This Privacy Policy explains how SIRR (the "App", "we", "us") collects, uses, stores, and shares your personal information when you use the SIRR mobile application, web app, and Market storefront (the "Service"). SIRR is operated by Mashooque Ali LLC, a limited liability company organized under the laws of the State of Wyoming, USA.
Operator: Mashooque Ali LLC — Principal Office: 1910 Thomes Ave #2, Cheyenne, WY 82001, USA — Support email: support@sirr.app.
1. Information We Collect
- Account data: email address, display name, and profile photo (optional). You may sign in with Google OAuth or with email and a password you create. If you use Google OAuth, we receive your Google account identifier and email address.
- Communications: messages you send through chat are stored encrypted on our servers and visible only to you and the recipient.
- Commerce data: shipping address, phone number, order history, wishlist, cart contents.
- Payment data: processed by a PCI-DSS compliant third-party provider. We never see or store your card number, CVV, or PIN. We retain only an opaque payment reference.
- Device & usage data: IP address (used to detect country for currency/shipping and discarded after the session unless retained for fraud prevention up to 30 days), device type, app version, crash logs.
- Cookies / local storage: session token, language preference, theme preference. We do not use third-party advertising cookies.
2. How We Use Your Information
- Provide and operate the Service (account, chat, orders, delivery).
- Process payments and prevent fraud.
- Send transactional notifications (order updates and secure sign-in links). We do not send marketing email without explicit opt-in.
- Improve product quality through aggregated, de-identified analytics.
- Comply with legal obligations (tax, anti-money-laundering, court orders).
3. Legal Basis (PDPL / GDPR)
We rely on: (a) contract — to deliver the Service you signed up for; (b) consent — for optional features such as location and marketing; (c) legal obligation — tax and regulatory record-keeping; (d) legitimate interest — security, fraud prevention, product improvement.
4. Data Sharing
We share personal data only with: hosting and database providers; payment processors; shipping carriers and fulfillment partners strictly to fulfill your orders; authorities when legally required; and, where you purchase from an independent third-party Seller on SIRR Market, the minimum delivery and contact information that Seller needs to ship your order and handle returns. We do not sell your data.
4a. Third-Party Sellers & User-Generated Content
SIRR Market may host independent Sellers. When you order from a Seller, we share your shipping name, address, phone, and order line items with that Seller solely to fulfill the order. Sellers are independent controllers for the data they receive and must handle it in line with applicable privacy law. Listings, reviews, reports, and messages you submit are user-generated content; you are responsible for what you post. We retain reports and moderation records for safety enforcement under our Terms of Service. You can flag any content using the in-app Report tool.
4b. Social Media Integrations
Sellers may choose to connect social accounts (Facebook, Instagram, Pinterest, LinkedIn) to publish product posts from SIRR. When connected, we store an access token or connection identifier provided by the platform so we can publish on the Seller's behalf. We do not access the Seller's personal social messages or contacts. You can disconnect any social account at any time from Settings > Social Channels in the Seller console.
5. International Transfers
Our infrastructure is global. Personal data may be processed outside Saudi Arabia. Transfers rely on Standard Contractual Clauses or equivalent safeguards as required by PDPL Article 29 and GDPR Chapter V.
6. Data Retention
Account data: while your account is active, plus 30 days after deletion request. Order and tax records: 10 years as required by Saudi tax law. Chat messages: deleted on user request or 12 months of inactivity. Backups: rotated every 35 days.
7. Your Rights
You may at any time: access your data, correct inaccuracies, request deletion (right to be forgotten), restrict or object to processing, port your data, and withdraw consent. Submit requests to support@sirr.app. We respond within 30 days. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA) or your local data-protection authority.
8. Children's Privacy
SIRR is not directed to children under 13. If you believe a child has provided personal information, contact us and we will delete it.
9. Security
We use TLS 1.3 in transit, AES-256 at rest, passwordless email authentication, and row-level access controls in our database. No system is perfectly secure; report vulnerabilities to the support email above.
10. Changes to This Policy
We will notify you in-app and by email at least 14 days before material changes take effect.
11. Contact
Email: support@sirr.app