Privacy policy

The data controller is Domiraqo LLP, a Pakistani limited liability partnership with registered office at Plaza # 18, First Floor, Usman Block, Al-Kabir Town Phase 2, Raiwind Road, Lahore, Pakistan.

Our Data Protection Officer is reachable at dpo@domiraqo.com.

Phone number, name, language preference, saved addresses, profile photo (optional). Professionals additionally provide their CNIC (front and back), a selfie, and skill-test data.

Job history, ratings you give, messages with professionals, and in-app call records (audio is not retained beyond 7 days).

Device data necessary to deliver push notifications and detect fraud (device id, OS version, network type, coarse location at the moment of dispatch).

Contract performance: matching, dispatch, payment, and customer support.

Legitimate interest: fraud prevention, dispute audit trail, product analytics on aggregated data.

Legal obligation: tax records under FBR income tax law, AML/KYC checks for payouts above SBP-mandated thresholds, court-ordered disclosure under Pakistani law, and lawful requests from law-enforcement or regulators.

Consent: optional marketing communications and non-essential cookies.

Matching you with the right professional, dispatching them, processing payment, handling disputes, and providing customer support.

Improving the product through aggregated, anonymised metrics only. Never re-identifiable.

Mandatory legal reporting: FBR income tax returns, SBP AML/KYC reporting for payment flows, and valid Pakistani court orders.

Professional CNIC data is the most sensitive thing we hold. It is encrypted at rest on secure cloud infrastructure in Asia, accessed only by trained ops staff with full audit logging, and never shared with customers or third parties.

See our /legal/cnic-handling page for the full operational policy on CNIC handling.

Customer-facing services are hosted on secure cloud infrastructure in Asia, with disaster-recovery infrastructure in a second Asian region. These regions provide the lowest latency to Pakistani customers while keeping data within Asia.

Personal data is not moved outside Asia for routine processing.

Professionals see only the data they need to do the job: your name, address, phone number, and the work description.

When enabled, payment processors (a card gateway for Visa / Mastercard, and mobile-wallet providers for JazzCash, Easypaisa, and Raast) will see the transaction data necessary for the payment, under their own security and SBP controls.

Pakistani government bodies only when legally compelled, by means of a court order, FBR notice, SBP notice, or law-enforcement request lawfully issued under Pakistani law.

We do NOT share data with advertisers, data brokers, or affiliates.

You have the right to access, rectify, restrict processing, object to processing, and erase your personal data. Email dpo@domiraqo.com and we respond within 30 days (most requests are resolved within 5 working days).

You may lodge a complaint with Pakistan's data-protection authority once it is formally designated under the Personal Data Protection Bill; in the interim, complaints may also be made to the Pakistan Telecommunication Authority under PECA for online privacy matters.

You can opt out of marketing communications at any time. Service-critical messages (job updates, OTP, dispute notices) cannot be opted out of while your account is active.

Account data: while your account is active, plus 30 days after closure.

Job records & invoices: 6 years (FBR / income tax record-retention requirement).

Professional CNIC data for deactivated professionals: 1 year after deactivation, then permanently deleted.

In-app call audio: 7 days unless needed for dispute resolution or a regulatory request.

Server logs containing IP addresses: 90 days.

TLS in transit, AES-256 at rest, cloud-provider-managed encryption keys with annual rotation, mandatory two-factor authentication for every staff account, and regular internal and third-party security reviews.

We use a single first-party cookie to remember your language preference. We do not run third-party advertising trackers. Our analytics is a self-hosted Plausible instance that does not use cookies and does not collect any personal data.