Legal
Privacy Policy
This Privacy Policy explains how [LEGAL ENTITY NAME] (“MadeInPK”, “we”, “us”, “our”) collects, uses, stores, shares and protects your information when you use the MadeInPK mobile application (iOS and Android) and the website made-in-pk.com (together, the “Platform”).
MadeInPK is a business-to-business (B2B) trade marketplace for Pakistani textile and manufacturing businesses. It connects verified buyers and sellers. We are a marketplace and verification service only — we are not a bank, payment institution, shipping company, or party to any trade contract between users.
By creating an account or using the Platform, you agree to this Privacy Policy. If you do not agree, please do not use the Platform.
1. Who we are (Data Controller)
- Entity: [LEGAL ENTITY NAME]
- Registered address: [FULL POSTAL ADDRESS, CITY, PAKISTAN]
- Contact email:madeinpk00@gmail.com
- Website:https://made-in-pk.com
- Privacy contact / Data Protection Officer:madeinpk00@gmail.com
2. Age requirement
MadeInPK is strictly for business use by adults. You must be 18 years or older to create an account. The Platform is not directed to children, and we do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a minor, we will delete that account and its data. If you believe a minor has registered, email madeinpk00@gmail.com and we will remove the account.
3. Information we collect
We only collect data that is needed to operate a verified trade marketplace. We collect it directly from you, automatically from your device, and (where applicable) from our identity and authentication providers.
3.1 Account & profile information
- Full name
- Email address
- Password (stored only as a salted cryptographic hash — we never see or store your plain-text password)
- Mobile phone number
- City / location (city-level only — we do not collect GPS or precise device location)
- Business name, business type and role (buyer / seller)
- Profile photo (optional)
- Account tier (Basic / Gold) and account status
3.2 Identity & business verification data (sensitive)
To keep the marketplace free of fake traders, sellers (and buyers who choose to be verified) submit:
- CNIC number (Pakistani national identity card number)
- Photographs of the CNIC (front and back)
- Selfie photographs and a short selfie/liveness video for face matching against the CNIC
- Business premises photographs and video (shop, factory, warehouse)
- NTN (National Tax Number) and NTN certificate document, where the user applies for a tax-verified badge
This is sensitive government-ID data. It is used only to verify identity and business legitimacy, to prevent fraud, and to comply with law. It is stored in a private, non-public storage bucket, is never shown on your public profile, is never shown to other users, and is never sold or used for advertising. Only authorised MadeInPK verification staff can view it, through short-lived signed links, for the purpose of approving or rejecting a verification request.
3.3 Listing & trade content
- Product listings: title, description, product type, price, price tiers, quantity, units, minimum order quantity, city, status
- Listing photographs you upload (these are public on the Platform)
- Saved / shortlisted items
- Orders: listing, quantity, unit price, total amount, order status, buyer and seller identity
- Reviews and ratings you give or receive
3.4 Payment-related information
MadeInPK does not process card payments and does not store card numbers, CVV codes or bank login credentials. Payments between users are made by direct bank transfer (IBAN) outside the app. In connection with this we collect:
- IBAN / bank account details you choose to provide for settlement
- Payment proof images (transfer receipts / screenshots) that you upload for verification
- Payment reference numbers, amounts, currency, and payment status
- Records of plan/tier upgrade payments (plan name, amount, reference, proof, status)
Payment proof images are stored in private storage and are viewable only by you and authorised MadeInPK staff verifying the transaction.
3.5 Communications
- In-app chat messages between buyers and sellers, including price offers and system messages
- Read receipts and timestamps
- Support emails, dispute submissions, reports and complaints you send us
- Notifications we generate for your account
Chat is not end-to-end encrypted. Messages are encrypted in transit and at rest but can be accessed by authorised MadeInPK staff when investigating a report, a dispute, fraud, or a legal request. Please do not send passwords, full bank credentials, or unnecessary sensitive documents through chat.
3.6 Device & technical information (collected automatically)
- Device type, operating system and version, app version, device language
- IP address and approximate (country/city-level) location derived from it
- Session tokens, login timestamps and authentication logs
- Crash and error diagnostics, and basic app performance data
- App preferences stored locally on your device (e.g. language selection, terms acceptance)
3.7 Activity & safety logs
We keep an internal activity log of key account events (sign-up, verification submitted/approved/rejected, listing created or blocked, payment submitted or verified, dispute opened, account suspended). These logs support fraud prevention, dispute resolution, and legal compliance.
3.8 What we do NOT collect
- We do not collect precise GPS/background location.
- We do not access your contacts, call logs, SMS messages, or calendar.
- We do not use third-party advertising SDKs, and we do not track you across other companies’ apps or websites.
- We do not store payment card numbers or banking passwords.
- We do not sell your personal data to anyone.
4. Device permissions we request
| Permission | Why we ask | Can you refuse? |
|---|---|---|
| Camera | To capture CNIC photos, selfie/liveness verification, business premises photos, listing photos and payment proof. | Yes. The app still works, but you cannot complete verification or upload photos taken live. |
| Photo library / storage | To upload existing images: CNIC, listing photos, NTN certificate, payment proof. | Yes, with the same limitation as above. |
| Microphone | Recorded only as part of the verification video (selfie/business video). | Yes. Video verification will be unavailable. |
| Notifications (optional) | To alert you about new messages, offers, order updates and verification results. | Yes. You can turn notifications off at any time in your device settings. |
| Internet / network access | Required for the app to function. | No. |
Permissions are requested only at the moment the related feature is used, and you can withdraw them at any time in your device settings.
5. How we use your information & our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account; authenticate logins | Name, email, password hash, phone, session data | Performance of a contract with you |
| Verify identity and business legitimacy; issue verified badges | CNIC number and images, selfie/video, business photos/video, NTN | Your explicit consent; our legitimate interest in preventing fraud; legal obligation |
| Publish listings and enable buyers to find sellers | Listing content, listing photos, business name, city, rating | Performance of a contract |
| Enable buyer–seller communication and offers | Chat messages, offers, profile identifiers | Performance of a contract |
| Record orders, verify bank-transfer payments, resolve disputes | Order data, IBAN, payment proofs, dispute submissions | Performance of a contract; legitimate interest |
| Detect and prevent fraud, scams, abuse and prohibited listings | Activity logs, device/IP data, reports, listing and chat content | Legitimate interest; legal obligation |
| Provide customer support | Contact details, account and order data | Performance of a contract |
| Send service messages (verification result, order status, security alerts) | Email, phone, push token | Performance of a contract |
| Send marketing or promotional messages | Email, phone | Your consent — you can opt out at any time |
| Improve app stability and fix bugs | Crash logs, device and app version | Legitimate interest |
| Comply with law, tax, court orders and lawful requests | As legally required | Legal obligation |
We do not use your data for third-party advertising, ad targeting, ad measurement, data brokerage, or credit scoring.
6. What other users can see
Public on the Platform: your business name, display name, city, account tier (Basic/Gold), verification badges, average rating and reviews, and all listings and listing photos you publish.
Shared only with your trading counterparty: once you begin a chat or an order, the other party sees your name/business name and the messages, offers and order details you exchange. Phone number and email visibility can be controlled in Settings → Privacy & Security.
Never shown to other users: your CNIC number, CNIC images, selfies, verification videos, NTN certificate, payment proof images, password, IP address and device information.
7. How we share information
We never sell your personal data. We share it only in these situations:
7.1 Service providers (processors)
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase (cloud database, authentication and file storage, running on AWS infrastructure) | Hosting our database, user authentication and encrypted file storage | All account, listing, order, chat and verification data |
| Google Sign-In (Google LLC) | Optional “Sign in with Google” authentication | Your Google account email, name and profile picture — only if you choose this login method. We never receive your Google password. |
| Apple App Store / Google Play | App distribution, and crash reporting where you have enabled sharing with the platform | Aggregated diagnostics; we do not receive your identity from these reports |
| Email delivery provider [NAME IF USED] | Sending verification codes, order updates and support replies | Email address and message content |
All providers act on our instructions under contractual confidentiality and security obligations, and may not use your data for their own purposes.
7.2 Other users
As described in Section 6.
7.3 Legal and safety disclosures
We may disclose information where we believe in good faith it is necessary to: comply with Pakistani law, a court order, or a valid request from law enforcement or a regulator (including the Federal Investigation Agency and the State Bank of Pakistan where applicable); enforce our Terms and Conditions; investigate fraud, financial crime or a security incident; or protect the rights, property or safety of MadeInPK, our users or the public.
7.4 Business transfer
If MadeInPK is involved in a merger, acquisition, restructuring or sale of assets, your data may be transferred to the successor entity. We will notify you in the app or by email before your data becomes subject to a different privacy policy, and you will be able to delete your account before the transfer takes effect.
8. International data transfers
MadeInPK primarily serves users in Pakistan, but our cloud infrastructure providers may store and process data on servers located outside Pakistan (for example in Singapore, the European Union or the United States). Wherever your data is processed, we require providers to apply security and confidentiality safeguards that are equivalent to those described in this policy, through contractual data-processing terms.
9. Data security
- All traffic between the app and our servers is encrypted using HTTPS/TLS.
- Data at rest is encrypted on our cloud provider’s infrastructure.
- Passwords are stored only as salted one-way hashes.
- CNIC images, verification videos, NTN certificates and payment proofs are held in private buckets that are not publicly accessible; they are served only through short-lived signed URLs to authorised reviewers.
- Database access is protected by row-level security, so each user’s records are technically isolated from other users.
- Administrative access is limited to a small number of trained staff, is role-based, and is logged.
- We monitor for suspicious activity and rate-limit sensitive endpoints such as login and OTP verification.
No system can be guaranteed to be perfectly secure. If a data breach occurs that is likely to put your rights at risk, we will notify affected users and the relevant authorities without undue delay, and in any event within 72 hours of becoming aware of it.
10. How long we keep your data
| Data | Retention period |
|---|---|
| Account and profile data | For as long as your account is active |
| CNIC images, selfies, verification videos | Retained while the account is active and verified; deleted or anonymised within 90 days of account deletion, unless required for an open dispute, fraud investigation or legal obligation |
| Rejected verification submissions | Deleted within 90 days of rejection |
| Listings and listing photos | Deleted when you delete the listing or your account |
| Chat messages | Deleted on account deletion, except where retained for an open dispute or a legal request |
| Order, payment and dispute records | Retained up to 5 years after the transaction, to meet Pakistani tax, accounting and anti-fraud record-keeping requirements |
| Security, fraud and activity logs | Up to 24 months |
| Support correspondence | Up to 24 months |
| Data of an account banned for fraud | Minimal identifiers (hashed CNIC, email, device markers) may be kept indefinitely to prevent the banned user from re-registering |
11. Your rights and choices
You may at any time:
- Access the personal data we hold about you and request a copy;
- Correct inaccurate or incomplete data — most fields are editable in Settings → Edit Profile;
- Delete your account and personal data (see Section 12);
- Withdraw consent for verification processing or marketing (withdrawing verification consent means verified badges are removed and seller features become unavailable);
- Object to or restrict certain processing based on our legitimate interests;
- Export your data in a portable, machine-readable format;
- Opt out of marketing messages via the unsubscribe link, or by emailing us;
- Control visibility of your phone number and email in Settings → Privacy & Security;
- Complain to us, or to the competent data protection authority in Pakistan, if you believe your rights have been infringed.
To exercise any right, email madeinpk00@gmail.com from your registered email address. We respond within 30 days. We may ask you to confirm your identity before acting on a request, to protect your account.
12. Deleting your account and data
In the app: open Settings → Account → Delete Account and confirm. This permanently removes your profile, listings, listing photos, saved items, chat messages, and verification documents, subject to the legal retention rules in Section 10.
By email / on the web: send a deletion request from your registered email address to madeinpk00@gmail.com with the subject line “Delete My Account”, or use the form at https://made-in-pk.com/data-deletion/.
What happens next:
- Your account is deactivated immediately and your listings are removed from the marketplace.
- Personal data and verification documents are erased from live systems within 30 days, and from encrypted backups within a further 60 days.
- What we must keep: transaction, invoice, payment and dispute records for up to 5 years (legal and tax obligation), and minimal fraud-prevention identifiers where an account was banned for fraud. Retained records are held in restricted-access storage and are not used for any other purpose.
- Deletion cannot be reversed. Open orders and unresolved disputes must be settled first.
13. Cookies and website analytics
The MadeInPK mobile app does not use advertising cookies or third-party ad trackers. It stores small amounts of data locally on your device (login session, language preference, terms acceptance) so you do not have to sign in repeatedly.
The website made-in-pk.com uses strictly necessary cookies for site functionality and security, and may use privacy-respecting analytics cookies to understand aggregate traffic. You can block or delete cookies in your browser settings; strictly necessary cookies cannot be disabled without affecting site functionality.
14. Third-party links and off-platform dealings
The Platform may link to third-party websites, and users may agree to move a deal off-platform. We are not responsible for the privacy practices of third parties or for dealings that take place outside MadeInPK. We strongly recommend keeping negotiation, payment proof and delivery records inside the app — off-platform dealings cannot be protected or arbitrated by us.
15. Changes to this Privacy Policy
We may update this policy as the Platform evolves or the law changes. The “Last updated” date at the top will always reflect the current version. If we make a material change — for example, collecting a new category of data or using data for a new purpose — we will notify you in the app or by email at least 14 days before the change takes effect, and where the law requires it we will ask for your consent again. Continuing to use the Platform after a change means you accept the updated policy.
16. Contact us
Questions, requests or complaints about privacy:
- Email:madeinpk00@gmail.com
- Contact form:https://made-in-pk.com/contact-us/
- Postal address: [LEGAL ENTITY NAME], [FULL POSTAL ADDRESS], Pakistan
We aim to acknowledge every privacy request within 48 hours and to resolve it within 30 days.
MadeInPK — Trade with Trust. CNIC-verified sellers. IBAN-secured payments.