Privacy Policy

Full name and email address — used for registration, login, and account identification.

Phone number — used for OTP verification, seller/buyer communication, and dispatch coordination.

CNIC (National Identity Card) — collected during KYC onboarding for identity verification of sellers, vets, caretakers, and dispatch riders.

GPS / Location data — used for nearby animal search, farm location mapping, and dispatch route tracking.

Photos and media — animal listing photos, CNIC document images, and vet inspection evidence.

Financial data — contract prices, deposit amounts, hissa share payments, and refund requests.

Animal and livestock data — species, breed, weight, age, health records, and vaccination history.

Veterinary records — vet booking details, inspection reports, and health certifications.

Contract and transaction history — buyer contracts, fulfillment orders, milestones, and delivery confirmations.

Device information — browser user agent and IP address for security and session management.

All data is encrypted in transit using TLS (Transport Layer Security).

Data is stored in a PostgreSQL database with PostGIS extensions on a secure, managed cloud server.

Passwords are hashed using bcrypt with a cost factor of 10 and are never stored in plain text.

Authentication tokens are signed with HS256 (HMAC-SHA256) and expire after 24 hours.

Session cookies are httpOnly and secure-flagged in production to prevent client-side access.

CNIC document images are stored securely and access is restricted to authorized KYC reviewers only.

Access is role-based and follows the principle of least privilege:

Buyers can only see their own contracts, orders, and tracking information.

Sellers can see their own listings, contracts with buyers, and farm data.

Veterinarians can access bookings and health records for animals assigned to them.

Caretakers can see feeding tasks and animal care logs for their assigned animals.

Suppliers can view and manage their feed/medicine inventory and orders.

Dispatch riders can see delivery assignments, routes, and delivery confirmations.

Admins have full platform access for oversight, moderation, and support.

Active contracts and order data are retained for the duration of the contract plus 12 months for dispute resolution.

KYC verification data is retained for the lifetime of the account and 24 months after deletion for regulatory compliance.

Veterinary health records and certifications are retained permanently as part of the animal's health passport.

Financial transaction records are retained for 7 years in compliance with Pakistani tax regulations.

User sessions expire after 24 hours of inactivity.

Deleted accounts: upon request, personal data is anonymised within 30 business days (see section 5).

You have the right to request a copy of all personal data we hold about you (data export).

You have the right to request correction of inaccurate personal data.

You have the right to request deletion of your account and personal data.

You can delete your account directly from the app: go to Account Settings → Delete Account. This immediately and permanently removes your name, email, phone number, and all login sessions.

Alternatively, you may request deletion by emailing us using the details in section 7 below.

Email requests will be processed within 30 business days.

Note: certain data (completed contracts, financial transactions, veterinary records) may be retained in anonymised form for legal and regulatory compliance even after account deletion.

Payment processors: deposit and payment amounts are shared with integrated payment gateways (JazzCash, Easypaisa, or bank partners) to process transactions.

Veterinary authorities: health certifications may be shared with government veterinary departments when required by law for animal movement permits.

Dispatch partners: delivery addresses and recipient contact details are shared with assigned dispatch riders for order fulfillment.

We do not sell personal data to any third party.

We do not share personal data with third parties for their marketing purposes.

For privacy concerns, data requests, or questions about this policy:

Platform Operator: Sahulat by PakSaf

Email: privacy@paksaf.com

Support: Use the in-app help or contact your seller directly.

Mailing Address: PakSaf, Multan, Punjab, Pakistan