Privacy Policy

Who we are

HisabKhana is a business-to-business seller network for e-commerce businesses operating in Pakistan, operated from Lahore, Punjab, Pakistan. HisabKhana is a private platform and is not a government authority, government database, credit bureau or official verification authority. For any privacy question, access request, correction request, deletion request or privacy complaint, contact us at arthurmarston581@gmail.com.

Information we collect

• Account information: name, email address and sign-in details.
• Business information: business name, workspace details, team members and roles, store platform and contact details you provide.
• Verification information and documents submitted for business verification review.
• Customer lookup information: the identifier searched, stored as a one-way hash in the lookup log rather than the raw value, together with the time, workspace and channel of the lookup.
• Report information: normalised customer identifiers submitted with a report (for example a phone number as +923001234567), delivery city, order number, factual notes, controlled factual tags, and moderation and dispute status.
• Evidence files uploaded in support of a report or a dispute.
• Order records, including imported order data.
• Community content: posts, comments, reactions and group activity.
• Subscription and payment information: plan, status, payment method used, transaction or reference details you supply, and proof of payment where requested.
• API and integration information: API key metadata, request logs, integration configuration and webhook delivery records.
• Device, browser and security information, such as IP address, browser and device characteristics and session information.
• Logs and usage information about actions taken in the app.

Card details are handled by our payment provider and are not stored by HisabKhana.

Why we use this information

• Providing and operating the services you use.
• Authenticating users and protecting accounts.
• Carrying out business verification review.
• Performing customer checks requested by a seller.
• Producing network intelligence from moderated records.
• Moderating reports and community content.
• Handling disputes, corrections and appeals.
• Maintaining platform security and audit records.
• Detecting and preventing fraud and abuse of the platform.
• Billing, subscription management and accounting.
• Providing customer support.
• Producing analytics of your own workspace activity.
• Maintaining and improving the service.
• Meeting legal, regulatory and record-keeping obligations.

Customer lookup privacy

Lookups are permitted only for order decisions and are subject to access controls, plan allowances, rate limiting, logging and abuse-prevention measures. Lookup results are deliberately limited: sellers do not receive a complete customer phone number, email address or postal address. Results are masked and confined to a network status and factual explanation lines. Attempting to reconstruct full contact details is prohibited.

Reports and evidence

A report is visible to the business that submitted it, to authorised moderators and staff reviewing it, and, in aggregated and masked form, in the network signals shown to other sellers who perform a lookup. Evidence and verification documents are stored privately, are never served through public links, are not indexed, and are accessible only to the business that uploaded them and to authorised moderators reviewing the matter. Access to sensitive records is logged in an audit trail that ordinary users cannot modify. Where a dispute or correction is accepted, information may be corrected, removed or anonymized, and rejected reports do not contribute to network signals.

Data retention

We retain information only for as long as reasonably necessary for the purposes described above. The periods below are our proposed operational retention periods. They are subject to applicable law and to legal review, and they are not statutory Pakistani requirements.

• Account and profile information: retained while the account is active, then deleted or anonymized where appropriate, subject to necessary exceptions.
• Business verification records: retained while the account is active and for up to 2 years after closure where reasonably necessary.
• Lookup logs: approximately 12 months.
• Customer network identifiers and related data: retained only as long as reasonably necessary for legitimate network functionality and applicable legal requirements.
• Seller reports: retained while relevant and for up to approximately 2 years after becoming inactive, subject to legal or business necessity.
• Evidence: retained while associated with an active or relevant report and for up to approximately 2 years thereafter where necessary.
• Disputes and appeals: approximately 5 years after resolution.
• Moderation and audit logs: approximately 5 years.
• Payment, subscription and accounting records: retained for the period reasonably required for accounting, tax, payment, fraud-prevention and legal purposes.
• API and integration logs: approximately 12 months unless longer retention is necessary.
• Security and access logs: approximately 12 months unless longer retention is required for security or legal purposes.

Information subject to a legal hold, active dispute, investigation or other legitimate retention requirement may be retained for longer than the periods stated above. When a retention period ends, information that is no longer required is deleted or anonymized.

Account deletion

You may request deletion of your HisabKhana account through the available account controls or by contacting HisabKhana Support. After a deletion request is accepted, access to the account and its seller features is disabled, and personal profile information that is no longer required is deleted or anonymized. Information that forms part of network integrity, including appropriately moderated reports, may be retained in de-identified or business-level form. Evidence associated with retained reports, and moderation, dispute, audit, payment and security records, may be retained for the applicable retention period where reasonably necessary or where retention is required or permitted by applicable law. Deleting an account does not automatically remove information lawfully submitted by another user. Where deletion or anonymization is technically or legally restricted, we limit further use of the information to the purposes for which continued retention is justified.

Sharing information

We share information only where necessary, with:

• service providers who help us operate the platform;
• payment providers, to process and confirm payments;
• hosting and infrastructure providers;
• email providers, to send account and service messages;
• integration providers you connect, such as Shopify or WooCommerce, for the data required by that integration;
• professional advisers, such as legal or accounting advisers, where reasonably necessary;
• authorities, courts or regulators where disclosure is required or permitted by applicable law.

We do not sell personal information.

International processing

Some of our third-party infrastructure, hosting, email and payment providers may process information on servers located outside Pakistan. Where that happens, we take reasonable steps to ensure the provider applies appropriate security and confidentiality protections. We can provide further detail on request.

Security

We apply reasonable technical and organizational measures, including access controls and row-level database restrictions, workspace isolation, role-based permissions, private and access-controlled evidence storage, encrypted connections, audit logging and abuse detection. No service can be guaranteed completely secure, and we do not claim that it is. Please keep your credentials and API keys confidential and tell us promptly if you suspect unauthorised access.

Cookies and analytics

We use strictly necessary cookies and browser storage to keep you signed in and to keep the service secure. Analytics shown in the app are produced from your own workspace activity within the platform. We do not use advertising cookies and we do not run third-party advertising trackers.

Your requests and choices

Subject to applicable law and to legitimate retention requirements, you may ask us to give you access to the information we hold about you, correct inaccurate information, delete information that is no longer required, restrict certain processing, or withdraw a consent you gave where processing was based on consent. You may also raise a privacy complaint. Send requests to arthurmarston581@gmail.com. We may need to verify your identity and to ask for information reasonably necessary to locate the relevant records, and we will explain where a request cannot be met in full.

Children

HisabKhana is intended for businesses and for adults acting for a business. It is not directed at children. We do not knowingly collect information about a minor, and where we become aware that information relating to a minor has been submitted unnecessarily, we will remove or restrict it unless retention is required for legal reasons.

Security incidents

If a security incident affecting personal information occurs, we will respond in accordance with our incident-response procedures and applicable law, which may include investigating and containing the incident, recording it, and notifying affected users or authorities where required or appropriate.

Changes to this policy

We may update this policy. Where a change is material, we will give notice in the app or by email to the address registered on the account. The updated policy applies from the effective date shown on this page. This policy explains how we handle information; it does not create rights beyond those available under applicable law.

Governing law and grievances

This policy is governed by the laws of the Islamic Republic of Pakistan. Privacy grievances may be raised with the Grievance Officer / HisabKhana Support Team at arthurmarston581@gmail.com. Please include enough information for us to identify the relevant account, transaction or report. Nothing in this process prevents you from exercising any legal right available under applicable law. See also our Terms & Conditions.