request deletion of your account and associated data, opt out of marketing communications, and request your data in a portable format.

Changes

We may update this Privacy Policy from time to time in order to reflect changes to our practices or for other operational, legal, or regulatory reasons.

Contact

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at help@taaray.pk.