Privacy Policy

Beyzo (“we”, “us”, “our”) operates a mobile-phone classifieds marketplace for Pakistan, accessible via beyzo.pk and the Beyzo mobile app (Android package pk.beyzo.app). This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have.

This policy is written to align with Pakistan's Prevention of Electronic Crimes Act 2016 (PECA) and the Personal Data Protection Bill (PDPB) framework, and follows GDPR-style principles for forward compatibility.

1. Who we are

• Service operator: Beyzo
• Contact for privacy matters: support@beyzo.pk
• Registered service: beyzo.pk website and Beyzo Android app
• Primary users: buyers and sellers of new and used mobile phones in Pakistan

2. Data we collect

2.1 When you create an account

• Phone number (required, used for OTP login)
• Full name and display name
• Email address (optional)
• Date of birth (for age verification — service is 18+)
• City and area (to show you relevant listings)
• Password (hashed with Argon2id — we never see the plain password)

2.2 When you post a listing

• Listing title, description, price, brand, model, storage, RAM, colour, condition
• Photos of the phone (uploaded to our secure storage; location EXIF stripped)
• IMEI, stored as a one-way SHA-256 hash for duplicate and stolen-device detection — the original number is never stored or displayed
• PTA status and warranty information

2.3 When you become a verified shopkeeper (optional)

• CNIC number (encrypted at rest; required for Pakistan KYC / AML compliance)
• CNIC document scan (encrypted; retained for 5 years after account closure as required by AML rules)
• Shop address and business phone
• Shop storefront photo

2.4 When you interact with listings

• Phone reveal requests (which listings you asked to see the seller's number)
• Chat messages between you and other users (encrypted in transit and at rest)
• Saved searches, saved listings, wishlists, viewed listings

2.5 When you use payment features (future)

• Wallet top-up records
• JazzCash / EasyPaisa transaction references
• We do not store card numbers or bank credentials — those are handled directly by the payment provider.

2.6 Collected automatically

• Device information (model, OS version, app version)
• IP address (stored only as a keyed hash for abuse detection — raw IP is not retained)
• Approximate location (derived from your selected city — not GPS)
• Push notification tokens (Google FCM / Apple APNs, only if you enable notifications)
• Crash reports and performance telemetry (via Sentry — personal messages, passwords, phone numbers are never transmitted)

3. Why we collect this data

4. Who we share data with

We do not sell your personal data. We share it only with the following categories of service providers, each bound by a data-processing agreement:

We also disclose data when required by Pakistani law — for example, a court order or a PECA-2016 request from the FIA or PTA.

5. How long we keep your data

6. Your rights

You have the following rights over your personal data:

• Access — request a copy of what we hold about you
• Correction — update your profile from Account → Profile
• Deletion — permanently delete your account from Account → Delete Account (or via beyzo.pk/delete-account). Legal-retention exceptions listed above still apply.
• Portability — export your data in machine-readable JSON
• Opt out of marketing — per-channel toggles under Account → Notification preferences
• Withdraw consent — at any time, effective immediately

We aim to respond to any privacy request within 30 days. For requests you can't complete inside the app, email support@beyzo.pk.

7. Security

We protect your data with:

• TLS 1.3 encryption in transit
• Envelope encryption at rest for sensitive fields (phone number, CNIC, KYC documents)
• Argon2id password hashing
• Two-factor authentication for admin access
• Regular security audits and threat modelling
• Continuous monitoring for unusual activity

If a data breach affects you, we will notify you within 72 hours of confirming the breach.

8. Children

Beyzo is intended for users aged 18 and above. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please contact support@beyzo.pk and we will remove it.

9. International data transfers

Some sub-processors (Cloudflare, Google, Apple, SendGrid, Sentry) are based outside Pakistan. We rely on contractual safeguards with each provider. When PDPB requirements are finalised, we will implement any additional measures required for cross-border transfers.

10. AI and automated decision-making

Beyzo does not use AI to make automated decisions about you (e.g. we do not auto-reject accounts or listings using machine learning). We use non-AI algorithms for search ranking, duplicate detection, and fraud signals. When we introduce any AI-driven feature, we will update this policy and (where required) request explicit consent.

11. Changes to this policy

If we make material changes, we will notify you in the app and update the “Last updated” date at the top. Continued use of Beyzo after a change means you accept the updated policy.

12. Contact

Questions or complaints about privacy: support@beyzo.pk

If you are not satisfied with our response, you may complain to the relevant Pakistani regulator (currently PTA; once PDPB is enacted, the designated data-protection authority).