You've reached the end
Effective date: August 20, 2026
Developer and controller: AYDIN SAMIR OSAMA ALMUHAMEEDAMEEN, an individual trading as IraqMoto
Location: Baghdad, Republic of Iraq
Privacy contact: [email protected]
This Privacy Policy explains how IraqMoto ("IraqMoto," "we," "us," or "our") collects, uses, discloses, stores, and deletes personal information when a person uses:
https://iraqmoto.com;The website and mobile applications are collectively called the "Services." IraqMoto is a marketplace that enables users to publish motorcycle listings and communicate with other users. IraqMoto is not a motorcycle dealer, payment intermediary, delivery provider, escrow provider, or party to motorcycle transactions.
This Policy describes the pricing, trial, entitlement, promotion, showroom and sponsored-campaign records currently available. Electronic payment, payment-card collection, programmatic advertising, cross-app tracking and persistent advertising identifiers are not active features. This Policy will be updated before any materially different payment or tracking feature is activated.
Authenticator-application two-factor authentication, user blocking, the reporting of advertisements, users and individual messages, push notifications in the iOS and Android applications, and signing in with a Google Account or an Apple Account are active features and are described in this Policy.
When a user registers or manages an account, we may collect:
Passwords are stored using one-way password hashing. IraqMoto personnel cannot retrieve a user's original password. A two-factor secret is used only to verify the codes a user submits at sign-in and is deleted when the user disables two-factor authentication.
The dealership-trial fingerprint is not a second plaintext copy of the telephone number and is not used to contact, profile or advertise to anyone. It remains linkable to a number if that number is submitted again, so IraqMoto treats it as personal information and protects it accordingly.
We collect information users choose to publish or submit, including:
Public listings, profile names, profile photographs, ratings and reviews may be visible to other users and to search engines. Private messages are made available only to the participating accounts and authorized personnel when access is reasonably necessary for support, safety, abuse investigation, legal compliance or enforcement.
If a user contacts IraqMoto, we may collect the message, email address, attachments and other information supplied to respond to the request, investigate a problem or maintain a support record.
To operate and protect the Services, we may collect limited technical information, including:
IraqMoto does not intentionally collect contacts, microphone recordings, precise GPS location or persistent mobile advertising identifiers. Users select their city manually. Where a showroom profile displays map coordinates, those coordinates are the business location the dealer entered and published; they are not derived from any device location.
Where error-reporting telemetry (for example, a crash-reporting service) is enabled, the service receives only error diagnostics — the route or screen where a failure occurred, the application version, device model and operating system, and a technical error description — and no account credentials, message contents or listing text. Error reporting is disabled unless explicitly configured.
When a user chooses to upload a profile or listing photograph, the mobile app may offer the operating system's photo picker or camera. Access occurs only after a user initiates the action. IraqMoto receives only the photographs the user selects or captures for upload; it does not request unrestricted access to the user's photo library where a system picker is available.
If a user grants notification permission in the iOS or Android application, the operating system issues a push notification token that identifies that installation of the app on that device. We store the token together with the user's account, the platform (iOS or Android) and the language in which notifications should be written.
A push token is an installation identifier, not an advertising identifier. It cannot be used to track a person across other applications or websites, and IraqMoto does not use it for advertising, profiling or measurement.
We use the token only to deliver the notifications described in section 3.1. It is stored while the app remains installed and permission remains granted, and is deleted when the user deletes their account, when the operating system reports that the app has been uninstalled or the token has expired, or when a different account signs in on the same device.
Notification permission is requested only after a user signs in, is never required to use the Services, and can be withdrawn at any time as described in section 10.
A user may create an account or sign in using a Google Account or an Apple Account instead of an email address and password. This is optional; email-and-password registration remains available and is not restricted in any way.
When a user chooses this, the provider asks them to confirm what is shared and then sends us:
We do not receive the account password, contacts, calendar, files or any other information held by Google or Apple, and we cannot act on the user's account at the provider.
Matching to an existing account. If the address the provider sends already belongs to an IraqMoto account, the sign-in resolves to that same account rather than creating a second one. We do this only when the provider states that it has verified the address; where it does not, the sign-in is refused.
Apple's Hide My Email. Apple lets a user withhold their real address and supply a private relay address instead. That relay address is treated exactly like any other email address: it is what we store and where our messages are sent. We are not told the underlying address.
We are the recipient of this information, not the source: signing in does not send a user's IraqMoto listings, messages or activity to Google or Apple. What those providers record about the sign-in itself is governed by their own privacy policies.
The website uses essential cookies or similar storage for authentication, security, session continuity, language and preferences. Where consent is legally required, non-essential storage does not load until the user has made a choice through the consent interface.
IraqMoto operates no advertising cookies or ad-network tracking. A clearly labelled sponsored listing promotion, if shown, uses IraqMoto's own marketplace records and does not add cross-app tracking or a persistent advertising identifier. See the IraqMoto Cookie Policy for more information.
IraqMoto does not currently process electronic payments and does not collect payment-card or bank-account information. Pricing and checkout summaries for Featured promotions, IraqMoto+ and showroom plans are visible, but the checkout action only displays a coming-soon notice and cannot charge, deduct wallet credit or activate a purchase. The introductory 90-day showroom Pro offer displays a price of 0 IQD and creates no payment record. Provider-neutral order, transaction, webhook, refund and payment-audit tables exist for future integration, but remain unused while payments are disabled and contain no card number, CVV, bank-account number or reusable payment credential. To measure demand before enabling payments, we record first-party plan-view, product-selection and coming-soon-view events with the product, displayed price, source screen, platform, locale and timestamp. If a signed-in user asks to be notified when payment becomes available, we store the user identifier and the same product and context fields with that request. We also store plan, trial, staff-access, manual-grant, benefit-redemption, promotion-expiry and sponsored-campaign records when access is provided or tested. Those records show zero paid amount unless and until a real payment system is introduced.
We may use personal information to:
Where applicable law requires a legal basis, we rely on performance of our agreement with the user, the user's consent, compliance with law, protection of vital or public-safety interests, and our legitimate interests in providing and securing a motorcycle marketplace. A user may withdraw consent where processing is based on consent, without affecting processing completed before withdrawal.
Where a user has granted notification permission, the iOS and Android applications may send notifications about:
A notification may include the sender's display name, the listing concerned and a short extract of the message so the user can decide whether to open the app. Anyone able to see the device's lock screen may therefore see that extract; a user who does not want this can disable notification previews in the operating system settings.
IraqMoto does not send marketing or advertising notifications, and does not send notifications on behalf of third parties.
We do not sell personal information.
We may disclose limited information to:
Service providers may process information only for the services they provide to IraqMoto or as otherwise permitted by law and their applicable terms. Some jurisdictions do not treat processing by a contracted service provider as a sale or sharing of information.
IraqMoto loads no programmatic advertising, third-party ad-network scripts or ad-measurement SDKs. The iOS and Android apps do not request cross-app tracking permission and do not collect a persistent advertising identifier.
IraqMoto may show clearly labelled sponsored promotions where a brand funds visibility for an eligible marketplace listing. Campaign selection and delivery use IraqMoto's own listing and entitlement records. Sponsors do not receive a user's private contact details, messages, device identifiers or off-service activity from this feature. No advertising network is a recipient of information described in this Policy. We will update this Policy and store disclosures before introducing materially different advertising or tracking.
We retain information only for as long as reasonably necessary for the purposes described in this Policy:
| Information | Typical retention |
|---|---|
| Active account and public content | Until the user deletes the content/account or the account is terminated |
| Private messages | While the relevant accounts remain active, unless earlier deleted or retention is required for an active safety/legal matter |
| Push notification token | While the app stays installed with permission granted; deleted on account deletion, on uninstall/expiry reported by the platform, or when another account signs in on that device |
| Google/Apple sign-in link (provider identifier) | While the account exists; deleted with the account |
| Security and fraud logs | Up to 90 days, unless a longer period is necessary for an active investigation or legal obligation |
| Reports, moderation decisions and limited audit/legal records | Up to two years when necessary for safety, fraud prevention, appeals, accounting or legal compliance |
| Plan, trial, promotion, benefit and sponsored-grant records | While active, then up to two years for support, abuse prevention and audit/accounting evidence |
| Future payment order, transaction, webhook, refund and payment-audit records | No records are created while payments are disabled; after launch, retained in minimized or de-identified form for the period required by accounting, provider-dispute, fraud-prevention and legal obligations stated in the final launch policy |
| Dealership trial telephone fingerprint | While the introductory offer operates, then up to two years after it ends, solely to prevent repeat activation and resolve abuse or eligibility disputes |
| Monetization funnel events | Up to two years for aggregate product-demand analysis, unless anonymized earlier |
| Payment-availability notification request | Until the selected product becomes available and the notice is sent, or the account is deleted |
| Support correspondence | As reasonably necessary to resolve and document the request, normally no longer than two years |
| Deleted information in backups | Removed or overwritten within 30 days |
Where possible, retained records are minimized, pseudonymized or anonymized. Aggregated information that cannot reasonably identify a person may be retained for legitimate operational and statistical purposes.
Users may initiate account deletion:
https://iraqmoto.com/delete-account.Deletion requires reasonable verification to prevent unauthorized requests. After a valid request, IraqMoto promptly deletes or de-identifies the active account, profile, listings, uploaded photographs, messages, favorites, sessions, push notification tokens, any Google or Apple sign-in link, and other associated personal information. Deleted information is removed from backups within 30 days.
Deleting an IraqMoto account does not delete the user's Google or Apple account. A user may additionally withdraw IraqMoto's access from the provider's own settings — for Apple, under Settings > [name] > Sign in with Apple; for Google, under Google Account > Security > Your connections to third-party apps.
Limited fraud, moderation, security, accounting or legal records may be retained for up to two years only where necessary. Those records are minimized or anonymized where possible and are not used for advertising.
Deleting an account does not require or cause the other party to delete information that the other party independently provided to IraqMoto, but IraqMoto will remove the deleted user's identity and associated personal information as required by applicable law and platform rules.
IraqMoto is operated from Iraq and uses Hetzner Online GmbH hosting infrastructure located in Helsinki, Finland. Cloudflare, Resend, Google, Apple and other service providers may process information in additional countries. Data-protection laws may differ between countries. We use contractual, technical and organizational measures appropriate to the nature of the information and the processing involved.
We use reasonable safeguards designed to protect information, including HTTPS in transit, password hashing, optional authenticator-application two-factor authentication, access controls, session protections, rate limiting, file-validation measures, logging and administrative authorization controls. No online service can guarantee absolute security. Users should use a unique password, protect verification codes and report suspected account compromise promptly.
Suspected security vulnerabilities, account compromise or other security concerns may be reported to [email protected]. Reports made in good faith are welcome and will not be pursued by IraqMoto as a breach of these documents.
Depending on applicable law, a user may have rights to:
Push notifications may be turned off at any time, in either of two independent ways:
Turning notifications off does not delete the account, restrict any other feature, or prevent the user from reading the same information inside the app.
Requests may be submitted to [email protected]. We may request reasonable verification and may deny or limit a request where permitted or required by law, while explaining the reason where appropriate.
People under 18 may browse publicly available content but may not create an account, publish listings, message sellers or participate in marketplace transactions. IraqMoto does not knowingly collect account information from a person under 18. A parent or guardian who believes a minor created an account may contact [email protected] for investigation and deletion.
The Services may contain links or contact methods leading to third-party websites, social networks, map services or user-selected communication services. Their privacy practices are governed by their own policies.
IraqMoto does not receive or hold motorcycle purchase funds and does not participate in, guarantee or insure transactions between users.
We may update this Policy when the Services, law, service providers or data practices change. Material changes will be identified by a new effective date and, where appropriate, an in-service notice or renewed consent. We will update this Policy and store privacy declarations before activating materially different processing such as mobile advertising, tracking, payments, push notifications, social login or new sensitive permissions.
Translations may be provided in Arabic and Kurdish for convenience. The English version controls to the extent permitted by mandatory law if a translation conflicts with it.
AYDIN SAMIR OSAMA ALMUHAMEEDAMEEN, trading as IraqMoto Baghdad, Republic of Iraq Email: [email protected]