Privacy Policy

1.1 Information You Provide Directly

• Full name, email address, mobile phone number, date of birth, and a self-selected username when you register
• Profile photo, biography, and a city / region location you choose to share
• Listing content: photographs, videos, titles, descriptions, prices, condition, brand, material, country of origin, and a pickup city + suburb when you offer direct pickup
• Order content: shipping address (recipient name, phone, full street address), delivery option chosen, and any notes you attach to the order
• No payment card details at all. OurBazaar does not store your card number, expiry, CVV, or even your card brand and last-4 digits. You enter your card on our payment processor’s own secure form each time you pay, and it is never sent to us
• Identity documents you submit for KYC: a copy of your CNIC (front and back) and a selfie or short video used for liveness / face-match verification
• If you register a business: its legal name, entity type, registered address, FBR National Tax Number (NTN), SECP CUIN where the entity type has one, an optional STRN, and the shop name, logo, support email and support phone you want buyers’ problems to reach
• Business registration documents you upload for verification — for example an FBR NTN certificate, a SECP incorporation certificate, a partnership deed, a trade licence, a utility bill, a bank statement, or the representative’s CNIC
• Messages you send to other users via in-app chat (one-to-one and product-anchored chats), plus the metadata our backend logs about those messages (sender, recipient, conversation id, timestamps)
• Support tickets you raise (subject, description, attached evidence photos / PDFs) and the full correspondence with our support team
• Reviews, ratings, comments, friend requests, blocks, and any other social interactions you perform on the Platform

1.2 Information Collected Automatically

• Device and app information sent with each request (app version, platform, OS version) and the IP address your request arrives from
• Your in-app search queries, and which listings you open — see “Personalisation & Automated Decisions” below for how these are used
• Which listings you view, bid on, favourite, or buy, recorded as activity events against your account
• Push notification token issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM)
• Your device advertising identifier — Apple’s IDFA on iOS (only if you allow tracking when asked) or Google’s Advertising ID on Android — used to serve and measure ads. See Section 14
• How you interact with ads: which ad was shown, whether at least half of it stayed on screen for a full second, how long it remained visible, and whether you tapped it. These records are linked to your account
• Diagnostic logs: client-side errors and warnings your app reports to us, plus server error, performance, and access logs. These never contain chat message bodies or KYC document contents
• Your online / last-active status, so other users can see whether you are available to chat. You can turn this off at any time under Profile → Privacy → Activity status

1.3 Information From Third Parties

• OAuth providers: when you sign in with Google or Apple, we receive your name, email, and profile photo from that provider. We never receive your Google / Apple account password.
• Payment gateway: transaction status, transaction reference id, fraud-screening signals, and refund status from our payment partner.
• SMS / WhatsApp delivery confirmations from the OTP / messaging providers that send your verification codes.
• Public reports about you that we may receive from other users (abuse reports, listing complaints).

1.4 Biometric Data (KYC Only)

Where you complete identity verification, we process biometric data in the form of facial geometry derived from your selfie / liveness video, and we compare it against the photo on your CNIC. The photo and video are held by our verification provider as documentary evidence of the result, not by OurBazaar; the biometric template exists solely for the duration needed to complete the match. (Where you submit your CNIC manually instead of using the camera flow, any images you upload are stored by OurBazaar.) We do not use biometric data for any purpose other than KYC, do not share it with advertisers, and do not use it to identify you outside of the verification flow itself.

1.5 Your Phone Contacts (Optional)

If you use “Find Friends” and grant the contacts permission, the app reads the phone numbers in your device address book and sends them to our server so we can tell you which of your contacts already have an OurBazaar account. This is entirely optional — declining the permission leaves every other feature working.

We designed this to keep as little as possible: the phone numbers you send are used for that one lookup and are never written to our database. We log only how many numbers were in the batch, never the numbers themselves. We do not build a social graph from your address book, do not store the contacts of people who are not OurBazaar users, and do not use your contacts for advertising or to suggest you to other people. Revoking the permission in your device settings stops this immediately; there is nothing retained for us to delete afterwards.

1.6 What We Do Not Collect

So that this policy is not read as broader than the truth: we do not collect your precise GPS location, we do not track you across other companies' apps or websites, and we do not sell personal data to anyone.

This section previously said we used no advertising identifier and ran no advertising SDK. That stopped being true when we introduced ads, and we have corrected it rather than quietly leaving it. Section 14 sets out exactly what advertising now involves and how to limit it.

• Create and manage your account, verify your identity (KYC), and authenticate you on each visit
• Display your listings, profile, and ratings to other users, and personalise your home feed and search results
• Facilitate buy-now, auction, and direct-pickup transactions between you and other users
• Process payments, payouts, refunds, and fraud prevention checks with our payment partner
• Coordinate shipping with logistics partners (where the platform-shipping delivery option is used)
• Send transactional notifications you have not opted out of: order updates, OTPs, security alerts, bid outbid warnings, auction-won notices, refund confirmations, and support replies
• Send marketing communications only where you have opted in, and only until you opt out
• Provide customer support, mediate disputes, and enforce these Terms and our community guidelines
• Improve the Platform: identify and fix bugs, measure feature adoption, run A/B tests on UI changes, and tune fraud-detection thresholds
• Show ads in the app, measure whether they were actually seen, report performance to the advertisers who paid for them, and cap how often you see the full-screen ad (Section 14)
• Comply with our legal obligations under Pakistani law (including the Prevention of Electronic Crimes Act 2016, applicable tax law, and lawful court / regulator orders)

We do not sell your personal data. We share information only in the limited circumstances listed below, and only the minimum data needed for each purpose:

• With other users: your public profile (name, username, photo, listings, ratings, member-since date) is visible to anyone on the Platform. Your shipping address is shared with the seller of an order only after payment is confirmed, and the seller's pickup city / suburb is shared with the buyer only after they pick the direct-pickup option at checkout.
• Service providers (processors): we disclose the minimum data needed to engaged third-party vendors who process data on our behalf under written agreements that restrict their use. The named list appears in “Third-Party Service Providers” below.
• Law enforcement and regulators: we may disclose data where we are compelled by Pakistani law (PECA 2016, the Federal Investigation Agency's Cyber Crime Wing, the Federal Board of Revenue, the State Bank of Pakistan, or a court order), or where we believe disclosure is necessary to protect the safety of our users or the public.
• Business transfers: in the event of a merger, acquisition, restructuring, or sale of substantially all of our assets, your data may transfer to the successor entity, subject to the same protections as this Policy. We will notify you in-app at least 30 days in advance where reasonably practicable.
• Advertising partners: when an ad slot is filled by Google AdMob rather than by an advertiser who booked directly with us, Google receives your device advertising identifier, IP address, and coarse device information in order to select and measure that ad. We do not send Google your name, phone number, email, CNIC, chat contents, or order history. Whether the identifier is used to personalise the ad depends on the choice you make in the prompts described in Section 14.
• Direct advertisers: businesses who book ad space with us receive aggregate performance figures only — impressions, viewable impressions, clicks, and average time on screen. They never receive anything that identifies you.
• With your consent: any other sharing will happen only after we explicitly ask and you explicitly agree.

To build trust on the Platform and to comply with applicable anti-fraud and anti-money-laundering regulations, certain features (selling items, withdrawing earnings, high-value bidding) may require successful KYC. The verification flow asks for:

• A photo of the front and back of your CNIC (Computerised National Identity Card)
• A short selfie video used for liveness check (to confirm a live person is present and not a static photo)
• A face-match comparison between your selfie and the photo on your CNIC

Verification is carried out for us by Didit, a specialist identity verification provider. Your CNIC images and selfie video are captured inside their secure component and sent to them; they perform the document check, the liveness check and the face match, and they store those images and that video on their own infrastructure in the European Union. OurBazaar does not receive or keep a copy of the images or the video.

What OurBazaar keeps is the outcome and the details read off the card: your name as printed, CNIC number, gender, date of birth, date of issue and expiry, and the address on the document, together with the verification result and a one-way cryptographic hash of your CNIC number. We use that hash to enforce one account per identity document; it cannot be reversed to recover the number.

The provider also analyses the network and device the verification was run from (including IP address, approximate location, and whether a VPN or data-centre connection was used) to detect impersonation and coordinated fraud.

Everything above is encrypted in transit (TLS 1.2+) and at rest (AES-256), access is audit-logged, and it is retained for the longer of: (a) the lifetime of your account, or (b) seven (7) years after deletion, in line with Pakistani record-keeping rules for financial-services intermediaries. You may withdraw consent for further KYC processing at any time, but doing so will close your seller account and disable any feature that requires verified status.

4.1 Automated Verification, and Your Right to a Human

Most verifications are decided automatically, in under a minute, with no person involved. Where the check is inconclusive — or where our own rules stop it, for example because the document is already registered to another account — the case goes to an OurBazaar reviewer instead. If your camera cannot complete the flow you can submit your CNIC details manually, and a reviewer will decide it.

If an automated decision goes against you and you believe it is wrong, write to support@ourbazaar.pk and a person will review it. We do not tell you which individual check failed, because saying so would tell somebody attempting to use a forged document what to change.

Where you register a business to sell through, we verify the business as well as the person. This section describes what that adds to the rest of this Policy; Section 4 continues to apply to the individual identity check itself.

4A.0 If you only apply

You can ask to sell as a business before you have an OurBazaar account, using the application form on the business console. Doing so does not create an account. We hold what you put in the form — your name, email address and phone number, the shop’s details, and anything you write in the note — together with our decision and the reason for it, so that we can reply to you and so that a later application from the same shop can be read alongside the first.

If we approve the application we create an account for the email address you gave, and the rest of this Policy applies to it from that point. If we decline it, we keep the application and our reason; you can ask us to delete it at support@ourbazaar.pk.

4A.1 What we collect, and why

• Registration details: legal name, entity type, registered address, FBR NTN, SECP CUIN where the entity type has one, and an optional STRN. We use them to identify the business and to check them against the documents you send.
• Registration documents you upload — an NTN certificate, a SECP incorporation certificate, a partnership deed, a trade licence, a utility bill, a bank statement, the representative’s CNIC, or anything else you choose to send. We use them to decide whether to approve the shop.
• Shop settings: shop name, logo, and the support email and phone you publish for buyers to reach you on.
• The outcome: whether the shop was approved, rejected or suspended, the reason recorded with that decision, and who at OurBazaar decided it.

One named representative of the business must also complete the individual identity verification described in Section 4. That check is about a person, is carried out the same way, and its result is linked to the business so that there is always somebody accountable for what the shop does.

4A.2 How business documents are stored

Business registration documents are never public. They are stored in a private area of our file storage, separate from the images and files the Platform serves to anyone, and the system refuses to store one anywhere else. A document is never given a public address: it is opened through a link that is generated on request and expires fifteen minutes later.

Access is limited to the owners and administrators of that business and to the OurBazaar personnel who review the registration. Buyers never see them, other sellers never see them, and they are not shared with advertisers or used for anything other than verification, fraud prevention, and responding to a lawful request of the kind described in Section 3.

A registration document can name people other than you — partners in a deed, a director on an incorporation certificate. By uploading it you confirm that you are entitled to share their information with us for the purpose of verifying the business.

4A.3 What other people can see

Nothing in this section is published. OurBazaar does not currently show a business profile page to buyers, and a shop’s registration details, its documents and the outcome of its review are not visible to other users of the Platform.

OurBazaar sends two categories of push notifications:

• Transactional pushes — OTPs, order status changes, bid outbids, auction wins, refund confirmations, security alerts. These are sent automatically when you trigger the corresponding action and cannot be turned off without breaking that action; you may still suppress them at the OS level via your device's notification settings.
• Marketing pushes — promotional campaigns, feature announcements, suggested listings. These are sent only with your explicit opt-in and can be turned off at any time from Profile → Settings → Notifications, or by tapping the in-notification “unsubscribe” shortcut.

We rely on Apple Push Notification service (APNs) for iOS devices and Google's Firebase Cloud Messaging (FCM) for Android. Push payloads contain the smallest metadata needed for routing (a notification id, an order id, etc.); we do not transmit your chat message bodies through FCM in clear text.

Your chats are private between you and the other user. There is one exception, and we would rather state it than have you discover it: if either of you reports a problem with an order, a member of our support team is added to that conversation so they can see what was agreed and help resolve it.

• It only happens on the conversation attached to the disputed order — never to your other chats.
• A message is posted in the conversation naming the person who joined, at the moment they join. You are never given a silent observer.
• They can read the conversation history and write in it, the same as you and the other party.
• They are removed when the issue is closed, and the conversation goes back to being private. The record of what was decided is kept as dispute evidence.

Outside of this, our staff do not read your chats in the ordinary course of business. We may still access message content where we are legally required to, or where we are investigating fraud, abuse, or a safety report — the grounds set out in Section 2.

6.1 How We Personalise What You See

The “Curated For You” section of your home screen is built from your own activity. Roughly every five hours, an automated job looks at the listings you have viewed and the searches you have run, works out which product categories you appear interested in, and picks current listings from those categories. Recent activity counts for more than old activity, and viewing a listing counts for more than searching for a word. If we cannot work out a category from your activity, we show you a message saying so rather than guessing.

This is profiling in the ordinary sense of the word, so we want to be plain about its limits. It only ever changes the ORDER and SELECTION of listings shown to you. It never changes prices, never changes which listings you are allowed to buy or bid on, and is never used to make a decision about your account. It uses only your own activity on OurBazaar — not your contacts, not data bought from third parties, and not anything from outside the Platform.

6.2 An Important Point About Clearing Your History

You can clear your recent searches and your recently-viewed list at any time, and doing so removes them from every screen in the app. However, we retain those records internally and they continue to inform the personalisation described above. In other words, clearing your history changes what YOU see in your history lists; it does not by itself reset your recommendations.

We are stating this explicitly because most people reasonably expect a “clear history” control to do both. If you want your activity history actually erased rather than hidden, email support@ourbazaar.pk from your registered address and ask us to erase your activity history; we will delete the underlying records and your recommendations will reset. Retained activity records are in any case deleted automatically once they age past the window in Section 10.

6.3 Other Automated Processing

We use automated rules and statistical models in a limited set of places. None of these produce a legally binding decision on you without human review available on request:

• Fraud detection on payment, OTP, and account-registration flows — abnormal patterns may trigger a temporary block or step-up verification
• Listing review: prohibited-content keyword scans on titles, descriptions, and uploaded photos
• KYC document validation: optical character recognition (OCR) on your CNIC, plus the biometric face match described in Section 4
• AI-assisted listing descriptions and category suggestions, where you explicitly request the “Generate description” feature; the AI provider used today is OpenAI (named under Service Providers below)
• Search relevance and home-feed ranking, plus the “Curated For You” personalisation described in 6.1, which order what you see but do not change what is available to you
• Choosing which of our own advertisers’ ads to show in a slot. This is a weighted random draw between the campaigns currently booked for that slot — it does not read your profile, your activity, or your advertising identifier

You have the right to request human review of any automated decision that materially affects you (e.g., a listing removal, an account suspension, a KYC rejection). Email support@ourbazaar.pk with the relevant order / listing / ticket id within 30 days of the decision.

We engage the following categories of processors. Each operates under a written data processing agreement that limits their use to the services we instruct, requires equivalent security standards, and prohibits onward transfer.

• Cloud infrastructure & database hosting: Amazon Web Services (AWS), Singapore region (ap-southeast-1)
• Authentication, real-time chat & push: Google Firebase — Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Cloud Messaging
• Apple push notifications: Apple Push Notification service (APNs)
• Identity verification (KYC): Didit, which performs the document check, liveness check and face match. It receives your CNIC images, your selfie video, and the network and device signals described in Section 4, and processes and stores them in the European Union. It is the only processor that receives your identity documents.
• Payment processing: our Pakistani payment gateway partner(s) and the bank rails they connect to; no card details of any kind reach OurBazaar systems
• SMS & WhatsApp OTP delivery: regulated Pakistani aggregators integrated with mobile network operators
• AI / LLM features: OpenAI, used only when you explicitly request an AI-generated listing description; your request payload (title, brand, condition, basic specs) is sent for that purpose only and is not retained by us beyond logging the API call for quota and audit
• Application monitoring & analytics: CloudWatch logs (AWS) and similar observability services covering errors, performance, and structured product events
• Email delivery: a transactional email provider used for account, security, and password emails (no marketing lists are sold to third parties)
• Advertising: Google AdMob, used to fill ad slots that our own advertisers have not booked, together with Google's User Messaging Platform, which presents the consent choices described in Section 14

Some of the processors listed above (Firebase, OpenAI, certain analytics tools) host data outside Pakistan, including in the United States and the European Union. Where data crosses borders we rely on the processor's published safeguards (Standard Contractual Clauses, equivalent technical and organisational measures, and the EU–US Data Privacy Framework where applicable). If you are uncomfortable with this transfer, you may opt out of optional features (AI description, push notifications, the chat feature) and continue to use the core marketplace, although some functionality will be limited.

Identity verification is the exception, and we would rather say so plainly. Your CNIC images and selfie video are processed and stored in the European Union by our verification provider, and that transfer is not optional: verification is what unlocks buying, bidding, selling and accepting offers, so declining it means not trading on OurBazaar rather than trading with one feature switched off. You can still browse, and you can still ask us to delete your account.

If we become aware of a personal-data breach that is likely to result in a risk to your rights or freedoms, we will:

• Notify the relevant Pakistani authority (the Federal Investigation Agency’s Cyber Crime Wing and the National Computer Emergency Response Team) within 72 hours of becoming aware, where the breach falls within their reporting thresholds
• Notify affected users by email and in-app message without undue delay, describing what happened, what data was involved, what we are doing, and what you can do to protect yourself
• Publish a post-incident summary on the Platform once the immediate response is complete

We retain your personal data for as long as your account is active and for as long as needed to provide the Platform. The default retention windows below apply unless a longer period is required by law:

• Account profile, listings, and order history — for the life of the account, then 7 years after deletion (tax and fraud-prevention obligations). See Section 10.1 for exactly what this means when you delete your account
• KYC documents and biometric evidence — 7 years from the date of verification
• Business registration details, the documents uploaded to verify a business, and the decision we reached — kept for as long as the business is registered with us, and afterwards for as long as we need the record of that decision to answer a dispute, a chargeback or a lawful request. They are not deleted on a fixed schedule
• Browsing and search activity used for personalisation (including entries you have cleared from your own history) — 180 days from the date of the activity, then deleted automatically
• In-app notifications — 90 days
• Chat messages — retained for the life of the conversation unless you delete them; the delivery and read-receipt metadata behind our seller-response-time statistics is kept indefinitely as dispute evidence
• Support tickets and dispute evidence — 5 years from closure
• Share / referral link events and OTP verification records — 365 days
• Background job audit logs (job_runs) — 90 days for successful runs, 1 year for failed runs
• Operational and diagnostic logs — 90 days
• Individual ad interaction records (which ad you saw and whether you tapped it) — 90 days, then deleted automatically. The daily totals we bill advertisers from are kept indefinitely and contain no identifier for you
• Aggregated, de-identified statistics — retained indefinitely; cannot be re-linked to you

Deleting your account happens in two stages, and we want to be precise about both because the second one means we still hold some of your information for a period afterwards.

Immediately, and for 30 days

Your account closes at once. Your profile stops being visible, your listings are withdrawn, and you are signed out everywhere. For 30 days you can change your mind — signing back in cancels the deletion and restores everything.

After 30 days: permanent closure

The closure becomes permanent and cannot be reversed. From this point no other user can see who you were. Anything of yours that remains — reviews you wrote, conversations you took part in, orders you were party to — is shown to everyone else as “Removed user”.

For 7 years after closure: limited retention

Your name, email address, phone number, CNIC number and order history remain in our records, accessible only to our compliance and support staff. They are not visible to any other user, are not used for marketing, personalisation, or advertising, and are not shared with anyone except where the law requires it.

We keep them for three specific reasons:

• Tax and audit. Pakistani record-keeping rules require that a transaction record identifies its parties. An order with no name attached does not satisfy that obligation.
• Payment disputes and chargebacks. A chargeback can be raised months after a purchase, and defending one requires showing who transacted. Without the identity we would be unable to contest a fraudulent claim — against you as well as against us.
• Fraud prevention. Records of confirmed fraud, non-payment, and cash-on-delivery refusals must survive account deletion. If they did not, deleting an account would be a way to erase a fraud history and start again — which would make every other user less safe.

Your verification provider's copy

The CNIC images and selfie video from the camera flow are held by our verification provider, not by us, so closing your OurBazaar account does not by itself erase them. When your account is permanently closed we release the link between your identity document and the account, which is what lets the genuine holder of that CNIC register again. If you also want the provider's own copy erased, write to support@ourbazaar.pk and we will pass the request on and confirm when it is done, subject to the record-keeping obligations above.

After 7 years: erased

Your name, email, phone number, CNIC, photo, date of birth and location are destroyed. Saved addresses are deleted. There are no saved payment methods to delete — we never stored any. What remains is a transaction record that cannot be linked to you.

Seven years is the same window this policy already applies to order and identity-verification records, and it is set by Pakistani record-keeping rules for financial-services intermediaries — not chosen by us. If it changes, this section changes with it.

We protect your data with industry-standard technical and organisational measures, including:

• TLS 1.2+ for every connection between the app, website, and our backend
• AES-256 encryption at rest for the database, file storage, and backups
• Hashed + salted passwords using bcrypt; password resets are time-limited and rate-limited
• JWT-based access tokens with short expiry and rotating refresh tokens
• Role-based access controls and least-privilege access on production data, with full audit logging
• Regular security reviews and dependency-vulnerability scanning
• Hashed IDs in all client-facing surfaces so user numeric identifiers are not exposed in URLs or responses

No system is ever completely secure. If you suspect unauthorised access to your account, change your password and contact support@ourbazaar.pk immediately.

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete information directly from your profile screen, or by contacting support
• Erasure — delete your account yourself from Profile → Privacy → Account → Delete account. Your account closes immediately, you have 30 days to cancel by signing back in, and after that your personal data is permanently erased. Records we are legally required to keep are described above and no longer carry your name
• Erasure of activity history alone — ask us to delete the browsing and search records behind your recommendations, without closing your account (see Section 6.2)
• Portability — request a machine-readable export of your account data (profile, listings, orders, messages). This is prepared manually on request
• Restriction — ask us to pause certain types of processing while we investigate a complaint
• Objection — opt out of marketing communications and out of optional automated processing
• Limit advertising — turn off personalised ads at any time from your device settings, as described in Section 14. Ads themselves remain part of the free Platform, but they need not be tailored to you
• Withdraw consent — for any processing that we rely on consent for; withdrawal does not affect the lawfulness of past processing
• Lodge a complaint — with the Federal Investigation Agency Cyber Crime Wing or any other relevant Pakistani authority if you believe your rights have been violated

To exercise any of these rights, email support@ourbazaar.pk from the address registered to your account. We respond within 30 days. If we need more time for a complex request, we will tell you within that 30-day window and explain why. We may ask you to verify your identity before processing a rights request to prevent unauthorised disclosure.

13.1 Mobile App

Our mobile app does not use browser cookies. It stores an authentication token on your device to keep you signed in, and it uses the SDKs of the service providers named in Section 7 — Firebase for sign-in, chat, and push, and Google AdMob for advertising. It does use your device advertising identifier, subject to the choices in Section 14. It does not track you across other companies' apps or websites. You can revoke the notification and contacts permissions at any time from your device settings.

13.2 Website (ourbazaar.pk)

Our website uses a small number of strictly-necessary cookies (authentication session, CSRF protection) which load without consent because the site does not function without them. We do not use third-party advertising, retargeting, or cross-site tracking cookies on the marketing site — the advertising described in Section 14 runs in the mobile app only. If we add analytics or ads to the website in the future we will surface a consent banner and a granular cookie preferences screen before any non-essential cookie is set.

OurBazaar is free to use, and advertising is part of how we pay for it. Ads appear in a small number of fixed places — a slide in the home carousel, the bottom of the menu, the product screen below the item you are looking at, your profile below the listings rail, and a full-screen ad shown at most once every six hours. Ads never appear between you and something you came to do.

One of those slots may show more than one ad while you are on the screen: where an advertiser has booked several, they take turns, each for a few seconds, and then start again. The slot does not change while it is off screen.

14.1 Two Kinds of Ads

Ads we sell directly. A business pays us to show their creative in a particular slot. Choosing which booked campaign to show is a weighted random draw between whichever campaigns are running. It does not read your profile, your browsing history, or your advertising identifier. Two people opening the same screen at the same moment may see different ads purely by chance.

Ads filled by Google AdMob. Slots that our own advertisers have not booked are offered to Google AdMob. Google selects the ad, not us. To do that, Google receives your device advertising identifier, your IP address, and coarse device information. Google may use these to personalise the ad, subject to your choices below. We never send Google your name, phone number, email address, CNIC, chat contents, listings, or order history.

14.2 What We Measure

For ads we sell directly, we record when an ad was shown, whether at least half of it remained on screen for a continuous second, how long it stayed visible, and whether you tapped it. These records are linked to your account so that we can cap repetition and detect click fraud. Individual records are deleted after 90 days (Section 10). Advertisers themselves receive only totals, never anything identifying you. Ads filled by Google are measured by Google under its own privacy policy; we do not record them.

14.3 Your Choices

• On iPhone and iPad, the first time the app needs your advertising identifier iOS asks whether to allow tracking. Declining means Google gets no IDFA and the ads you see are not tailored to you. You can change your mind at any time under Settings → Privacy & Security → Tracking.
• On Android, open Settings → Google → Ads and turn on “Delete advertising ID” or opt out of ad personalisation.
• Where local law requires a consent prompt — principally the EU, the UK, and certain US states — Google's User Messaging Platform presents it before any ad loads, and your answer is honoured. Users elsewhere, including in Pakistan, are not shown that prompt.
• Either way you will still see ads on the free plan. Opting out changes whether an ad is tailored to you, not whether ads appear. OurBazaar Pro removes advertising entirely — the server sends no ad at all to a Pro account, so nothing is shown and nothing is measured.

14.4 What Advertising Never Does

Advertising is walled off from the marketplace itself. An advertiser cannot influence search results, listing order, or which items you are shown as recommendations. Advertising data is never used to set prices, assess your account, or decide anything about your ability to buy, bid, or sell. And we do not send your marketplace data — what you searched for, bid on, or bought — to any advertising network.

OurBazaar is not intended for individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has registered, we will delete the account and all associated data without delay. Parents and guardians who believe a minor has registered may report it to support@ourbazaar.pk.

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan, including the Prevention of Electronic Crimes Act 2016 and the Personal Data Protection Bill once enacted. Any disputes shall be subject to the exclusive jurisdiction of the courts of Pakistan.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page always reflects the current revision. We will notify you of material changes by displaying a prominent in-app notice and by email at least 14 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy. We keep an archive of previous versions available on request.

If you have any questions, concerns, or a rights request relating to this Privacy Policy, please reach out: