IraqMoto Privacy Policy

1. Scope

This Privacy Policy explains how IraqMoto ("IraqMoto," "we," "us," or "our") collects, uses, discloses, stores, and deletes personal information when a person uses:

• the IraqMoto website at https://iraqmoto.com;
• the IraqMoto application for iOS; or
• the IraqMoto application for Android.

The website and mobile applications are collectively called the "Services." IraqMoto is a marketplace that enables users to publish motorcycle listings and communicate with other users. IraqMoto is not a motorcycle dealer, payment intermediary, delivery provider, escrow provider, or party to motorcycle transactions.

This Policy describes only features currently available. Paid digital features, mobile advertising, cross-app tracking, persistent advertising identifiers, push notifications, and Google or Apple mobile login are not described as active features. This Policy will be updated before any such feature is activated.

Authenticator-application two-factor authentication, user blocking, and the reporting of advertisements, users and individual messages are active features and are described in this Policy.

2. Information we collect

2.1 Account and contact information

When a user registers or manages an account, we may collect:

• full name;
• email address;
• telephone number, if provided;
• manually selected city or governorate;
• profile photograph;
• account identifier, account status, language, and preferences; and
• password-verification data and one-time security codes; and
• two-factor authentication status and, where a user enables authenticator-application two-factor authentication, the shared secret used to verify the codes generated by that application.

Passwords are stored using one-way password hashing. IraqMoto personnel cannot retrieve a user's original password. A two-factor secret is used only to verify the codes a user submits at sign-in and is deleted when the user disables two-factor authentication.

2.2 Listings and user content

We collect information users choose to publish or submit, including:

• motorcycle details, price, description, city, condition, documents and other listing fields;
• listing and profile photographs;
• reviews and ratings;
• messages between users;
• favorites, comparisons, listing views and other marketplace interactions;
• the list of accounts a user has blocked, which is visible only to that user and to authorized personnel; and
• reports of advertisements, users and individual messages, together with complaints, appeals, supporting material and communications with moderators.

Public listings, profile names, profile photographs, ratings and reviews may be visible to other users and to search engines. Private messages are made available only to the participating accounts and authorized personnel when access is reasonably necessary for support, safety, abuse investigation, legal compliance or enforcement.

2.3 Support and communications

If a user contacts IraqMoto, we may collect the message, email address, attachments and other information supplied to respond to the request, investigate a problem or maintain a support record.

2.4 Security and technical information

To operate and protect the Services, we may collect limited technical information, including:

• a hashed, truncated or otherwise minimized IP address;
• browser type, operating system, app version and device type;
• login times, session information and authentication events;
• rate-limit, fraud, moderation and security events; and
• basic server and error information needed to diagnose service failures.

IraqMoto does not intentionally collect contacts, microphone recordings, precise GPS location or persistent mobile advertising identifiers. Users select their city manually.

2.5 Photographs and camera access

When a user chooses to upload a profile or listing photograph, the mobile app may offer the operating system's photo picker or camera. Access occurs only after a user initiates the action. IraqMoto receives only the photographs the user selects or captures for upload; it does not request unrestricted access to the user's photo library where a system picker is available.

2.6 Website cookies and advertising

The website uses essential cookies or similar storage for authentication, security, session continuity, language and preferences. The website may display Google AdSense advertising. Where consent is legally required, advertising and other non-essential cookies must not load until the user has made a choice through the consent interface.

The first iOS and Android releases do not display advertising, perform cross-app tracking or collect persistent advertising identifiers. See the IraqMoto Cookie Policy for more information.

2.7 Information we do not currently collect

IraqMoto does not currently process payments for paid digital features and does not collect payment-card or bank-account information. Paid boosts, subscriptions, badges and paid listing allowances are not currently available.

3. How we use information

We may use personal information to:

• create, authenticate, secure and administer accounts;
• provide listings, search, favorites, comparisons, messaging, reviews and other requested marketplace functions;
• display public content submitted by users;
• send verification codes, security notices, transactional messages and responses to support requests;
• detect spam, fraud, stolen-property reports, account compromise, prohibited content and other misuse;
• review listings before publication and investigate reports or appeals;
• enforce the Terms and Community Guidelines;
• maintain service reliability, diagnose errors and protect the Services;
• comply with legal obligations and valid requests from competent authorities;
• establish, exercise or defend legal claims; and
• improve the Services using aggregated or minimized operational information.

Where applicable law requires a legal basis, we rely on performance of our agreement with the user, the user's consent, compliance with law, protection of vital or public-safety interests, and our legitimate interests in providing and securing a motorcycle marketplace. A user may withdraw consent where processing is based on consent, without affecting processing completed before withdrawal.

4. How we disclose information

We do not sell personal information.

We may disclose limited information to:

• Hetzner Online GmbH, which hosts the website, application services and database on infrastructure located in Helsinki, Finland;
• Cloudflare, for domain, content-delivery, network-security and related services;
• Resend, for account, verification, security and service email delivery;
• Google AdSense, only in connection with advertising on the website and subject to applicable cookie/consent choices;
• professional advisers, insurers or auditors where reasonably necessary and subject to appropriate confidentiality obligations;
• law-enforcement, courts, regulators or other competent authorities when disclosure is legally required or reasonably necessary to protect rights, safety or the integrity of the Services; and
• a successor in a merger, reorganization or transfer of the IraqMoto business, subject to appropriate notice and protection.

Service providers may process information only for the services they provide to IraqMoto or as otherwise permitted by law and their applicable terms. Some jurisdictions do not treat processing by a contracted service provider as a sale or sharing of information.

5. Advertising and tracking

Google AdSense advertising may operate on the website. Google and its partners may use cookies, browser information, approximate location derived by third parties, and activity information to deliver, limit, secure and measure advertising in accordance with Google's policies and the user's consent choices.

The initial iOS and Android apps do not contain mobile advertising, do not request permission for cross-app tracking, and do not collect a persistent advertising identifier. We will update this Policy and the relevant App Store and Google Play disclosures before introducing mobile advertising or tracking.

6. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy:

Where possible, retained records are minimized, pseudonymized or anonymized. Aggregated information that cannot reasonably identify a person may be retained for legitimate operational and statistical purposes.

7. Account and data deletion

Users may initiate account deletion:

• inside the website or app through Settings > Delete Account; or
• through https://iraqmoto.com/delete-account.

Deletion requires reasonable verification to prevent unauthorized requests. After a valid request, IraqMoto promptly deletes or de-identifies the active account, profile, listings, uploaded photographs, messages, favorites, sessions and other associated personal information. Deleted information is removed from backups within 30 days.

Limited fraud, moderation, security, accounting or legal records may be retained for up to two years only where necessary. Those records are minimized or anonymized where possible and are not used for advertising.

Deleting an account does not require or cause the other party to delete information that the other party independently provided to IraqMoto, but IraqMoto will remove the deleted user's identity and associated personal information as required by applicable law and platform rules.

8. International processing

IraqMoto is operated from Iraq and uses Hetzner Online GmbH hosting infrastructure located in Helsinki, Finland. Cloudflare, Resend, Google and other service providers may process information in additional countries. Data-protection laws may differ between countries. We use contractual, technical and organizational measures appropriate to the nature of the information and the processing involved.

9. Security

We use reasonable safeguards designed to protect information, including HTTPS in transit, password hashing, optional authenticator-application two-factor authentication, access controls, session protections, rate limiting, file-validation measures, logging and administrative authorization controls. No online service can guarantee absolute security. Users should use a unique password, protect verification codes and report suspected account compromise promptly.

Suspected security vulnerabilities, account compromise or other security concerns may be reported to [email protected]. Reports made in good faith are welcome and will not be pursued by IraqMoto as a breach of these documents.

10. User choices and rights

Depending on applicable law, a user may have rights to:

• access or receive information about personal data;
• correct inaccurate account information;
• delete an account and associated information;
• object to or restrict certain processing;
• withdraw consent for optional processing;
• manage non-essential cookies; and
• submit a complaint to an appropriate authority.

Requests may be submitted to [email protected]. We may request reasonable verification and may deny or limit a request where permitted or required by law, while explaining the reason where appropriate.

11. Children and minimum age

People under 18 may browse publicly available content but may not create an account, publish listings, message sellers or participate in marketplace transactions. IraqMoto does not knowingly collect account information from a person under 18. A parent or guardian who believes a minor created an account may contact [email protected] for investigation and deletion.

12. Third-party links and motorcycle transactions

The Services may contain links or contact methods leading to third-party websites, social networks, map services or user-selected communication services. Their privacy practices are governed by their own policies.

IraqMoto does not receive or hold motorcycle purchase funds and does not participate in, guarantee or insure transactions between users.

13. Changes to this Policy

We may update this Policy when the Services, law, service providers or data practices change. Material changes will be identified by a new effective date and, where appropriate, an in-service notice or renewed consent. We will update this Policy and store privacy declarations before activating materially different processing such as mobile advertising, tracking, payments, push notifications, social login or new sensitive permissions.

14. Languages

Translations may be provided in Arabic and Kurdish for convenience. The English version controls to the extent permitted by mandatory law if a translation conflicts with it.

15. Contact

Aydin Samir, trading as IraqMoto Baghdad, Republic of Iraq Email: [email protected]