This Privacy Policy explains what personal information iswap.pk ("we", "us", "our"), operated by ISWAP SMC-PRIVATE LIMITED, a company incorporated under the laws of the Islamic Republic of Pakistan, collects across the website, the Android and iOS applications, and all related services (collectively, the "Platform"); why we collect it; who we share it with; and the choices and rights you have over it. It should be read together with our Terms & Conditions, which governs your use of the Platform generally.
1. Your Consent to This Policy
By checking "I accept iSwap's Terms and Conditions and Privacy Policy" when creating an account, and/or by accessing, browsing, or otherwise using the Platform, you give your free, specific, and informed consent to the collection, storage, use, and disclosure of your personal information as described in this Privacy Policy.
- Consent-Based Processing: Consent obtained through your acceptance of this Policy is our primary legal basis for collecting and processing your personal data. Where we rely on a different basis for a specific activity — such as our legitimate interest in preventing fraud and abuse, or a legal obligation to disclose information to law enforcement — that basis is identified in the relevant section below.
- Point of Collection: You are asked to accept this Policy (together with our Terms & Conditions) at the point of account registration. Continued use of the Platform after that point, including posting a listing, sending a message, or submitting a report or comment, constitutes ongoing consent to the collection and use of the data associated with that activity, as described below.
- Granular Consent for Optional Features: Some data is only collected when you take a specific, optional action — for example, sharing your location in a chat, enabling marketing notifications, or granting camera/photo-library or push-notification permissions on the mobile apps. Taking that action is a further, specific act of consent to that particular collection, separate from your general acceptance of this Policy.
- Withdrawing Consent: You may withdraw your consent at any time by adjusting your notification and privacy preferences in account settings, revoking a permission on your device, deactivating your account, or requesting deletion of your account as described in Section 11 (Your Rights and Choices). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and we may continue to retain limited data after withdrawal where necessary for the purposes described in Section 9 (Data Retention) — for example, fraud prevention, dispute resolution, or compliance with law.
- If You Do Not Consent: If you do not agree to this Policy, please do not register for, or otherwise use, the Platform. Certain features described below (such as OTP verification and posting a listing) cannot function without the related data collection, so declining that specific collection means that feature will not be available to you.
2. Information We Collect
We collect the following categories of information, either directly from you, automatically as you use the Platform, or from other users interacting with your content:
Account & Identity Data
- Your name, email address, phone number, and WhatsApp number.
- Your password, stored in hashed (non-reversible) form, if you register with email/password.
- Your Google account identifier and profile photo, if you register or sign in with Google.
- Optional profile details you choose to add: profile photo, date of birth, gender, bio, saved addresses, and preferred language.
Verification Data
- One-time passcodes (OTPs) sent to verify your phone number, and email verification tokens sent to verify your email address.
- For higher account tiers, secondary verification information such as CNIC details or video verification, where you choose to complete that step (see our Terms & Conditions).
Listings & Trade Content
- The ads and swap listings you post, including photos, descriptions, condition, price, and city.
- Swap offers, cash (top-up) offers, and their negotiation history and status.
- Items you save to your wishlist.
Messages & Location Data
- Chat messages and image attachments you send to other users through the Platform, so we can deliver them and investigate abuse reports.
- Location information you choose to share inside a conversation — including search queries and map coordinates you pick when arranging a meetup — and the date, time, and place of a proposed meetup.
- Typing indicators and presence/last-seen status.
Community Content on Mobile Prices
- Comments and photos you post on a device's Mobile Prices page.
- Price, specification, image, or link correction reports you submit, and the email address you optionally provide with a report.
Usage, Device & Fraud-Prevention Data
- Pages and listings you view, and the approximate location (city) you browse from.
- Standard technical data such as browser type, device type (mobile, tablet, or desktop), operating system, and IP address. IP address is collected on every sign-up, sign-in, and listing submission.
- A device/browser fingerprint generated on your device — at account registration (including via Google Sign-In and Google One Tap), at sign-in, and when you submit a listing — used to detect fraud, duplicate accounts, and policy circumvention (see Section 5).
3. How We Use Your Information
- To operate core features — posting ads, search, chat, swaps, wishlists, and meetup scheduling.
- To verify accounts (OTP and email verification) and keep the Platform secure against fraud, duplicate accounts, and abuse.
- To determine and manage your account tier and ad allowances.
- To hand store orders only to the right person, using the receiver's CNIC details, and to look into delivery, fraud, stolen-device, return, and warranty issues with that order. We don't use these details for marketing, and we don't sell them.
- To process and deliver store orders, handle returns, replacements, refunds and warranty claims, and confirm that a phone is genuine.
- To remember preferences like your selected city and notification settings.
- To deliver transactional notifications (messages, offer and swap updates, price drops) and, where you have opted in, marketing communications.
- To respond to support requests, and to review and act on user reports and content moderation.
- To display and keep the Mobile Prices directory, Blog, and Help Center accurate and current.
- To maintain and improve the Platform, and to show advertising, as described below.
- To comply with legal obligations and to cooperate with law enforcement where required, including reporting devices or accounts implicated in theft, fraud, or other crimes to the relevant authorities (see our Terms & Conditions).
4. Cookies and Advertising
We use cookies and similar technologies to run the site — for example, keeping you signed in. Certain forms are also protected by Google reCAPTCHA, which sets its own cookies to distinguish genuine users from bots. For the full list of cookies we use, what each one does, how long it lasts, and how to accept, decline, or change your choice at any time, see our dedicated Cookies Policy.
iswap.pk may display advertising served by third-party vendors, including Google. Google and its partners use cookies (such as the DoubleClick/DART cookie) to serve ads based on your prior visits to this site or other sites on the internet. You can learn more about how Google uses this data and opt out of personalized advertising at policies.google.com/technologies/ads and manage your ad settings at adssettings.google.com. You can also disable cookies generally through your browser settings, though some parts of the site may not work as intended without them.
5. Device Fingerprinting, Fraud Prevention & Blacklisting
- Why we collect it: To protect genuine users from scams, we generate a device/browser fingerprint and record your IP address, and use them, together with behavioral patterns, to score the risk of a listing or account and to detect multiple accounts operated by the same person.
- When we collect it: A fingerprint and IP address are captured at account registration — whichever method you use, including email/password, the Google Sign-In popup, the Google One Tap prompt, and the native app's Google sign-in — again at every sign-in, and again each time you submit a listing. A brand-new account is checked against our fraud signals at the moment it is created, not only the first time (if ever) it posts a listing.
- How the fingerprint is generated: The fingerprint is computed entirely on your device from standard, publicly documented browser characteristics (for example, rendering behavior, installed fonts, and hardware configuration) and reduced to a single non-reversible identifier before it is sent to us — we do not receive or store the underlying raw characteristics themselves, only the resulting identifier. This technique, and its privacy implications, are studied by the World Wide Web Consortium (W3C) — for example, in its Privacy Interest Group guidance on mitigating browser fingerprinting. Consistent with that guidance, we use this identifier solely as a first-party security signal for this Platform: it is never used to track you across other websites, to build an advertising profile, or to defeat browser privacy protections, and it is not shared with our advertising partners described in Section 4.
- Blacklist: Where a device fingerprint or a hashed (never a raw) phone number is confirmed to be associated with fraud or serious policy violations, we retain it on an internal blacklist to block further abuse from that device or contact identifier, independent of any specific account. Because device fingerprints can, in rare cases, be identical for two unrelated people using very similar hardware and software, a fingerprint-only blacklist match does not by itself automatically reject a listing — it is held for human review unless corroborated by an independent signal (such as a matching phone number, shared IP history, or duplicate content). A hashed phone number match is treated as a stronger signal and may act on its own.
- Duplicate Image Detection: We compute a similarity hash of listing photos to detect duplicate or reused images across listings, for fraud-prevention purposes.
- Legal Basis (GDPR): For users in the European Economic Area and the United Kingdom, this processing is carried out on the basis of our legitimate interest in maintaining a safe, fraud-free marketplace and protecting other users and the Platform from abuse, under Article 6(1)(f) of the General Data Protection Regulation (GDPR), and additionally on the basis of your consent to this Policy as described in Section 1. You have the right to object to processing based on legitimate interest; see Section 11.
6. How We Share Information
We don't sell your personal information. We share it only:
- With other users where it's inherent to the feature — your listing details, public profile, and Mobile Prices comments are public, and your phone number or WhatsApp number is shared with a buyer or seller if you choose to reveal it in a chat.
- With service providers who help us run the Platform under contract, including: cloud infrastructure and authentication providers, SMS delivery providers for OTP verification, transactional email providers, cloud file storage providers for photos and attachments, and analytics providers (Google Analytics, which on the website only sets its cookies if you choose "Accept All" — see our Cookies Policy). These providers are only permitted to use your data to provide the relevant service to us.
- With our delivery staff — the rider delivering a store order sees the receiver's name and the last four digits of their CNIC, so they can check them at the door. The full CNIC number is visible only to authorized staff who manage orders.
- With delivery and payment partners — our riders and courier companies get the name, phone number, and address needed to deliver your order. Payment providers get what they need to process a payment you make online.
- Through WhatsApp — we send your packing video to the number on your order on WhatsApp, and WhatsApp's own privacy terms apply to messages sent there.
- With mapping services — when you search for or share a location in chat or a meetup proposal, that query is sent to a third-party location-search service to return results.
- With advertising partners as described in Section 4 (Cookies and Advertising), above.
- With law enforcement and regulators when required by law, or to investigate stolen, cloned, or otherwise illegal devices and accounts, including the National Cyber Crime Investigation Agency (NCCIA) and the Pakistan Telecommunication Authority (PTA), as described in our Terms & Conditions.
- In a business transfer — if ISWAP SMC-PRIVATE LIMITED is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
- To protect rights and safety — to enforce our Terms, investigate a report, or protect the rights, property, or safety of iswap.pk, our users, or the public.
7. International Data Transfers
Some of the service providers described in Section 6 operate infrastructure outside Pakistan. Where your information is processed or stored outside Pakistan, we take reasonable steps to ensure it continues to be protected consistently with this Policy.
8. Data Security
We use reasonable technical and organizational safeguards to protect your information, including encrypted connections (HTTPS), hashed password storage, and access controls limiting who can view account and verification data. A receiver's full CNIC number is encrypted, kept apart from order records, and masked when shown back to you. Return videos and photos, and the CNIC photos, handover photos, signatures, and failed-delivery photos riders take, are stored privately: our site only offers them to the staff handling that order or return, and your own return videos and photos to you. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@iswap.pk.
9. Data Retention
- We keep account, listing, and message data for as long as your account is active, and for a reasonable period afterward to resolve disputes, investigate abuse reports, enforce our Terms, and meet legal obligations.
- Anonymized impression/view analytics records are automatically deleted after 30 days.
- Account activity logs (e.g., sign-in, listing, and chat events) and moderation/administrative records are retained for longer periods as an audit trail supporting account security and dispute resolution.
- We keep the 20 most recent device fingerprints and 20 most recent IP addresses associated with your account, so older ones age out automatically as new ones are recorded. The per-event activity log described above (which records which fingerprint/IP was used for a given sign-in or listing) is retained longer, as an audit trail, for the same security/dispute-resolution reasons as other activity logs. Entries on the fraud-prevention blacklist are retained until an administrator determines they are no longer needed.
- Chat messages and meetup details may be retained even after you delete or archive a conversation on your end, where necessary to investigate a report or resolve a dispute involving the other participant.
- Receiver details saved on your account are kept until you change them or delete your account. Those recorded against an order you placed are kept with that order for at least 2 years, and for as long as we need them for delivery, returns, warranty, disputes, and legal obligations, and remain after your account is deleted.
- Order records and device numbers are kept for those same reasons and periods.
- We automatically delete CNIC photos taken at delivery after 6 months; handover photos, signatures, and failed-delivery photos after 1 year (counted from the delivery, hand-back, or attempt); and return videos and photos 90 days after the return is closed. We keep them longer only while a dispute about that order is open. Deleting your account doesn't shorten these periods.
- You can request deletion of your account at any time; see Section 11.
10. Notification Preferences
You can choose which channels — email, SMS, and push — you receive notifications on, and opt in or out of specific notification types (messages, price drops, swap updates, and marketing) from your account settings. One-time passcodes (OTP) and essential account/security notices are transactional and will still be sent regardless of your marketing preferences, as they are required to verify your account and keep it secure.
11. Your Rights and Choices
You can review and update your profile information from your account settings, delete individual listings, manage your notification preferences, or request that we delete your account and associated data by contacting us or using the delete-account option in account settings. We will respond to reasonable requests within a reasonable time, subject to the retention exceptions in Section 9 and to the fraud-prevention limits described below. You can change the receiver details saved on your account at checkout, or contact us to have them removed.
If You Are in the EEA or UK (GDPR)
You have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; request that we restrict processing in certain circumstances; object to processing carried out on the basis of our legitimate interest, including the fraud-prevention processing described in Section 5; and receive a copy of your data in a portable format. Where our fraud-prevention processing is necessary to protect other users and the integrity of the Platform, we may decline or limit an erasure or objection request to that specific data, as permitted under GDPR, and will explain why. You also have the right to lodge a complaint with your local data protection supervisory authority.
If You Are a California Resident (CCPA/CPRA)
You have the right to: know what personal information we collect, use, and disclose about you; request a copy of that information; request correction of inaccurate information; request deletion of your information; and not be discriminated against for exercising these rights. We do not sell or share (as those terms are defined under the CCPA) your personal information, including your device fingerprint or IP address, so there is no opt-out required for that activity. To exercise any of these rights, contact us or email support@iswap.pk; we may need to verify your identity before completing a request.
12. Children's Privacy
iswap.pk is not intended for use by anyone under 18. We do not knowingly collect information from children.
13. Third-Party Links, Images & Content
Listings, chat messages, comments, and Blog/Help Center articles may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties; review their own policies before providing information to them.
The Platform also displays certain images and content — such as device photos and specifications on Mobile Prices pages — sourced from manufacturers, retailers, distributors, public product listings, or other third parties, for informational and editorial purposes. If you are a rights holder and object to the use of your image or content on the Platform, you may request its removal by contacting support@iswap.pk, as described in Section 26 (Third-Party Images, Content & Copyright Complaints) of our Terms & Conditions.
14. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we'll update the "last updated" date above and, where appropriate, notify you via in-app banner or email. Continued use of the Platform after a change takes effect constitutes your consent to the updated Policy.
