Privacy Policy

1. Operator and contact

Only the Owner, Shwan Chawshin, is authorized to receive and manage customer-support emails and account-deletion requests. No other Admin or employee is authorized unless the Owner expressly authorizes access. This is the operator's access policy; it does not claim that mailbox delegation or every deployed application permission has been independently verified.

ZAGROS AUTO+ is owned and operated by Shwan Chawshin, an individual in the United Kingdom. ZAGROS AUTO+ is the app and public brand name, not a claim that a company has been incorporated. Shwan Chawshin is the controller for personal-data processing whose purposes and means the operator determines.

Business and correspondence address: 69 Witham, Hull, HU9 1BL, United Kingdom

For support, privacy enquiries, rights requests or account deletion, contact zagrosautoplus@gmail.com. Never send passwords, one-time codes, private keys or full payment-card details.

This notice covers the app, associated website and account/business features. ZAGROS AUTO+ is a vehicle marketplace for Iraq/Kurdistan and, where configured, the UK market. Independent sellers, service providers, sign-in providers and payment providers also have their own privacy responsibilities.

2. Accounts and sign-in information

Account features process your name, email address, phone number, profile details and language, together with password hashes where password login is used, verification attempts, recovery requests and session records. Business access adds approval status, permissions and business details. Approved business functions use the customer account; matching an email alone is not authority to link another identity.

When offered and chosen, Apple, Google or Facebook authenticates you and supplies a provider-specific identity reference and available email, verification status and name. Authentication also processes the codes or tokens needed to verify the response. Your provider password is entered with that provider, not given to ZAGROS AUTO+.

Google sign-in requests openid, email and profile, not Gmail messages, Drive files or Google contacts. It uses verified identity information for account creation, sign-in and authorized linking, and stores a derived identity reference, available email/name and login times. Where offered, Apple may supply a private relay email; Facebook requests email and public_profile and may not return an email. Disconnecting a provider is not the same as deleting the ZAGROS AUTO+ account.

3. Listings, media, messages and business records

Vehicle and service listings can contain descriptions, prices, city/location, contact details, photos, videos and publication or approval status. Business features also process service categories, permissions, credit movements and promotion history. Information published in a listing or business profile is visible to its audience and may allow contact outside the app.

Messaging features process content, participants, timestamps, read markers, notifications and reports. Customer-support emails and account-deletion requests are managed only by the Owner unless the Owner expressly authorizes someone else. This does not grant other Admins or employees access to that correspondence. Do not treat in-app messages as end-to-end encrypted or assume all upload metadata is removed.

The permanent Cloudflare backend uses Resend for requested verification and password-recovery emails, processing the recipient address, message and delivery information. Real email OTP delivery has been verified; SMS and WhatsApp OTP delivery have not. Contact links are separate from code delivery.

4. Device, location and usage data

Location functions can use a city you enter or device location you permit. On-duty location sharing by a recovery-service provider is different from a customer's one-time map location. You can manage device permissions; dependent features may then be unavailable.

Login uses session cookies or equivalent storage, and the app stores preferences such as language and saved favourites.

Optional listing and business-profile interaction counting is disabled in the current application: its event sender and ingestion path are disabled. Requested favourites, messages, listings and account operations still process the information needed for those features. Hosting and security systems still process ordinary request and connection information.

Historical versions recorded listing/profile interaction types, timestamps, record references and derived daily visitor identifiers. These identifiers are not anonymous. A contact-link tap does not prove a completed call, message or transaction. Historical records require separate purpose, access and retention review.

The app loads Google Fonts and interface resources from Cloudflare's cdnjs; map features load OpenStreetMap tiles. Those providers receive connection information to serve their resources. This separate static legal website contains no account forms, analytics scripts or advertising cookies; its host can still process requests and security logs.

5. Payment, credit and promotion information

Real customer payments are not currently active for the general public. A payment button or existing credit balance does not establish that checkout is available. Existing account, credit and transaction records and rights are preserved; this policy does not activate charging.

Where enabled, payment features process orders, amount/currency, selected products, transaction references, payment status, submitted receipts, credit movements and refund/dispute records. A payment provider may collect additional information in its own checkout. Avoid sending card security codes, bank passwords or unrelated financial documents in messages or listings.

An administrative payment-status change does not by itself prove that money was refunded. Cancelling a pending payment is not the same as reversing a settled charge. The applicable paid-product and refund terms must explain the actual service and payment route.

Refund, cancellation and credit requests are reviewed individually by Admin under the applicable terms and law. Contact zagrosautoplus@gmail.com with the relevant account or transaction reference and a description of the issue. There is no promise of automatic approval or automatic refund. Admin review does not remove, delay or override statutory consumer rights or a refund required by applicable law.

6. Why information is used

We use information to authenticate and recover accounts; provide requested listings, messages and business services; administer approval, credits and promotions; reconcile existing payment records; investigate misuse and support requests; and maintain service reliability.

For the minimum information necessary to register, authenticate or recover your account and provide the listings, messages and individual business services you request, the basis is performance of the service contract (UK GDPR Article 6(1)(b)). Without information needed for a chosen function, that function may be unavailable. This basis does not cover unrelated tracking or make you responsible for supplying optional information.

Proportionate account security, misuse prevention, support and reliability work uses legitimate interests (Article 6(1)(f)): protecting users and delivering a reliable service, with limited information and restricted access. Where a business contract is with a separate organisation, managing an authorised representative's contact and access also uses this basis. These interests must be balanced against the individual's rights; they do not permit indefinite retention or unrelated advertising.

Handling privacy requests and retaining the minimum records required by an identified applicable legal duty uses legal obligation (Article 6(1)(c)). A credit balance or database constraint is not itself such a duty. Accepting these terms, an OAuth screen or a device permission is not blanket consent for every purpose. Optional analytics, tracking or marketing requires its own applicable basis and any required consent; no such consent is assumed here.

When you visit this legal website, its host processes ordinary connection and request information, such as your IP address, to deliver and protect the pages. Our basis for necessary website delivery and proportionate security is our legitimate interest in providing reliable access to legal information. If you email us, we use your contact details and message to answer your enquiry or handle your request, on the support or legal-obligation basis described above; email services also process delivery information.

Historical interaction records remain subject to a separate review of their purpose, lawful basis and retention. Disabling new counting does not erase or retrospectively justify earlier records. Registration, social sign-in and use of this website are not blanket tracking consent. Contact zagrosautoplus@gmail.com to ask about, object to or request restriction or deletion of historical records.

7. Recipients, storage and international processing

Our published contact address uses Google's Gmail service. Google processes email delivery and mailbox storage under the terms applicable to that mailbox; using this address does not establish a business data-processing agreement or UK-only storage. Email us only the information needed for your enquiry. Google's privacy information is available at https://policies.google.com/privacy.

The existing application uses Cloudflare Workers, D1 and R2 for its permanent backend, database, media and encrypted backups. Legacy resources and records are preserved separately; provider sign-in does not authorize automatically merging distinct accounts. This separate legal website uses Cloudflare Pages and has no application database or media-storage bindings.

The permanent Cloudflare backend uses Resend for requested verification and password-recovery emails, processing the recipient address, message and delivery information. Real email OTP delivery has been verified; SMS and WhatsApp OTP delivery have not. Contact links are separate from code delivery.

Cloudflare and Resend may process data internationally. Their published safeguards are described at https://www.cloudflare.com/cloudflare-customer-dpa/ and https://resend.com/legal/dpa. These documents do not prove a particular data location, retention period or completed transfer assessment. Contact zagrosautoplus@gmail.com for applicable safeguards.

Earlier hosting environments and preserved backups may contain historical copies. Publishing this website does not migrate or erase those copies. Privacy and deletion requests must address applicable historical copies separately; no immediate deletion from every provider or backup is promised.

8. Retention and security

Our policy is to delete your account and associated personal data after secure identity verification and confirmation of the request, except specific information we are legally required to retain. A business role, unused credit, unpaid amount or administrative review is not, by itself, a reason to retain your whole account indefinitely.

We assess account/profile and session data, personal listings and owned media, messages, favourites, notifications and sign-in links separately. Shared records require care to protect other people's information and rights. Any legally retained item must be limited to necessary fields, have restricted access, and have an ending or review criterion tied to the specific legal duty.

Our retention policy requires review of account and authentication information when its service or verification purpose ends; listings and exclusively owned media when withdrawn or their service ends; and business-contact details when authority or the business relationship ends. A verified deletion request also triggers review across these categories. Information no longer needed is to be deleted or irreversibly anonymized, subject to the specific legal-retention exception above.

Security and support records are to be reviewed when the particular incident or enquiry ends. A privacy-request record is limited to information needed to handle the request and explain the outcome. At the outcome and any required complaint or compliance review, we assess what still needs to be kept and record its ending or review event. Credit and promotion rights must be reconciled without automatically retaining the whole personal profile or forfeiting existing rights.

Deletion from active systems and any remaining backup or provider copies can require separate steps. We will explain any remaining copies or unresolved steps in the outcome of your request. This notice does not promise immediate deletion from every copy or confirm a fixed backup-expiry schedule.

We will identify any specific legal-retention requirement and tell you which part of a deletion request remains unresolved. Disabling an account or queuing a task is not confirmation of complete deletion. Automatic erasure across all app systems and providers is not confirmed by this notice.

Security measures include HTTPS, password hashing, protected sessions, administrative access controls and social identity-token validation. No system guarantees absolute security. Report suspected misuse to zagrosautoplus@gmail.com.

9. Rights, requests and complaints

Depending on the applicable conditions, UK data-protection rights include access, correction, erasure, restriction and portability. You may withdraw consent without affecting earlier lawful processing.

Your right to object: you may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time.

Contact zagrosautoplus@gmail.com to exercise rights or request account deletion. Identify the account and explain your request without sending a password or OTP. Proportionate identity checks may be necessary. A legally valid request does not require special wording. See Account Deletion for practical instructions and the distinction between deletion, sign-out and uninstalling.

Requests must be handled within applicable statutory time limits, with explanations of any permitted extension or refusal. You can raise a complaint with the operator and with the UK regulator through https://ico.org.uk/make-a-complaint/. This notice does not limit your right to seek a legal remedy.

10. Eligibility and updates

ZAGROS AUTO+ is for users aged 18 or older. You must be at least 18 to register, use an account, publish listings or access business/provider features.

The effective date is shown above. We will communicate material changes appropriately and reflect them consistently in English, Kurdish Sorani and Arabic. Contact zagrosautoplus@gmail.com with questions.