Privacy policy

We collect three categories of information:

• Account & identity. Name, email, phone, preferred language, primary city, password hash, account role (buyer / seller / admin), and — for verified sellers — KYC documents (CNIC, business registration, proof of address) collected through our private media pipeline.
• Activity & content. Listings, photos, snaps, reviews, ratings, chats with shops, inquiries, search queries, saved items, and the device sessions attached to your account.
• Technical signals. IP address, browser and device type, approximate location (when you grant permission), referrer, push-notification tokens, and short-lived cookies for sign-in and CSRF protection.

• Run the core service — render the map, list nearby shops, deliver chat messages and notifications, process inquiries, and rank search results.
• Verify identities and resolve disputes (KYC documents and chat snapshots are only opened by trained reviewers).
• Keep the platform safe — detect spam, off-platform circumvention, banned categories, and abuse patterns.
• Send transactional emails / SMS / push (order updates, security alerts) and, only with your opt-in, marketing updates you can switch off at any time from /settings.
• Improve product quality through aggregated, de-identified analytics. We do not sell personal data.

The map view, “shops near me”, and proximity alerts require your device location. We request permission in-app and only store your last known coordinates while you actively use the map. You can revoke location access from your device settings; the map will fall back to your registered city.

We share information only:

• With the other party in a chat or inquiry (your display name, the shop name, and the messages you exchange).
• With infrastructure providers strictly for service delivery — Cloudflare R2 for media, Meilisearch for search, transactional email / SMS / WhatsApp gateways, and our payment partners once paid plans go live. Providers are bound by data-processing agreements.
• With Pakistani authorities when required by a valid legal order — see Section 8.

We do not sell or rent your information to advertisers.

• Account data is kept while your account is active and for up to 18 months after deletion (to support fraud investigation and to honour outstanding inquiries).
• KYC documents are kept for the regulatory minimum — 7 years — encrypted at rest and accessible only to compliance staff.
• Chat messages are retained as long as the conversation exists; deletion of an account redacts the buyer/seller identifier from past messages while preserving the counter-party's history.
• Analytics events are aggregated within 90 days and the raw events are pruned.

• Access. Sign in and visit /profile to see what we hold. You can also request a full export by writing to privacy@yaychez.pk.
• Correction. Edit your profile, shop, and listings at any time from the dashboard.
• Deletion.Open Settings → Security → Close account. Where regulation permits we honour the request within 30 days; where it doesn't, we tell you what we have to keep and why.
• Opt-out of marketing. Toggle off email / push / SMS / WhatsApp in Settings; transactional messages (security, OTP, order updates) still arrive.
• Complaint. Mail privacy@yaychez.pk — we respond within 14 days.

We use a small number of first-party cookies for sign-in (HTTP-only session), CSRF defence, and remembering your language preference. No third-party advertising cookies are set. Analytics is internal and aggregate-only.

If we receive a valid legal order from a Pakistani court, the PTA, FIA, or another empowered authority, we comply with the minimum disclosure necessary. Where the law allows, we notify the affected user.

YayChez is not intended for children under 13. If you believe a child has created an account, contact us at privacy@yaychez.pk and we will remove it.

We'll post a notice in-app and re-stamp this page's “Last updated” date whenever the substance changes. Material changes also trigger an email to all account holders.