Last updated: 30 July 2026. This policy explains how ZILAL processes account and marketplace data. Government identity-document upload is not required for ordinary account use or property posting.
We may process account details such as name, email, optional phone number, city, profile photograph, profile text, preferences, roles, security information, and authentication records; listing and booking information; photographs; messages and reports; device, session, IP-derived security, and diagnostic data; and support communications.
The product does not provide a government identity-document upload flow for ordinary accounts or property posting. Users must not place identity-document images, bank cards, passwords, OTPs, PINs, or other highly sensitive identity or financial information in profiles, listings, posts, stories, chats, reports, or photographs.
Data is used to operate accounts, publish and discover listings, support communication and bookings, provide user controls, secure uploads, prevent abuse, respond to support requests, enforce rules, measure reliability, improve the service, and comply with lawful obligations.
User-facing file-upload controls accept supported photograph formats only. Photographs may be resized, converted, stripped of embedded metadata, validated, moderated, and stored with access controls appropriate to the feature. An external malware scanner may be enabled later, but the current direct-photo mode does not send ordinary photographs to that scanner. A YouTube feature stores and displays a URL rather than uploading video bytes to ZILAL Storage.
Profile names, usernames, profile photographs, selected profile details, public posts, public stories, and active listings may be visible publicly and indexed where appropriate. Private messages, account controls, unpublished listings, internal security signals, and private support information are not intended for public display.
Data may be processed by contracted hosting, database, authentication, email, storage, security, monitoring, search, mapping, and support providers only for authorised service purposes. Information may also be preserved or disclosed when reasonably necessary to comply with law, protect rights and safety, investigate fraud or abuse, or respond to valid legal process.
We retain information only for operational, security, legal, dispute, backup, and fraud-prevention needs. Retention differs by category. Deleted content may remain for a limited period in backups, audit records, security evidence, or legally required preservation. Public media should be removed when the associated content is permanently deleted, subject to these exceptions.
Users can edit profile information, manage visibility choices, remove photographs, control optional contact display, sign out, request support, and use the in-product account-deletion process. Some records may be retained where required for security, legal obligations, dispute handling, or prevention of repeat abuse.
ZILAL uses access controls, row-level security, private staging where appropriate, photograph signature checks, safe image decoding and re-encoding, session safeguards, rate limiting, audit logs, and secret-management controls. Optional malware scanning may be enabled when production infrastructure is configured. No internet service can promise absolute security; users should use a unique password, protect devices, and report suspicious activity promptly.
The service is not intended for children who cannot legally use the relevant services. Do not upload photographs or personal information about another person unless you have a lawful and appropriate basis to do so.
This policy may be updated when product features, providers, or applicable rules change. Material changes should be communicated through the service. Pakistan’s privacy and data-governance framework is evolving; ZILAL should periodically review this policy with qualified Pakistani counsel and update production disclosures when law or enabled providers change.
