Privacy Policy

1. Privacy Commitment & Legal Capacity

PyWorks ("We", "Us", or "Our"), operated as a registered Sole Proprietorship under the laws of the Islamic Republic of Pakistan, is committed to safeguarding the privacy and confidential data of merchants, store creators, and visitors.

2. Categories of Information We Collect

To provide our digital catalog builder and hosting platform, we collect the following limited categories of information:

• Merchant Account & Profile Data: Name, business email address, store title, WhatsApp helpline number, social media handles (Instagram, Messenger), physical business location, and authentication credentials.
• Platform Billing & Invoicing Records: Invoice IDs, plan tier names, transaction reference numbers, payment timestamps, and payment statuses. (Payment card credentials are handled exclusively by Safepay and are never stored on PyWorks servers).
• Storefront Order Logs: When a customer places an order on a merchant catalog, our database records order details (buyer name, phone number, shipping address, selected product items, order notes, and tracking IDs) to enable order tracking and fulfillment for the merchant.
• Technical & Telemetry Data: IP addresses, browser user agents, referring URLs, request timestamps, and error logs collected automatically to safeguard edge network integrity and prevent denial-of-service or brute-force attacks.

3. LocalStorage, Cookies & Edge Caching Technologies

PyWorks utilizes modern browser client-side storage technologies rather than intrusive third-party cross-site advertising cookies:

• HTML5 LocalStorage & SessionStorage: Used exclusively to maintain client shopping cart contents across page navigation, store active builder preview states, preserve selected product variants, and remember user interface preferences.
• Service Worker Cache (`sw.js`): Enables offline-ready asset caching (CSS stylesheets, WebP icons, and core JavaScript runtime bundles) to deliver lightning-fast loading speeds across mobile internet networks in Pakistan.
• Zero Advertising Trackers: We do not sell your data or inject third-party programmatic tracking pixels (e.g., ad-exchange trackers) into merchant storefronts.

4. Payment Gateway Security & PCI-DSS Compliance (Safepay)

We enforce rigorous security standards for all subscription billing transactions:

• Direct Redirection / Tokenization: All checkout sessions for plan upgrades and renewals are processed through our partner payment aggregator, Safepay, using encrypted SSL/TLS connections.
• Zero Card Data Retention: PyWorks never collects, sees, stores, or processes credit/debit card numbers, CVVs, card expiry dates, or online banking passwords. Safepay handles all transaction verification under strict Payment Card Industry Data Security Standards (PCI-DSS).

5. Multi-Tenant Database Security & Row-Level Security (RLS)

All merchant stores and customer records reside on our enterprise-grade database infrastructure powered by PostgreSQL and Supabase, secured with:

• Strict Row-Level Security (RLS): Cryptographic and database-level tenancy constraints guarantee that no merchant can access, query, or view the orders, customer data, or analytics of any other store.
• Encryption in Transit & at Rest: All web traffic is encrypted using TLS 1.3, and underlying database volumes and backups are fully encrypted at rest.

6. Sub-processors & Technical Infrastructure Providers

PyWorks collaborates only with industry-leading infrastructure partners strictly necessary to deliver the Services:

• Cloudflare Inc.: Global CDN edge proxy, SSL termination, DDoS protection, and edge server routing.
• Supabase Inc. / PostgreSQL: Secure cloud database storage, authentication, and object storage.
• Safepay (Pvt) Ltd: Licensed payment service provider and payment gateway aggregator.
• Google Cloud (Maps / Places API): Geocoding and map location links for store physical addresses.

7. On-Store "Report Store" Submissions & Regulatory Compliance

In accordance with the Prevention of Electronic Crimes Act, 2016 (PECA) and applicable e-commerce regulations:

• Information submitted through the on-store "Report Store" button (such as reporting party contact, complaint reason, and evidence of counterfeit or fraudulent activity) is retained securely to conduct internal abuse investigations and enforce store eradication.
• PyWorks will cooperate with lawful requests, search warrants, or court orders issued by competent Pakistani law enforcement agencies, the Federal Investigation Agency (FIA), or the Pakistan Telecommunication Authority (PTA) in the investigation of cybercrime, financial fraud, or counterfeit distribution.

8. Account Deletion & Right to Erasure

Merchants maintain absolute ownership of their data:

• You may request complete and permanent deletion of your account, catalog, and order database at any time by contacting support@pyworks.pk or using the store reset controls in your dashboard.
• Upon verified account deletion, all database records, customer logs, media files, and active storefront routes associated with your store are permanently wiped from production systems.

9. Children's Privacy

The platform is designed strictly for business merchants and commercial operators. PyWorks does not knowingly solicit or collect personal information from children under the age of 18. If we discover that an account has been created by a minor without parental consent, we will promptly delete the account.

10. Contact Details & Data Protection Officer

For questions regarding this Privacy Policy, data subject access requests, or privacy concerns, please contact our data privacy desk: