Privacy Policy

Last updated: 14 June 2026
Effective date: 14 June 2026

This Privacy Policy explains how SHA7N ("SHA7N", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use the SHA7N mobile application (the "App") and the related customer services (together, the "Service").

This Policy applies to customers who register for and use the SHA7N App to request delivery and transport services. If you use the SHA7N Driver application instead, a separate privacy policy applies to that app.

By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the App.

1. Who We Are

SHA7N operates a ride-sharing and delivery logistics platform that connects customers with drivers who provide delivery and transport services in Iraq. SHA7N is the data controller responsible for your personal information processed through the App.

  • Service name: SHA7N
  • Contact for privacy matters: info@sha7n.app

2. Summary of Data We Collect

  • Account & identity — name, phone number, email, gender, date of birth, preferred language. You provide it.
  • Profile media — profile photo. You provide it.
  • Addresses & delivery details — saved addresses, delivery contact phone numbers, delivery notes, and map locations. You provide it.
  • Order data — pickup and drop-off locations, items, order history, receipts, and pricing. Generated by use; locations and details provided by you.
  • Location — your device location while the App is in use, to set pickup and drop-off points and to track your active order. Collected from your device when you use these features.
  • Financial data — wallet balance, deposits, transaction history, reward points, and selected payment method. Generated by use.
  • Device & technical data — device ID, device model and brand, operating system version, app version, IP address, push notification token. Collected automatically.
  • Communications & activity — order history, ratings and feedback you submit, in-app notifications. Generated by use.

We do not knowingly collect data from anyone under the legal age to enter into a binding contract in Iraq (see Section 12).

3. Information You Provide to Us

When you register and use the App, you provide:

  • Identity details: your name, gender, and date of birth.
  • Contact details: primary phone number (used to log in and verified by SMS one-time code) and an optional email address (verified by a one-time code when added).
  • Profile photo.
  • Addresses and delivery details: saved addresses, the map location of a pickup or drop-off point, a contact phone number for a delivery, and any delivery notes you add.
  • Order details: the items, locations, and instructions for the deliveries you request.

You may also choose to sign in using a third-party account (Google, Apple, Facebook, or FIB). When you do, we receive a basic account identifier from that provider to link it to your SHA7N account.

4. Information We Collect Automatically

4.1 Location data

To let you set a pickup or drop-off point on the map, show relevant nearby information, and let you follow your delivery, we collect your device's location while you are using the App.

  • When in use (foreground): We collect your location only while the App is open and you are using a feature that needs it, such as choosing a location on the map or tracking an active order. The SHA7N customer App does not collect your location in the background or when your screen is locked.
  • Following your driver: During an active order, we show you the assigned driver's live location and vehicle details so you can track your delivery.
  • Control: You can revoke location permission at any time in your device settings. Some features, such as picking a precise location on the map, may not work without it; you can still enter an address manually.

4.2 Device and technical data

We automatically collect a device identifier, device name, brand and model, operating system version, app version, IP address, and push notification token. This data is used for security, session management, push notification delivery, fraud prevention, and troubleshooting.

5. How We Use Your Information

We use your personal information to:

  • Create, verify, and manage your customer account.
  • Verify your phone number and, where applicable, your email address.
  • Accept and process the delivery and transport orders you request.
  • Match your order with an available driver and share the details needed to complete it.
  • Show you the assigned driver's live location and vehicle details during an active order.
  • Calculate distances, routes, fares, and any applicable discounts.
  • Process your payments, wallet balance, deposits, and reward points.
  • Send you operational push notifications (order status changes, payment and wallet updates).
  • Maintain safety, prevent fraud and abuse, and investigate disputes.
  • Provide customer support.
  • Comply with legal, tax, and regulatory obligations.
  • Improve and secure the Service.

6. Legal Bases for Processing

Where applicable law requires a legal basis, we rely on:

  • Performance of a contract — to provide the Service you sign up for and the orders you request.
  • Consent — for location access and push notifications (which you grant through device permission prompts and can withdraw).
  • Legal obligation — to meet identity verification, tax, and regulatory requirements.
  • Legitimate interests — to keep the platform safe, prevent fraud, and improve the Service.

7. How We Share Your Information

We do not sell your personal information. We share it only as described below.

7.1 With drivers

To complete an order you request, we share with the assigned driver the details needed to deliver it: your first name, the delivery contact phone number, the pickup and drop-off locations, and any delivery notes you provided. Your full account details, payment information, and order history are never shared with drivers.

7.2 With service providers (data processors)

We share specific data with trusted third parties that process it on our behalf:

  • Firebase Cloud Messaging (FCM) & Expo — delivery of push notifications. Data shared: push notification token, device platform.
  • Email providers (such as SendGrid, Mailgun, and Amazon SES) — sending verification emails. Data shared: email address.

These providers are authorized to use your data only to perform services for us and are bound by confidentiality and data protection obligations.

7.3 For legal and safety reasons

We may disclose information if required by law, court order, or government request, or where necessary to protect the rights, safety, or property of SHA7N, our users, or the public, or to investigate fraud or violations of our Terms of Service.

7.4 Business transfers

If SHA7N is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.

8. Data Retention

We keep your personal information for as long as your account is active and as needed to provide the Service. Specific retention practices include:

  • Account, profile, and address data: retained while your account exists. After account deletion, this data is removed or anonymized except where we must retain it (see below). Some records are soft-deleted (hidden and scheduled for removal) before permanent deletion.
  • Order history: retained as part of our operational, safety, and dispute records.
  • Financial records (wallet, transactions, payments): retained for the period required by applicable tax, accounting, and anti-fraud laws, even after account deletion.
  • Authentication and security logs (sessions, device info, IP addresses, SMS and email verification records): retained for security, fraud prevention, and audit purposes.

When we no longer need your information, we delete or anonymize it.

9. Data Security

We protect your information using industry-standard measures, including:

  • Encryption of data in transit (HTTPS/TLS).
  • Secure on-device storage of authentication tokens.
  • Access controls limiting who can view personal data internally.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your login credentials confidential and notify us immediately of any unauthorized use.

10. Your Rights and Choices

Subject to applicable law, you may:

  • Access the personal information we hold about you.
  • Correct inaccurate information (some profile fields are editable in the App; others may require contacting support).
  • Delete your account and associated personal data (see Section 11).
  • Withdraw consent for location or notifications by changing your device permissions.
  • Object to or restrict certain processing.

To exercise these rights, contact us at info@sha7n.app. We will respond within a reasonable timeframe and may need to verify your identity first.

Permission controls

  • Location (when in use) — used to set pickup and drop-off points and to track your active order. Control via Device Settings → SHA7N → Location.
  • Camera — used to capture your profile photo. Control via Device Settings → SHA7N → Camera.
  • Photo library — used to upload existing images. Control via Device Settings → SHA7N → Photos.
  • Notifications — used for order status and payment alerts. Control via Device Settings → SHA7N → Notifications.
  • Face ID / biometrics — used for secure, convenient login. Control via Device Settings or in-app.

11. Account and Data Deletion

You can request deletion of your SHA7N account and personal data at any time:

  • In the App: open the Account/Profile section and follow the account deletion option, where available; or
  • By email: send a deletion request from your registered email or phone to info@sha7n.app with the subject "Delete My Account".

When you delete your account, we remove or anonymize your personal data, except information we are legally required to retain (such as financial, tax, and certain fraud-prevention records) and information necessary to resolve disputes or enforce our agreements. Any outstanding balances or open orders must be settled before deletion can be completed.

12. Children's Privacy

The Service is intended only for individuals who are of legal age to enter into a binding contract in Iraq. The App is not directed to children, and we do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will delete it.

13. International Data Transfers

Some of our service providers (such as cloud storage, maps, payment, and notification services) may process data on servers located outside Iraq. Where we transfer data internationally, we take steps to ensure it remains protected in accordance with this Policy and applicable law.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the App. Your continued use of the Service after an update means you accept the revised Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data:

SHA7N
Email: info@sha7n.app

This Privacy Policy is governed by the laws of the Republic of Iraq.

Terms of Service →