Privacy policy
Last updated: 2026-09-19
Garida Mall is an online marketplace where shops across Iraq sell to customers, and payment is held safely until an order arrives. This page explains what we collect, why we need it, who else sees it, and how to get it deleted.
| What | Why we need it | How long we keep it |
|---|---|---|
| Name, phone number, email | To create your account and let a courier reach you | Until you delete your account |
| Delivery addresses and map location | To deliver your order to the right door | Until you delete the address |
| Orders, payments, refunds | To run the order, hold payment in escrow, and keep required accounting records | Kept as accounting records after deletion, with your name removed |
| Photos you upload | Product reviews and return evidence | Deleted when you delete your account |
| Device and notification token | To send order updates to your phone | Deleted when you sign out or delete your account |
| App diagnostics and crash reports | To find and fix faults in the app | Up to 90 days |
Who we are
Garida Mall is operated by Saro Tech, based in Erbil, Kurdistan Region, Iraq. We are responsible for the personal information described on this page.
Shops that sell on Garida Mall are independent businesses. When you buy from a shop, that shop receives the details it needs to prepare and send your order, and is responsible for how it handles them.
Information we collect
We collect information you give us, information created when you use the app, and a small amount of technical information sent automatically by your device.
Information you give us
- Your name, phone number and email address when you register.
- Delivery addresses, including a map point you choose when adding an address.
- Photos you attach to a product review or a return request.
- Messages you send to our support team or to a shop.
- The reason you give us if you ask to close your account.
Information created when you use Garida Mall
- Orders you place, their contents, their delivery status and their history.
- Payments, refunds, coupons, points and escrow status.
- Products you view, search for, save or add to your basket.
- Reviews and ratings you leave.
Information your device sends
- A notification token that lets us send order updates to your specific device.
- Device model, operating system version and app version.
- IP address and approximate region, used to protect accounts against fraud and abuse.
- Crash and performance diagnostics when the app fails.
Phone permissions we ask for
Garida Mall asks for a permission at the moment you use the feature that needs it, never at launch. You can refuse any of them and keep using the rest of the app, and you can withdraw any of them later in your phone settings.
| Permission | What it is for | If you refuse |
|---|---|---|
| Location | Placing a pin on the map when you add a delivery address | You type the address by hand instead |
| Camera | Taking a photo for a review or a return | You can pick an existing photo, or skip the photo |
| Photos | Attaching an existing photo to a review or a return | You skip the photo |
| Notifications | Telling you when your order is confirmed, sent and arriving | You check order status in the app instead |
We do not track your location in the background. Location is read only while the address screen is open.
How we use your information
- To create and secure your account.
- To take an order, pass it to the shop, and arrange delivery to your address.
- To hold your payment in escrow and release it to the shop once the order is complete, or refund it to you.
- To tell you what is happening with an order, by notification, SMS or email.
- To answer your support messages and settle disputes between you and a shop.
- To detect fraud, abuse and fake reviews, and to enforce our terms.
- To understand which parts of the app are used, so we can fix and improve them.
- To meet accounting, tax and other legal obligations in Iraq.
Who else sees your information
We do not sell your personal information, and we do not share it for advertising.
| Who | What they receive | Why |
|---|---|---|
| The shop you bought from | Your first name, phone number, delivery address and order contents | To prepare and hand over your order |
| Delivery drivers and courier partners | Your name, phone number and delivery address | To bring the order to you |
| Payment providers, including ZainCash, FastPay and FIB | The amount, the order reference and the identifiers their service needs | To take payment and issue refunds |
| Google Firebase | Notification token, crash diagnostics, app usage events | To deliver notifications and diagnose faults |
| Our hosting provider | Data stored on our servers | To run the platform |
| Courts, regulators and law enforcement | Only what the law requires | When we are legally obliged |
Payments and escrow
Card and wallet details are entered with the payment provider, not with us. We never see or store a full card number.
When you pay, the money is held in escrow rather than passed straight to the shop. It is released to the shop after the order is delivered and the return window has closed, or returned to you if the order is cancelled or a return is approved. We keep a record of each of these movements because we are required to.
How long we keep things
We keep your account information for as long as your account is open. When you delete your account, personal details are removed or replaced with a placeholder within 30 days.
Order, invoice and payment records are kept for seven years as accounting records, as commercial and tax rules require. After your account is deleted these records no longer carry your name, phone number, email or address, and cannot be linked back to you from the app.
Crash and diagnostic data is kept for up to 90 days. Backups are overwritten on a rolling cycle and are fully replaced within 90 days.
Your choices
- See and edit your name, phone number, email and addresses in the app, under your profile.
- Turn off marketing notifications separately from order notifications. Order notifications use their own channel so that silencing offers never silences a delivery arriving.
- Withdraw the location, camera, photo or notification permission at any time in your phone settings.
- Ask for a copy of the information we hold about you, by writing to us.
- Delete your account and the personal information attached to it.
Deleting your account
You can delete your account from inside the app, under Profile, or from our deletion page on the web without installing anything.
Deletion is scheduled rather than instant. You get a grace period of 14 days in which signing in again cancels it, because an accidental deletion cannot be undone once it runs.
An account with an order still in progress, an open return, or money left in its wallet cannot be deleted until those are settled. This protects your right to a refund. We will tell you which one is blocking the request.
What is removed
- Your name, phone number, email address and password.
- Your saved addresses and map points.
- Your profile photo, and photos attached to reviews and returns.
- Your basket, wishlist, browsing and search history.
- Your notification tokens and signed-in devices.
What is kept, without your name
- Order, invoice and payment records, for seven years, as accounting records.
- Review text, shown without any name attached, so ratings on a product stay accurate.
- Records of fraud or abuse where we need them to keep the platform safe.
How we protect your information
Traffic between the app and our servers is encrypted in transit. Passwords are stored hashed and cannot be read by us or recovered. Access to production systems is limited to the people who operate the platform, protected by keys rather than passwords, and monitored for repeated failed attempts.
No system is perfectly secure. If a breach affects your personal information, we will tell you and the relevant authorities without undue delay.
Children
Garida Mall is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has created an account, write to us and we will remove it.
Where your information is held
Our servers are in Europe, and Google Firebase processes notification and diagnostic data on its own infrastructure outside Iraq. Wherever it is held, the protections described on this page apply.
Changes to this policy
When we change this policy, we update the date at the top of the page. If a change materially affects you, we will tell you in the app before it takes effect.
Contact us
Write to us about anything on this page, including a request to see or delete your information. We answer within 30 days.