Privacy Policy

1. Information We Collect

Category	What We Collect	Purpose	Retention
Account & Profile	Name, phone, email	Account creation & support	Until deletion or 6 months inactivity
Location	Precise / approx. GPS after contract sign	Shipment tracking, safety	90 days
Device & Logs	IP, device model, OS, crash logs	Debugging, security	24 months
Usage Analytics	In‑app behaviour (Firebase)	Product improvement	24 months
Cookies / Local Storage	Session tokens	Keep you signed in	Until cleared

2. How We Use Information

Operate and maintain core logistics functions.
Display real‑time driver location to authorised parties.
Analyse aggregated usage to improve features and prevent fraud.
Send transactional notifications.
Comply with legal obligations.

3. Location Information

Location tracking starts only after a driver digitally signs a transport contract and grants permission. Updates occur approximately every 30 minutes during an active delivery and stop when the delivery is completed or the user disables tracking. Location data is never sold.

4. Sharing of Information

We share data only in the situations listed below:

Recipient	Reason	Safeguards
Firebase (Google LLC)	Analytics, crash reports	EU Standard Contractual Clauses
Map / Routing provider	Route generation	Data minimised
Transport customers	Show live location & ETA	Confidentiality clauses
Regulators / law‑enforcement	Legal compliance	As required by law

5. Legal Bases (EEA / UK)

For users in the European Economic Area and the United Kingdom, we process your personal data under the following legal bases:

Contractual necessity — to deliver the logistics services you request.
Legitimate interests — to improve safety, prevent fraud, and develop new features.
Consent — for precise location tracking and analytics where required.
Legal obligation — to comply with applicable transport or accounting regulations.

6. International Transfers

Your information may be processed outside your country of residence. Our primary servers are located in the European Union; when we transfer data internationally, we rely on adequacy decisions or Standard Contractual Clauses to ensure an equivalent level of protection.

7. Security

We use TLS 1.3 in transit, AES‑256 at rest, role‑based server access, and periodic audits. No method of transmission is 100 % secure.

8. Your Rights

You may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Requests can be sent to qarbarysy@gmail.com. We respond within 30 days.

9. Children’s Privacy

The app is not directed to children under 13. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this policy from time to time. The latest version is always available at https://qar.kz/en/privacy/Alash. Continued use of the app constitutes acceptance of the updated policy.