Privacy Policy

Mazad is a premier online auction marketplace for electronics, vehicles, property, and general goods, operated from Iraq and the Kurdistan Region and accessible at https://user.mazad.bid. This privacy policy applies to the Mazad website as well as our official iOS and Android mobile applications.

• Account details — name, email address, phone number, and authentication tokens from your selected sign-in provider (Email, Google, or Apple).
• Profile & shipping details — city, governorate, and delivery address provided so won lots can be dispatched directly to your location.
• Bidding & transaction history — the lots you view, watchlist items, bids placed, winning lots, orders, payment confirmations, and delivery timeline statuses.
• Identity verification (KYC) — government-issued ID card or passport images, collected only if you choose to verify your profile for higher bidding limits.
• Mobile permissions & device data:
  • Location: accessed only while using the app when you tap to detect your delivery address. We never track background location.
  • Camera & Photo Library: accessed only with your consent when uploading ID documents for verification or setting a profile photo.
  • Push Notifications: device notification tokens used solely to send urgent auction alerts (outbid, winning, countdown ending).

• Facilitate real-time auctions: accept bids, increment counters, declare winners, and generate orders.
• Send real-time alerts you have opted into — outbid warnings, lot ending alerts, and fulfillment updates.
• Prevent fraud, shill bidding, impersonation, and payment abuse.
• Process payments, refunds, returns, and seller payouts.
• Comply with applicable legal, tax, and accounting standards.

We do not sell, rent, or trade your personal data with third-party advertisers or data brokers.

We share data strictly on a need-to-know basis with trusted infrastructure partners: our cloud hosting and Supabase database, Firebase Cloud Messaging for instant push notifications, and secure payment processors. Sellers only receive the delivery details required to ship won lots. We may disclose records when required by law or judicial process.

Active profile and account data is maintained for the life of your account. Completed auction records, bids, and receipts are retained in anonymised form to fulfill commercial accounting requirements. Identity documents submitted for KYC are automatically deleted upon account deletion.

You can delete your account at any time directly inside the app:

In the Mazad mobile app: open Profile, tap Delete my account, type DELETE and confirm. Full steps: https://user.mazad.bid/delete-account.

Deletion is immediate: your sign-in is removed and the account cannot be used or restored. We keep a private copy of your name, email, phone number and delivery address, and your orders keep your name, because we need them to complete deliveries, payments and returns and for our accounting and legal records. Only Mazad staff can see this copy. If you cannot access your device, email [email protected] and your account will be deleted within 48 hours.

You may request a copy of your data, correct it, restrict how it is used, or object to processing. Contact [email protected] and we will respond within 30 days.

Mazad is not intended for anyone under 18. We do not knowingly collect data from children; if we learn that we have, we delete it.

Data is transmitted over encrypted connections and stored with access rules that limit each account to its own records. Identity documents are held in private storage reachable only by reviewers.

We will update this page when our practices change and revise the date above. Questions or requests: [email protected].