Karwaan Privacy Policy

This policy explains what personal information Karwaan collects, why we collect it, who we share it with, how long we keep it, and what you can do about it. It is written to describe what our apps and websites actually do. If anything here is unclear, write to us at the address in section 18.

1. Who we are and what this policy covers

Karwaan ("Karwaan", "we", "us") is an online marketplace for Afghanistan. Shops of all sizes, retail and wholesale, list their goods on Karwaan; buyers order them and usually pay the courier in cash when the parcel arrives.

This policy applies to:

• the Karwaan website at karwaan.io and our wholesale storefront at wholesale.karwaan.io;
• the Karwaan mobile app for Android and iPhone;
• the Karwaan seller console, which shops use to manage listings, orders and payouts;
• the messages, calls and text messages (SMS) we send or connect in the course of an order.

It covers buyers, business (wholesale) buyers, sellers and their staff. Couriers who deliver Karwaan parcels register through a separate courier app, which has its own privacy notice; section 14 explains what Karwaan itself receives about them.

2. Information we collect

2.1 Information you give us

• Account details. Your first and last name, mobile phone number, email address (optional if you sign up with your phone), password, and date of birth. We ask for your date of birth to confirm that you are at least 18 (see section 15): on the sign-up form if you sign up with your email address, and before you can use your account if you sign up with a phone code or with Google or Apple. A person opening a business account gives their own date of birth. If you sign in with Google or Apple, we receive an identifier for that account and the email address it shares with us.
• Profile photo, if you choose to add one.
• Delivery addresses. The recipient's name, phone number and an optional second phone number, the province and district, the area, street and landmark you describe, an optional note for the courier, and, if you place it, a pin on the map marking the exact door.
• Orders. What you bought, from which shop, the price, delivery charges, any cash-collection fee, the payment method, and the address and phone number the order was sent to.
• Returns, claims and cancellations. The items concerned, the reasons you give, anything you write to us about them, and the outcome, including any refund.
• Messages. What you write to sellers and to our support team, including any photos or files you attach.
• Reviews, ratings and questions. Product reviews and any photos you add to them, ratings of sellers and of couriers, and questions you ask about products.
• Gift cards and registries. If you buy a gift card, the details of the purchase and the name you enter for the recipient; if you create a list or a gift registry, its name and contents.
• Support requests and privacy requests. What you tell us when you ask for help or when you ask about your data, and the contact email you give us.
• Business accounts. If you open a business account for wholesale buying, the name of the person who will own the account, together with the contact details above.
• Sellers. The additional information shops provide is described in section 13.

2.2 Information collected automatically

• Device and connection information. Your IP address, the app version and build, the device model and brand, the operating system and its version, your language and time zone, and an identifier for your installation of the app. We use these together to recognise the devices you sign in on and to protect accounts from being taken over.
• Sign-in and security records. When you sign in, fail to sign in, change your password or phone number, or accept our terms, we record when it happened and from which device and IP address.
• Notification tokens. If you allow notifications, the token that lets us send alerts to your phone or browser.
• How you use Karwaan. Products you view, searches you make and results you open, items you add to or remove from your cart, checkouts you start and complete, returns completed and reviews submitted. On the website these are linked to your account if you are signed in, and otherwise to a random identifier stored in a cookie (see section 7).
• Location, only when you ask. The app reads your device's location only when you tap the control that pins your delivery address, and only while the app is open. It never reads your location in the background. On the website, your browser asks your permission, and your location is read only when you ask the map to find you.
• Crash reports. If the mobile app crashes, a technical report of the error is sent to our crash-reporting provider (see section 5). These reports do not include screenshots or what was on your screen.
• Advertising information, in the mobile app only. Google's advertising software in the app collects your device's advertising identifier (on Android unless you delete or reset it; on iPhone, only with your permission), your IP address, device and app information, and which advertisements were shown and tapped. Section 8 explains this and how to turn it off.

2.3 Information we receive from others

• Sellers tell us whether they accepted, packed and shipped your order, and about returned goods they inspect.
• The delivery service and couriers tell us where your parcel is, whether the delivery succeeded or failed and why, how much cash was collected, and, where the courier takes one, a proof-of-delivery photograph.
• Google and Apple, if you use them to sign in, confirm your identity to us.
• Other users may report a message, review or account to us, and a seller may reply to your review.

2.4 Payment information

Buyers pay the courier in cash on delivery, or with Karwaan store credit (money added to your Karwaan balance from refunds, awarded claims or gift cards). We do not ask buyers for card or bank details, and store credit cannot be withdrawn as cash. We keep a record of every payment, cash collection, refund and balance movement on your account.

3. How we use your information

We use personal information to:

• Run your account: create it, sign you in, verify your phone number and email, and keep your settings.
• Take and deliver orders: pass your order to the seller, arrange delivery, confirm the order by a code sent to your phone, send you a delivery code to give the courier at the door, collect the cash, and show you where your parcel is.
• Handle returns, claims, cancellations and refunds, and keep the records that show what was agreed and paid.
• Let you talk to sellers and to us, and keep the conversation so that disputes can be resolved.
• Show reviews, ratings and questions to other shoppers.
• Personalise the store: recently viewed items, recommendations, and "bought together" suggestions. Recommendations about products are calculated from many shoppers' activity combined, and two products are only linked once enough different shoppers have produced that link that it cannot point back to any one person.
• Send you notifications by in-app message, push alert, email or SMS about your orders, returns, claims, messages and account security, and, if you have not turned them off, about deals and products you have asked to follow.
• Keep Karwaan safe and fair: prevent fraud and fake orders, protect accounts, limit abuse, investigate reports, and enforce our Terms of Service.
• Run rewards: Karwaan Coins and inviting friends, including the checks that stop one person claiming an invitation reward from their own second account (section 4).
• Show sponsored products and charge the sellers who pay for them (see section 8).
• Meet legal, tax and accounting obligations, and establish, exercise or defend legal claims.
• Improve and fix Karwaan, using crash reports, service logs and statistics.

We do not sell your personal information.

4. Automated checks

Some decisions in Karwaan are made or assisted by automatic rules. We want you to know what they are:

• Cash-on-delivery risk checks. When you place a cash order, the system scores it using signals such as whether you have ordered before, the size of a first order, earlier refused or failed deliveries, and how many unpaid cash orders you already have on the way. A high score sends the order to a member of our team for review before it is dispatched. The score does not on its own cancel your order.
• Cash limits. A cash order may be refused if you already have too many undelivered orders you have not yet paid for, or if its value is more than a courier is permitted to carry. If you often refuse deliveries at the door, we may ask for part of the payment in advance on later orders.
• Message screening. Messages between buyers and sellers are automatically checked for phone numbers and other contact details. Messages are not blocked; a flagged message may be read by our moderation team to protect buyers from deals taken outside Karwaan, where our protections do not apply.
• Invitation checks. When you enter a friend's invitation code, and again when your first order qualifies for the reward, we compare the two accounts: the identifier of the device the code was entered on (an identifier for your installation of the app, or on the website the kw_device cookie in section 7, which we store only in a scrambled, hashed form), the phone numbers on the accounts and on the order, and the delivery addresses. A match does not refuse the reward on its own; it holds it for a member of our team to review.

If you think an automated check has treated you unfairly, contact us and a person will look at it.

5. Who we share your information with

5.1 Sellers

When you order from a shop, the seller receives what it needs to fulfil the order: the recipient's name, phone number and delivery address (including landmark and delivery note), and the items ordered. Sellers also see the messages you send them, returns and claims you open against their orders, and your reviews and ratings of their shop. Sellers do not see your email address or your payment history with other shops.

5.2 The delivery service and couriers

Karwaan parcels are carried by independent couriers through a delivery platform that serves Karwaan and our sister service, Ravaan. For each parcel the platform receives the recipient's name, the delivery address, landmark and map pin, your delivery note, the amount of cash to collect, and the pickup address of the shop. The courier's app shows the courier your name and a partly hidden version of your phone number. How calls between you and the courier work is explained in section 6. The ratings you give a courier are shared with the delivery platform.

While your parcel is on its way, we show you the courier's first name, a description of their vehicle, and their location on a map. We do not show you the courier's phone number.

5.3 Other users and the public

• Your product reviews, ratings of sellers and questions are public and appear with your first name only.
• If you enter a friend's invitation code, that friend sees your initials, the date you entered the code and the status of the invitation, such as whether your first order has been delivered. They do not see your name, contact details or orders.
• If you share a list or gift registry, anyone with the link can see its name and the items on it. A registry never shows your address, your identity or who bought what.
• Sellers' public shop pages show the shop's name, description, logo and ratings. They do not show the seller's legal name, tax number or private contact details.

5.4 Service providers

We use the following providers to run Karwaan. Except for Google AdMob, as its row says, they process information on our behalf and only for the services they provide to us.

5.5 Legal and safety reasons

We may disclose information when the law requires it, when a competent authority in Afghanistan lawfully requests it, to tax authorities in connection with sellers' tax obligations, or when it is necessary to protect the safety of a person, to prevent fraud, or to establish or defend a legal claim.

5.6 Business changes

If Karwaan is reorganised, merged or sold, personal information may pass to the new owner, who must continue to protect it as this policy describes.

6. Calls, codes and couriers

• Codes by SMS. We send codes to the phone number on your account or order: to sign you in, to confirm a cash order, and to confirm handover at the door. Give the delivery code to the courier only once you have the parcel.
• Calls with the courier. When our number-masking service is switched on, calls between you and the courier are connected through a temporary number, so neither of you sees the other's real number. When it is not, the courier's app is given your number for the active delivery only, and we keep a record that it was disclosed, without storing the number itself in that record. Calls cannot be placed through Karwaan after the delivery is finished.
• No call recordings. We do not record calls. We keep only the time, duration and outcome of calls placed through the masking service.
• Proof of delivery. A courier may take a photograph of the parcel at the point of delivery. It is kept with the delivery record and used to resolve disputes about whether a parcel arrived.

7. Cookies and similar technologies

The website uses a small number of its own cookies. It does not use third-party advertising cookies.

The website also stores a few settings in your browser's local storage: your delivery district, wholesale products you viewed recently, announcements you have dismissed, and — for up to 24 hours after you sign up by email — the page you were heading to, so you return to it once you confirm your address. The mobile app keeps your sign-in securely on your device and caches some content to work on slow connections.

The session cookies are necessary for the site to work. You can delete cookies or local storage in your browser's settings at any time; you will then be signed out, and your cart and preferences on that browser will be forgotten.

8. Advertising and sponsored products

• Sponsored products. Sellers can pay to have their products shown in marked "sponsored" places on Karwaan. Which sponsored product appears depends on the page or search you are looking at, not on a profile of you. We record each time a sponsored product is shown or clicked against the random kw_sid identifier (on the web) so that sellers are charged correctly and fake clicks can be detected. These records are deleted after 90 days.
• Advertising in the mobile app (Google AdMob). The Karwaan mobile app includes Google's Mobile Ads software (AdMob), which is used to show advertisements from other companies, marked as advertisements. The website does not include it. Karwaan's own sponsored products are not shown through AdMob, and nothing about them is shared with Google.
• What AdMob collects. When the app requests an advertisement, Google receives your device's advertising identifier, your IP address, from which an approximate location can be worked out, your device model, operating system and language, the app's name and version, and which advertisements were shown to you and which you tapped. On Android the identifier is the Advertising ID, and it is shared unless you have deleted or reset it; on iPhone it is the IDFA, and it is shared only if you allow it. Google uses this information to deliver and measure advertisements, to limit how often you see the same one, and to detect fraud and abuse. Unless you have refused or turned it off as described below, Google also uses it to choose advertisements based on your interests. Google handles this information as an independent company under its own privacy policy, which explains how it uses information from apps that use its services (policies.google.com/technologies/partner-sites). We do not give Google your name, phone number, email address, delivery addresses or orders.
• Your consent. The app does not ask everyone for consent to advertising. Where the law of the country you are in requires consent to personalised advertising, Google's consent form is shown, and you can refuse. Google shows this form only where the law requires it, such as in the European Economic Area and the United Kingdom, and not in Afghanistan. On iPhone, the app asks your permission through Apple's App Tracking Transparency before the advertising identifier can be used; if you refuse, the identifier is not shared and only non-personalised advertisements are requested. When either of these prompts is about to appear, the app first explains what advertising is for. On Android, where Google's form is not shown, the app does not ask: the Advertising ID is shared, and advertisements can be personalised, until you delete or reset your advertising ID or turn off ad personalisation as explained below. Non-personalised advertisements are chosen from the app and the moment, not from a profile of you, although Google still uses the information above to deliver, measure and protect them.
• How to opt out. On iPhone, turn off Settings → Privacy & Security → Tracking for Karwaan. On Android, open your phone's Google settings, choose Ads, and delete or reset your advertising ID; on some phones this is under Settings → Privacy → Ads. You can also review and turn off ad personalisation for your Google Account at myadcenter.google.com. Turning these off does not stop the app from working, and it does not stop advertising: it stops advertising from being personalised to you.

9. Where your information is stored

Karwaan's servers and stored files are hosted by Amazon Web Services in the United States. Some of our providers listed in section 5.4 process information in other countries. By using Karwaan, you understand that your information is transferred to, stored and processed outside Afghanistan. We choose providers that protect information to a standard consistent with this policy.

10. How long we keep information

We keep personal information only as long as we need it for the purposes in section 3:

• Account information is kept while your account is open. When you delete your account, it is removed as described in section 12.
• Order, cash, refund and balance records, including Karwaan Coins and invitation records, are kept for as long as tax, accounting and anti-fraud rules require, and then deleted.
• Browsing and shopping activity used for recommendations is kept for up to 400 days. When you delete your account, its link to you is removed.
• Records of sponsored product views and clicks are kept for 90 days.
• Copies of your data prepared on request can be downloaded for 14 days and are then deleted.
• Records of actions taken in the seller console and by our staff are kept for up to ten years, because they are the record of who did what with orders, money and accounts.
• Proof-of-delivery photos and delivery records are kept with the order they belong to.

Kept information is deleted permanently when the period ends. Backups are cleared on their normal rotation.

11. How we protect your information

• All connections to Karwaan are encrypted.
• Your phone number, date of birth and contact details are encrypted in our database, and the codes you give couriers are stored encrypted.
• Passwords are stored only in a hashed form that cannot be turned back into the password.
• You can add an authenticator app as a second step when you sign in, so that a stolen password alone cannot open your account.
• Our staff can see personal information only where their role needs it, and their actions are logged.
• Identity documents and other private files are stored privately and shown only through links that expire.

No system is perfectly secure. If a security incident affects your personal information, we will tell you and take the steps the law requires.

12. Your rights and choices

• See and download your data. In your account, A copy of your data makes a file of everything the account holds, straight away: your details and settings, orders, returns and refunds, saved addresses, reviews and questions, messages with sellers and with us, and the devices you are signed in on.
• Ask us about your data. Under Your data and privacy in your account, you can ask for a copy of your data or ask us to delete your account. Every request is given a date by which we will answer, no later than 30 days after we receive it, and you can read our answer on the same page.
• Correct your data. You can change your name, photo, email, addresses and notification settings in your account. Changing your phone number requires confirming it with a code sent by SMS.
• Delete your account. You can delete your account yourself in the app (You → Settings → Delete my account), on our account deletion page, or by writing to us from the email address on your account. Deletion takes effect immediately. We remove or anonymise your name, email, phone number, date of birth, photo, sign-in methods, sessions, device identifiers, saved addresses and your notifications, and replace the text of messages you sent. Some records are kept, as explained on that page and in section 10: order and money records; reviews, which stay without your name; and activity used for recommendations, which is no longer linked to you.
• Marketing. You can turn off marketing messages and choose how you receive each kind of notification in your notification settings. Marketing emails include an unsubscribe link. Some messages are always sent while you have an account, such as sign-in and delivery codes and messages about your orders and your account's security.
• Device permissions. You can withdraw permission for location, photos, camera, notifications or tracking at any time in your phone's settings. Karwaan keeps working; only the feature that needed the permission stops.
• Advertising. In the mobile app you can refuse or withdraw permission for personalised advertising at any time, as section 8 explains.
• If we cannot do what you ask. We will tell you why. For example, a seller's shop records and a staff member's actions cannot be erased on request (see section 13). If you are not satisfied with our answer, write to us and a different member of the team will review it.

13. Sellers and shop staff

If you sell on Karwaan, we also collect and use:

• Shop details: the shop's display name and, where given, legal name, description, logo, opening hours, holidays, pickup address and map location, and the shop's support phone and email.
• Verification documents: the documents and numbers you submit so that we can verify your shop, such as your tazkira (national identity document), a business licence, a Tax Identification Number (TIN), proof of address, and the bank or hawala account for payouts. Our staff review them, and some documents have expiry dates after which we will ask for new ones.
• Payments and tax: sales, fees, commissions, settlements, payouts, advertising invoices, plan subscriptions and the cash payments made for them, and your Business Receipts Tax (BRT) band. Where the law requires, BRT is calculated and withheld from settlements, and tax records may be shared with the tax authorities.
• Performance: counts of late shipments, cancellations and fulfilled orders, ratings from buyers, and the standing of the account.
• Team members: the people you invite to help run your shop, their roles, and the actions they take in the seller console.
• Payout details are shared with the bank, hawala agent or other channel that delivers the payment.

Your TIN, legal name and private contact details are never shown to buyers. Because invoices, settlements, tax records and verification documents are commercial records that buyers and authorities rely on, an account that owns a shop cannot be erased on request while it holds those records; a staff member's access must first be removed by the shop owner. You may still make a request, and we will answer it with the reason for any refusal.

14. Couriers

Couriers register, are verified and are paid through the delivery platform described in section 5.2, using its own courier app and under its own privacy notice. Karwaan itself receives, for each parcel: the courier's first name and a description of their vehicle to show the buyer, the courier's location while the parcel is on its way, the result of each delivery attempt, the cash collected, any proof-of-delivery photo, and the ratings buyers give. We use this to run deliveries, handle claims and account for the cash.

15. Children

You must be at least 18 years old to hold a Karwaan account. If you sign up with your email address, we ask for your date of birth before the account is created. If you sign up with a code sent to your phone or with Google or Apple, the account is created when you first sign in, and it cannot be used until you give a date of birth showing that you are 18 or over; if the date you give is under 18, we do not keep it and you cannot sign in. Anyone whose account was opened before we asked for a date of birth is asked at their next sign-in. A business account must be opened by an adult authorised to act for the business, who gives their own date of birth. If we learn that an account belongs to someone under 18, we will close it and delete its information.

16. Changes to this policy

We may update this policy when Karwaan changes. The version and effective date are shown with it. If a change significantly affects how we use your information, we will tell you in the app, on the website or by message before it takes effect.

17. Governing law

This policy is governed by the laws of Afghanistan.

18. Contact us

For any question about this policy or your personal information, or to make a request about your data, write to support@karwaan.io. You can also use the Your data and privacy page in your account. We answer in Dari, Pashto and English.