1. Information we collect
When you open a shop (merchants)
- Account details from Google Sign-In: your name, email address and profile photo. We do not receive your Google password.
- Shop details you enter: shop name, description, logo, address, opening hours, WhatsApp number, social handles and your products.
When you buy from a shop (shoppers)
- Order and delivery details: your name, phone number, an optional email, and your delivery address (city, district, street, landmark and any notes you add).
- Optional map location: only if you choose to drop a pin on the map to help the courier find you. It is never taken automatically, and orders work without it.
- Your order contents and, if you create a shopper account, the details above via Google Sign-In.
Collected automatically
- A login session cookie (if you sign in) and a language-preference cookie. See our Cookie Policy.
- Basic technical data such as your IP address and browser type, used only to serve the site securely and prevent abuse.
- No analytics or advertising trackers. We do not use Google Analytics, advertising pixels, or any third-party tracking, and we do not build profiles of you across other websites.
2. How we use your information
- To display shops, take and fulfil orders, and arrange delivery.
- To let a shop contact you about your order (e.g. by phone/WhatsApp).
- To provide, secure and support the platform and prevent fraud/abuse.
- To manage merchant accounts and subscriptions.
Orders on Shopy.krd are cash on delivery — you pay the shop when your order arrives. We do not collect or store card or bank details for payments.
3. Legal bases
Where data-protection law applies, we rely on: performing the contract with you (to take and deliver your order or run your account); your consent (e.g. the optional map pin); and our legitimate interests in operating a secure, working service. You can withdraw consent at any time.
4. Who we share it with
- The shop you order from receives the details needed to fulfil and deliver your order. Each shop is responsible for how it then uses that information.
- Service providers who host and protect the platform (secure cloud hosting and content-delivery providers, with servers located in the European Union) and Google for sign-in.
- When required by law, or to protect our rights, users or the public.
- We never sell your personal data and never share it with advertising networks.
5. Data retention
We keep personal data for as long as needed to provide the service, support your orders, and meet legal, accounting and dispute-resolution needs, then delete or anonymise it. Merchants can request deletion of their shop, and you can ask us to delete your data (see your rights below).
6. How we protect it
Data is encrypted in transit (HTTPS). Access is restricted, and each shop’s data is isolated from every other shop’s at the database level. No system is perfectly secure, but we take reasonable measures to protect your information.
7. Your rights
Subject to applicable law, you may ask to access, correct, delete, or limit the use of your personal data, or object to certain processing. For data held by a shop, contact that shop directly; for anything we hold or for help reaching a shop, contact us below. We will respond within a reasonable time.
8. Children
Shopy.krd is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will remove it.
9. International users
Our servers are located in the European Union, so if you use Shopy.krd from elsewhere your information is transferred and processed there.
10. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above and, for significant changes, provide a clearer notice.
Contact us
Questions about this policy or your data? Reach Shopy.krd:
- Through the contact options on shopy.krd.
- Based in Kurdistan Region, Iraq.