Privacy Policy

Last updated: 2 August 2026 — effective from the date of publication.

This policy explains how the Banzeen Khana app collects, uses, protects and shares your data. By using the app you agree to this policy.

1. Who we are

Banzeen Khana is an Iraqi fuel and energy services platform that connects customers with delivery agents (gas cylinders, kerosene, oils) and with fuel stations and their information. Privacy contact: sabticode@gmail.com

2. Data we collect

a) Account data

• Full name.
• Phone number (stored in a normalized +964 format to prevent duplicate accounts).
• Account type: customer, delivery agent, or station owner.
• Governorate (for agents and station owners).

b) One-time password (OTP)

Sign-in uses a one-time code sent by SMS to your phone. The code is stored hashed only, together with its expiry time and attempt counter. We never store or log it in plain text.

c) Order data

• The name and phone number used for the order.
• The written address and the delivery point coordinates (latitude and longitude).
• Service type, quantity, order status, and status timestamps.

d) Delivery agent data

• Activity type (gas, kerosene, oils, station owner).
• Vehicle details and a vehicle photo (selected from the photo library at registration or when editing the account).
• Account approval status set by our admin team.

e) Fuel station data

• Station name, location, working hours and available fuel types.
• Station photos and the assistant accounts linked to the station.

f) Device and notification data

• Push notification token (FCM token).
• Platform (Android / iOS), device identifier, interface language, and last-used time.

g) Technical and security data

• IP address, app/browser type, access and error logs — for operations and security.

h) Usage statistics

We record how many times an agent or station page is opened, aggregated per day (view count and unique visitors), so agents and station owners can see how their page performs.

3. Device permissions

• Location (while using the app only): to set the delivery point on the map. You may deny it and type the address manually.
• Notifications: to inform you about your order status and important messages.
• Photo library: only to pick a vehicle photo or a station photo when needed.

Each permission is requested only when needed and can be revoked at any time in your device settings.

4. How we use your data

• Creating your account and verifying ownership of your phone number.
• Creating and fulfilling orders and delivering to the correct address.
• Sending operational notifications (accepted, on the way, arrived, completed, rejected).
• Reviewing and approving agent and station owner applications.
• Protecting the platform from abuse, duplicate requests and fraud (rate limiting).
• Improving the service through aggregated statistics.
• Support and answering your enquiries.

Legal bases: performance of the service you requested, your consent (permissions and notifications), our legitimate interest in platform security, and compliance with applicable law.

5. Data sharing

We do not sell or rent your data to anyone. Sharing happens only in these cases:

• With the other party to your order: when you place an order, the selected agent sees your name, phone number, address and delivery location — solely to fulfil the order. Your order data is not shown to any other agent.
• With service providers required to run the app:
  • Google Firebase Cloud Messaging — to deliver push notifications to your device.
  • Google Maps — to display maps and select locations.
  • SMS provider (OTPiq) — to send the verification code to your phone.
  • Hosting and server provider — to store data and run the service.
• With our admin team: to the extent needed for review, support and issue resolution.
• Where legally required or upon an official request from a competent authority, or to protect the rights of users and the platform against fraud and abuse.

6. Data security

• All communication with our servers uses an encrypted connection (HTTPS).
• No passwords are used; sign-in relies on a hashed one-time code that expires within minutes and has a limited number of attempts.
• The session token is kept in the device's secure storage and is revoked on sign-out or account deletion.
• Uploaded images are stored on a private (non-public) location and are served only to authorized users.
• Rate limits are applied to sensitive operations (sign-in, OTP sending, order creation).
• Permissions and ownership are verified before any data access, so no account can see data that does not belong to it.

No method of protection is 100% guaranteed, but we follow widely accepted best practices.

7. Data retention

• Account data: for as long as your account is active.
• Orders: retained as a service record for both parties, for as long as legally and operationally necessary.
• OTP codes: expire within minutes and are invalidated after use.
• Notification tokens: deleted on sign-out or account deletion.
• Technical logs: kept for a short period for security, then deleted.

8. Your rights and account deletion

• Access and correction: you can view and edit your data inside the app.
• Delete your account in the app: from the account/settings screen choose "Delete account". On deletion we immediately revoke all access tokens, stop all push notifications, and deactivate the account and remove your data from use inside the app. This action cannot be undone.
• By email: you can request deletion or a copy of your data at sabticode@gmail.com — we respond within 30 days at most.
• Revoke permissions: you can turn off location, notifications or photo access from your device settings at any time.

Note: we may retain some order records tied to another party (agent or station) or required by law, decoupled from your account where possible.

9. Children's privacy

The service is not directed to anyone under 18 and we do not knowingly collect their data. If we learn that a minor holds an account, we will delete it.

10. Processing outside Iraq

Some data may be processed on service providers' servers outside Iraq (for example Google services for notifications and maps), under appropriate safeguards and solely to operate the service.

11. Changes to this policy

We may update this policy from time to time. The last-updated date at the top of this page will change, and for material changes we will notify you inside the app or by notification.

12. Contact us