Privacy Policy
This policy explains what Irsaal does with information — yours, and your customers'. It is written to be read, not to be got past. If something in it is unclear, write to info@irsaalsystems.com and we will explain it.
01 What we hold
Two different things, and it matters which is which.
Your account details
The business name, the names, email addresses and phone numbers of the people who sign in, the plan you are on, and a record of what was done in the panel and when. This is information about you, and we are responsible for it.
The records you enter
Your customers, their addresses, their delivery rounds, their orders, their bottles and their balances. This is your data about your customers. We hold it on your behalf so the software can work; we do not use it for anything else, we do not analyse it, and it never leaves your account.
In data-protection language: for your account details we are the controller. For the records you enter about your own customers we are the processor and you are the controller — you decide what goes in and what comes out, and we act on your instructions.
What we collect automatically
- The IP address a request came from, and what browser or app made it.
- When each account last signed in, and how many times.
- Error reports when something breaks, so it can be fixed.
02 Why we hold it
| What | Why |
|---|---|
| Your account details | To run your account, bill it, and answer you when you contact support. |
| Your customer records | To provide the software you are paying for. Nothing else. |
| Sign-in history and IP addresses | To keep the account secure and to investigate a login you did not recognise. |
| Error reports | To find and fix faults. |
We do not build advertising profiles, we do not sell anything to data brokers, and we do not train anything on the contents of your account.
03 Who can see it
The people you give logins to, and only the sections you allow them. Permissions are set per section and per action, so a rider sees their round and not your books.
No other business using Irsaal can see your records. Every account's data is separated at the database level — every query the software makes is bound to the account it is running for — not by a screen that merely hides things.
A small number of our own staff can reach your data when you ask for support, or when we are investigating a fault. When one of us signs into your account to help you, it is recorded in your account's own history, where you can see it. We do not think support access should be invisible to the customer it happens to.
04 Location data and photographs
If you switch the delivery-location feature on, riders can record a customer's doorstep and photograph the gate so the next rider finds it. That is stored against that customer, in your account, and nowhere else.
- A rider's position is recorded only while they are signed into the rider app and on a round.
- It is never recorded in the background when the app is closed.
- Switch the feature off in Settings and nothing further is collected.
- You can delete a saved location or photograph from the customer's own record at any time.
05 The mobile apps
The rider app and the customer app ask for these permissions, and only for these reasons:
| Permission | What it is for | Optional? |
|---|---|---|
| Location | Recording a delivery point, and showing the rider their route | Yes |
| Camera | Photographing a doorstep or a payment slip | Yes |
| Storage / photos | Attaching a picture you already have | Yes |
| Notifications | Telling a rider a new delivery has been assigned | Yes |
| Network | Talking to your account | No |
Refusing any of the optional ones leaves the rest of the app working. There is no advertising SDK and no third-party tracker in either app.
07 How long we keep it
- While your account is open — everything, because that is the product.
- After it closes — for 30 days, so an account closed by mistake, or one you come back to, is not lost. After that the business records are deleted.
- Financial records — invoices and payments we raised against you may be kept longer where tax law requires it.
- Audit lines — the record that an action happened, and who did it, is kept as a security measure. It contains no customer detail.
You can ask us to delete your data sooner. See below.
08 Your rights
Whatever the law where you are, this is what we will do if you ask:
- See it. Tell you what we hold about you.
- Export it. Give you your records in a file you can open elsewhere. You can do most of this yourself from Reports.
- Correct it. Fix anything that is wrong.
- Delete it. Remove your data, subject to anything the law makes us keep.
- Object. Tell us to stop a particular use of it.
- Complain. Take it up with your data protection authority if we have got it wrong.
Write to info@irsaalsystems.com and we will act on it. There is no charge, and we will not ask why.
09 Deleting your account
You do not need to be able to sign in to ask. There is a form anyone can use, and it works even if you have lost the mailbox you signed up with.
Request account deletion →
You can ask us to close the account entirely, or to clear the records inside
it while keeping the account open.
What happens after you ask:
- We email the address you gave, to confirm the request is genuine.
- A person reviews it, and we reply within 7 days.
- There is a cooling-off period of 14 days before anything is removed, so a request made in error can still be withdrawn.
- After that the data is deleted and cannot be recovered.
10 How we protect it
- Everything travels over an encrypted connection.
- Passwords are stored hashed. Nobody here can read yours, including us.
- Sign-in attempts are rate-limited, and the panel's own admin login harder still.
- Access by our staff is limited to the people who need it, and is logged.
- Backups are taken regularly and are encrypted.
No system is perfect. If a breach affects your data we will tell you, tell you what happened, and tell you what to do about it — promptly, and without waiting to be asked.
12 Children
This is business software. It is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, write to us and we will remove it.
13 Changes to this policy
We may update this policy. The effective date at the top always says which version you are reading. If a change materially affects you — a new use of your data, a new supplier who can see it — we will tell you before it takes effect, by email and in the panel.
14 Contact
Anything about this policy, or about the data we hold, goes to a person and not a form queue:
- info@irsaalsystems.com — privacy and data requests
- The contact form — anything else
- Irsaal Software, Daska, Pakistan
See also our Terms & Conditions, which cover what we owe each other, and the account deletion form.