Privacy policy

1. Introduction

Welcome to Hajzi Makfool. This policy explains what data we collect when you use the app, why we collect it, who can see it, how we protect it, and the choices you have. It applies to the Hajzi Makfool app on iOS and Android and to every service it offers.

You can browse the app without an account. We ask for personal details only when you sign in to book, order, message or post.

2. The data we collect

We collect the following, most of it provided by you:

• AccountYour phone number, which is how you sign in. We verify it with a code we send you.
• ProfileYour name, gender, date of birth, governorate, and the app language you choose. Gender decides which men's or women's services are shown; your governorate shows what is in your city.
• Bookings and ordersWhat you book, order or ask a price for, the dates, notes and answers you give, and a delivery address or event location when you set one.
• ConversationsThe messages and photos you exchange with providers in the app.
• Provider detailsIf you list a service: its name, contact and WhatsApp numbers, links to your social accounts, photos and videos, prices, location, and the schedules, team and accounts you manage.
• Community postsThe funeral announcements and blood requests you post, including a contact number and the location of the mosque or hospital.
• DeviceYour device's notification token, its operating system, the app version and its language, so notifications reach you in your language.
• PhotosOnly what you choose from your gallery or take with the camera to send in a conversation or show on your service. We never see the rest of your photos.

3. How we use your data

We use your data only to:

• Create your account, verify your number and keep you signed in.
• Carry out your bookings and orders, deliver them to the provider, and keep you updated on them.
• Show services that suit you in your governorate, and the nearest when you ask.
• Deliver the notifications you chose, such as funeral announcements and blood requests in your city, and announcements from the app's administration.
• Review services and community posts before they are published, to keep content safe and accurate.
• Protect the app and its users from fraud and abuse, and fix technical problems.
• Meet our legal obligations.

4. Who sees your data

Some of what you share is seen by others because of what the service is. Here is who sees what:

• The providerWhen you book, order or ask for a quote, the provider sees your name, phone number and the details of your request, so they can fulfil it and contact you. In conversations they see your name and messages, not your number.
• App usersListed services — name, contact numbers, photos, location and prices — are visible to everyone using the app. Some services show only an approximate area, to protect their owners' privacy. Reviews you write about services may be shown publicly.
• Community postsA published funeral announcement is visible to everyone without its poster's name, and we never ask for or show the name of the deceased. A blood request shows the contact number you enter to anyone who opens it, so a donor can call you; that number is never put in a notification.
• Review teamAuthorised Hajzi Makfool staff see a community post's author name and phone number while reviewing it, and the details needed to review services and handle reports.
• Yours aloneThe blood type saved in your settings is seen by no one but you — not even our staff. Your conversations are available only to the two people in them.

5. Sharing with others

We never sell or rent your data. We rely on trusted providers for technical services, and each receives only what it needs to do its job:

• Hosting and databaseThe app's data is stored with a cloud hosting provider (Supabase), whose servers may be outside Iraq.
• Verification codesYour phone number is sent to a messaging provider that delivers your verification code over WhatsApp.
• NotificationsNotifications pass through Google's Firebase Cloud Messaging, with your device token and the notification's text.
• MapsMaps are shown with Google Maps, under Google's own privacy policy.
• PaymentsIf you pay electronically, you enter your payment details directly on the payment provider's page. Your card details never reach us and we do not keep them; we keep only a record of the transaction — its reference, amount and status.

We may disclose specific data if required by law or by an order from a competent authority, or where needed to protect someone's safety or prevent fraud.

6. Location

We ask for your location only when you ask for something that needs it: showing services near you, centring the map on where you are, or setting a place on the map. It is used only while you use the app; we never track you in the background.

When you look for what is near you, your location is sent to sort the results and is not stored. The only places we store are ones you set on purpose, such as a delivery address, your service's location, or a mosque or hospital. You can withdraw the permission at any time in your device settings.

7. Blood type and health data

If you wish, you can save your blood type in the notification settings so that the blood requests that match it reach you. It is entirely optional, seen by no one but you — not even our staff — and you can change or remove it whenever you like.

The blood request form never asks for the patient's name or anything that identifies them, so please don't write it there. Pulse connects people with one another; it is not a medical service.

8. Notifications

We send you notifications to keep you informed, and you are in control:

• Notifications about your bookings, orders and messages are part of the service itself, and reach you while you are signed in.
• Funeral announcements, blood requests and announcements from the administration can be turned off or tailored in Settings, then Notifications.
• You can turn all notifications off in your device settings. When you sign out, your device token is deleted, so your account's notifications stop reaching it.

9. How long we keep data

We keep your data only as long as it is needed for the purpose it was collected for:

• Your account, bookings, orders and conversations: for as long as your account exists.
• Funeral announcements and blood requests: they leave the list when they end, and are permanently deleted 30 days later.
• The notifications page: shows your newest 100 notifications, and nothing sent before you joined.
• Payment records and anything the law requires us to keep: for as long as the law requires.
• When you delete your account: it is deleted for good 90 days after your request unless you sign in before then. We delete your profile, bookings, orders, conversations and their photos, favourites, notifications and preferences. Services you own are closed for good, with their photos and contact numbers deleted, and we keep only the financial and regulatory records we must, separated from your identity.

10. Protecting your data

We protect your data with technical and organisational measures, including:

• Encrypting data in transit between your device and our servers.
• Keeping your sign-in session in your device's secure storage, so it never moves to another device.
• Access rules in the database itself, so no one can read more than they are entitled to.
• Limiting our staff's access to those who need it for their work, according to their role.

Even so, no method of transmission or storage is completely secure. Never share your verification code with anyone — we will never ask you for it.

11. Your rights and choices

Your data is yours. At any time you can:

• View and edit your profile from My account.
• Control notifications, and the location, photo and camera permissions, from the app and from your device settings.
• Withdraw the community posts you made, where the app allows it.
• Ask for a copy of your data, or for the correction of anything you cannot edit yourself.
• Delete your account from Settings, then Delete account: you are signed out at once, and the account is deleted for good after 90 days unless you sign in before then.

12. Children's privacy

The app is not directed at children, and we do not knowingly collect data from anyone under 13. If you learn that a child has given us their data, contact us and we will delete it.

13. Links and outside services

At your request the app may open other apps or sites — WhatsApp, a phone call, your maps app for directions, or YouTube videos shown on some services' pages. What happens there is governed by their owners' privacy policies, not this one.

14. Changes to this policy

This policy may be amended and updated as the app and its services evolve and as legal requirements change. Every new version is published on this page, with the Last updated date at the top changed accordingly.

If a change is significant, we will tell you in the app before it takes effect. Continuing to use the app after a change takes effect means you accept the updated policy.

15. Contact us

For any question about this policy or your data, or to ask for a copy or a correction, contact us through the contact details published on the app's page on the App Store and Google Play. We will reply as soon as we can.