1. Introduction
AutoModz (“we”, “us”, “our”) respects your privacy and is committed to protecting personal data in line with applicable laws in Pakistan and widely recognised data-protection principles. This Privacy Policy explains what we collect, why we collect it, how we use and safeguard it, and the choices you have when you use automodz.pk (the “Site”), place orders, create an account, sign in with third-party providers, or communicate with us (collectively, the “Services”).
By using the Services, you acknowledge this Policy. If you do not agree, please do not use the Site or submit personal data to us.
Public policy URLs (for app review & OAuth):
Privacy Policy: https://automodz.pk/privacy-policy
Terms of Use: https://automodz.pk/terms-of-use
User Data Deletion Instructions: https://automodz.pk/user-data-deletion
2. Data controller
The data controller for personal information processed through the Site is AutoModz, Lahore, Pakistan. Privacy contact: support@automodz.pk.
3. Information we collect
3.1 Information you provide
- Account data: name, email address, phone number, password (stored only as a secure one-way hash), and profile details you choose to save.
- Order & checkout data: billing/shipping name, delivery address, city, phone, email, order notes, and payment method selection.
- Guest checkout: the same order contact and delivery details when you shop without registering.
- Payment-related data: we do not store full card numbers on our servers. Payment partners (e.g. Stripe, PayPal, JazzCash, EasyPaisa, or cash-on-delivery workflows) may process transaction references, status, and limited payment metadata according to their own policies.
- Communications: messages you send by email, WhatsApp, or support channels, including order confirmations and delivery updates if you opt in to WhatsApp automation.
- Reviews & content: product reviews, ratings, and text you submit on the Site.
3.2 Information collected automatically
- Technical & usage data: IP address, browser type, device information, pages viewed, referring URLs, and approximate location derived from IP.
- Cookies & similar technologies: session identifiers, authentication tokens, cart contents, CSRF protection tokens, and preferences needed for security and core Site functionality.
- Security logs: failed login attempts, admin access, webhook delivery logs (e.g. WhatsApp, Facebook data deletion), and fraud-prevention signals.
3.3 Information from third parties
- Social sign-in (OAuth): when you choose “Continue with Google”, “Continue with Facebook”, “Continue with Instagram”, “Continue with LinkedIn”, or “Continue with X (Twitter)”, we receive information from that provider as described in Section 16.
- Payment gateways return payment status and transaction identifiers needed to fulfil your order.
- Courier or logistics partners may provide delivery status updates linked to your order.
4. How we use your information
We use personal data only where we have a lawful basis, including to:
- Process, fulfil, ship, and support your orders (contract performance).
- Create and manage your account, authenticate you (including via social login), and provide order history.
- Send transactional messages (order confirmation, shipping updates, payment status) by email and, where enabled, WhatsApp.
- Generate shipping labels, tracking links, and QR codes that allow you or carriers to view order status through secure tokenised URLs.
- Process payments, prevent fraud, and comply with financial record-keeping obligations.
- Operate, secure, and improve the Site (monitoring, debugging, analytics in aggregated form).
- Respond to inquiries, disputes, data deletion requests, and legal requests.
- Send marketing only where you have given clear consent or where permitted by law; you may opt out at any time.
We do not use Google user data for serving advertisements. We do not sell personal information to data brokers.
5. Legal bases (summary)
- Contract: processing necessary to sell and deliver products you order and to provide account login.
- Legitimate interests: site security, fraud prevention, and service improvement, balanced against your rights.
- Consent: optional marketing, non-essential cookies where required, WhatsApp messaging where applicable, and your consent on each social login provider.
- Legal obligation: tax, accounting, and regulatory requirements.
6. Sharing and disclosure
We do not sell your personal information. We may share data with:
- Service providers under confidentiality obligations: hosting, email delivery, payment processors, OAuth/identity providers (Google, Meta/Facebook, Instagram, LinkedIn, X), WhatsApp/Meta Cloud API, analytics (if used), and IT support.
- Delivery partners to the extent needed to deliver parcels (name, address, phone, tracking reference).
- Professional advisers (lawyers, accountants) when necessary.
- Authorities when required by law, court order, or to protect rights, safety, and security.
- Business transfers in connection with a merger, acquisition, or asset sale, subject to continued protection consistent with this Policy.
Third-party sites and sign-in providers have their own privacy policies; review them when you authenticate.
7. International transfers
Our primary operations are in Pakistan. Some providers (e.g. cloud hosting, Google, Meta/Facebook, payment processors, or WhatsApp infrastructure) may process data in other countries. Where data leaves Pakistan, we take steps to ensure appropriate safeguards (contractual protections, provider certifications, and minimisation of data shared).
8. Data retention & deletion
We retain personal data only as long as necessary for the purposes above, including:
- Order and payment records: typically for the period required by tax and commercial law (often several years).
- Account data: until you delete your account or request erasure, subject to legal holds.
- Social login links: until you disconnect the provider, delete your account, or submit a valid deletion request.
- Marketing preferences: until you withdraw consent or unsubscribe.
- Security logs: for a limited period appropriate to investigate incidents.
- Guest tracking tokens: while needed for order tracking links; tokens may be rotated or invalidated when no longer required.
How to request deletion: follow the step-by-step instructions at https://automodz.pk/user-data-deletion. Facebook Login users may also remove the app in Facebook settings; we honour Meta data-deletion callbacks as described on that page.
9. Security measures
We implement administrative, technical, and organisational measures designed to protect your data, including HTTPS encryption in transit, access controls for admin systems, hashed passwords, CSRF protection, tokenised guest tracking links, OAuth industry-standard flows for social login, and least-privilege staff access. No method of transmission or storage is 100% secure; please use a strong unique password and protect your devices.
If you believe your account or order information has been compromised, contact us immediately at support@automodz.pk.
10. Your rights and choices
Subject to applicable law, you may have the right to:
- Access personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of data not required for legal or contractual purposes (see User Data Deletion).
- Object to or restrict certain processing.
- Withdraw consent where processing is consent-based (without affecting prior lawful processing).
- Receive a copy of your data in a portable format where technically feasible.
- Revoke social login access via your Google, Facebook, or other provider account settings.
To exercise these rights, email support@automodz.pk from the address associated with your account or order. We may need to verify your identity before responding.
11. Cookies
Essential cookies and session storage are used for login (including OAuth return flows), cart, checkout, and security. You can control cookies through browser settings; disabling essential cookies may prevent you from using parts of the Site.
12. Children
The Services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly.
13. WhatsApp and messaging
If you provide a mobile number and we enable WhatsApp order updates, messages may be sent via Meta’s WhatsApp Business Platform. Message content is limited to order-related information. Reply-based confirmations may update order status in our system. Meta processes data according to its own terms and privacy policy. You can stop WhatsApp messages by replying STOP where supported or by contacting us, though we may still email critical order updates.
15. Changes to this Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change, and material changes may be highlighted on the Site. Continued use after changes constitutes acceptance where permitted by law.
16. Contact
Privacy & data requests: support@automodz.pk
WhatsApp (business): +92 312 4094997
User data deletion: https://automodz.pk/user-data-deletion
Related: Terms of Use
14. Social sign-in (Google, Facebook, Instagram, LinkedIn, X)
When social login is enabled on automodz.pk, you may register or sign in using a third-party account instead of creating a separate password. We only request the minimum data needed to authenticate you and maintain your account.
14.1 Google Sign-In
If you choose Google, we may receive:
We use this information solely to:
AutoModz’s use and transfer to any other app of information received from Google Accounts will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, or use it for creditworthiness decisions. You can revoke access at any time in your Google Account permissions.
14.2 Facebook Login (Meta)
If you choose Facebook, we may receive:
We use this data only for authentication, account management, and order linking as described above—not for unrelated profiling or ad targeting on Facebook. You can remove AutoModz in Facebook Settings → Apps and websites. Meta may send us a data-deletion request; we process it according to https://automodz.pk/user-data-deletion.
14.3 Instagram
Instagram login (where enabled) is provided through Meta’s platforms. We may receive a user identifier, username, account type, and profile picture for authentication only. Meta’s policies apply to data collected by Instagram; we store only what is needed for your account on our Site.
14.4 LinkedIn and X (Twitter)
Where enabled, LinkedIn or X sign-in may provide a user identifier, name, email, and profile image for authentication and account management only, subject to each provider’s privacy policy and your account settings with that provider.
14.5 Storage of social login data
We store your provider name, provider user ID, and optional avatar URL in our database linked to your user account. We do not receive or store your social network password. Disconnecting a provider or deleting your account removes or anonymises this linkage as described in Section 8.