Privacy Policy

Overview

Sycha (سجة) is a multi-vendor e-commerce platform based in Iraq that connects customers with multiple vendors and merchants. Our mobile application enables users to browse products across various categories and brands, follow celebrity product recommendations, manage shopping carts and wishlists, place and track orders, use referral programs, and receive personalized notifications. This Privacy Policy explains how we collect, use, and protect your personal information when you use our mobile application and services.

Information We Collect

We collect the following types of information:

• Account Information: Phone number (required, Iraqi format), first name, last name, password (securely hashed), and email address (optional, for referral features and verification)
• Profile Information: Date of birth, profile picture, preferred language, preferred currency, and notification preferences (all optional)
• Shipping Addresses: Address name, recipient phone number, governorate, district, and full address details for delivery across Iraq
• Shopping Data: Products viewed, items in cart, wishlist items, order history, search queries, and product reviews and ratings
• Device Information: Device type, operating system and version, device model, unique device identifiers, IP addresses, and Firebase Cloud Messaging tokens for push notifications
• Session & Usage Analytics: Session duration, page views, the products you view, add to your cart or save, which shelf showed them to you and how long you looked, searches you make, and general usage patterns — recorded under a random per-device identifier, and joined to your account when you sign in
• Location Data: With your permission, device location for area-based offers; governorate and district information for shipping
• Photos & Camera: With your permission, camera or photo library access for profile pictures and product review images
• Referral Data: Referral codes, referral status, and related activity when participating in our referral program

How We Use Your Information

We use your information to:

• Process and fulfill your orders across multiple vendors
• Send order status updates and shipping notifications via push notifications
• Provide customer support and respond to your inquiries
• Personalize your shopping experience: the products, categories and stores you browse shape the recommendations and the home screen we show you
• Improve app performance and user experience through analytics
• Manage your account, cart, wishlist, and shipping addresses
• Apply promotional discounts and coupon codes
• Manage and validate referral program activities
• Detect and prevent fraud, including referral fraud through device fingerprinting and IP analysis
• Comply with legal obligations

Data Storage and Security

All data is stored on secure servers located in Germany (hosted on secure VPS infrastructure). We implement industry-standard security measures to protect your personal information:

• JWT (JSON Web Token) authentication with HTTP-only cookies
• Encrypted connections (HTTPS/SSL) for all data in transit
• Secure password storage using bcrypt hashing
• Automatic session expiry after 30 minutes of inactivity
• Token refresh rotation for enhanced security
• Rate limiting on API endpoints and OTP verification
• Regular security updates and monitoring
• Access controls limiting who can view your data
• Encrypted local storage for sensitive credentials on your device

Payment is currently limited to cash-on-delivery. No credit card or online payment data is stored on our servers.

Data Sharing & Third-Party Services

We do not sell your personal information. We may share your data only in these limited circumstances:

• Vendors & Merchants: Order details are shared with relevant vendors on our platform to fulfill your purchases
• Shipping Partners: Delivery addresses and order information for shipping within Iraq
• Firebase Cloud Messaging (Google): Device tokens for delivering push notifications about order updates and promotions
• Hosting Provider: Our VPS hosting provider in Germany stores and processes data on our behalf under strict data protection agreements
• Legal Requirements: When required by law, court order, or government regulation

We do not share your personal information with third parties for their own marketing purposes.

Your Rights and Choices

You have full control over your personal information:

• Access: View and manage your account information in the app settings
• Correction: Update your name, email, phone number, addresses, and profile at any time
• Notification Preferences: In the app, choose which categories reach you as push notifications — offers, saved-item alerts, recommendations — and set quiet hours. Order updates are always sent. Every message also stays in your inbox (app and web). We send no marketing email or SMS; WhatsApp is used only for verification codes.
• Opt-out: Disable push notifications in your device settings or customize categories in-app
• Deletion: Request deletion of your account and associated data
• Data Portability: Request a copy of your personal data
• Consent Withdrawal: Withdraw consent for data processing at any time (may limit app functionality)

You can exercise these rights yourself in the app, under Account.

We will respond within 30 days.

Cookies and Local Storage

Our app uses local storage and caching mechanisms to improve performance, store user preferences, and maintain authentication state. We do not use browser cookies as this is a native mobile application. Session and analytics data collected is used solely for app improvement and security purposes.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. After account deletion, we may retain certain information for:

• Legal compliance (tax records, transaction history): Up to 7 years
• Fraud prevention and security: Up to 5 years
• Analytics (anonymized data): Indefinitely
• OTP records: Automatically expire after 5 minutes
• Session data: Automatically expires after 30 minutes of inactivity

You can delete your account at any time from the app, under Account.

Children's Privacy

Sycha is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected data from a child, please contact us immediately, and we will take steps to delete such information.

International Data Transfers

Your data is stored on servers located in Germany (EU). If you access our services from Iraq or other regions outside the EU, your data is transferred to and processed in Germany. We ensure all international transfers comply with applicable data protection laws, including GDPR.

Legal Compliance

Sycha complies with applicable data protection laws, including:

• General Data Protection Regulation (GDPR) for EU data processing
• Relevant Iraqi data protection and consumer protection regulations
• International e-commerce and consumer protection laws

Delete Your Account

You can permanently delete your Sycha account and all associated personal data directly from within the app. To delete your account, follow these steps:

• Once confirmed, your account and personal data will be permanently deleted. This action cannot be undone. Please note that certain data may be retained as required by law:
• Order history and transaction records: Retained for up to 7 years for legal and tax compliance.
• Fraud prevention data: Retained for up to 5 years.
• Anonymized analytics data: Retained indefinitely (not linked to your identity).

Deleting your account removes your personal information from our systems.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the app, sending push notifications, and updating the "Effective Date" at the top of this policy. Your continued use of Sycha after any changes indicates your acceptance of the updated policy.

Who Publishes This Policy

This policy is published by:

sycha-iq.com

Sycha (سجة) — Multi-Vendor E-Commerce Platform