1. Who we are and what this policy covers

Yimken (يمكن) is the service this policy covers: a digital intermediation platform connecting vehicle owners in the Republic of Iraq with spare-part companies, workshops, vehicle-service providers and crane drivers, through the Yimken mobile app and this website.

This policy applies to every role in the app: customer, company, workshop and service provider, and crane driver. It explains what information we collect, why, who we share it with, how long we keep it, and what your rights are.

2. Information we collect

We collect only the following categories, and only to the extent needed to operate the service:

Profile and contact information — your name, an optional email address, and for companies and workshops the business name and its contact details.
Phone number and authentication information — your phone number is the primary sign-in identifier and contact channel. We use it to send a one-time verification code (OTP) confirming the number is yours, and we store a session token on your device to keep you signed in. We do not retain your password in readable form.
Vehicle and address information — your saved vehicle details, saved delivery addresses, and the pickup point and destination you select on the map when requesting a crane.
Orders, workshop requests, crane requests and support correspondence — your order history with companies, your bookings and services with workshops, maintenance reminders, crane requests and their status, and whatever you send us when you contact support.
Device notification tokens — when you sign in we register a push notification token for your device so we can deliver operational notifications about your orders, trips and account. The token is deleted from our servers when you sign out.
Images and documents you voluntarily upload — a product image uploaded by a company, an incident photo attached by a customer, or vehicle documents uploaded by a crane driver. No file is uploaded unless you choose it.
Basic technical and security logs — when the app connects to our servers, standard technical data such as the time and type of the request, the response code and basic connection information is logged, and is used to run the service, diagnose faults and prevent abuse.

We do not request or collect payment card data, because the app does not currently process electronic payments inside it.

3. Purposes of processing

We use the information above for the following purposes only:

Operating the service — showing parts and services, fulfilling orders, bookings and crane trips, and calculating what is due between parties.
Creating and securing your account — verifying your phone number, keeping your session active, and preventing unauthorized access.
Communicating with you — operational notifications about your orders, trips and account, and responding to your support enquiries.
Protecting the platform — detecting fraud, impersonation and rating manipulation, and handling reports.
Accounting and legal obligations — keeping the records that transactions require.

We do not use your data for third-party targeted advertising, and we do not build advertising profiles about you.

4. Basis for processing

We process your data to deliver the service you requested, to meet applicable legal requirements, and for the legitimate interest of operating the platform and protecting it from abuse. Where processing is optional — such as uploading an image or using your current location — it happens because you chose it.

5. Device permissions

Location — requested only to place a crane point on the map when you tap "my current location". There is no continuous background tracking.
Photo library and camera — requested only when you choose an image for a product, an attachment or a document.
Notifications — requested in order to deliver the operational notifications about your orders, trips and account.

We do not request permissions the app does not actually use, and you can withdraw any permission from your phone's system settings at any time.

6. Service providers and infrastructure

We rely on a small number of technical service providers to run the platform. They are described here at a general level, without internal technical detail:

Server hosting — Yimken's servers run with a commercial hosting provider, and hold the account and order data needed to operate the service.
Notification delivery — we use Google's Firebase Cloud Messaging to deliver notifications to your device. The service receives the device notification token and the content of the notification sent.
Maps — we display OpenStreetMap maps and use the Nominatim service to turn coordinates into a readable address.
WhatsApp — used to deliver the verification code and as the support channel. When you open a support chat, WhatsApp's own privacy policy applies to that conversation.

We currently use no payment gateways, no third-party analytics and no advertising networks.

8. We do not sell your data

We do not sell, rent or trade your personal data. Nor do we share it with third parties for their own marketing purposes.

9. Retention

We keep your account data for as long as the account exists.
Your device notification token is deleted from our servers when you sign out.
Transactional records (orders, crane trips, commissions and settlements) may be retained in anonymized form after account deletion, for accounting or legal purposes.
Technical and security logs are kept for a short period sufficient to operate the service, diagnose faults and prevent abuse.

10. Security

All connections between the app and our servers use an encrypted connection (HTTPS). The app also enforces permission rules that stop one role from reaching another role's data, and stop any user from reaching another user's data.

We prefer candour to overstatement: we do not claim end-to-end encryption, compliance certifications or dedicated data centres, because those systems are not implemented. No technical measure can guarantee absolute security.

11. Your rights

Access — you can see your profile data, vehicles, addresses and orders inside the app.
Correction — you can edit your data directly in the app, or request correction through support.
Deletion — you can delete your account and personal data. See the user data deletion instructions.
Objection — you can withdraw device permissions at any time, and adjust non-operational notification preferences inside the app.

Notifications about your orders, trips and account always reach you, because they are operational and necessary to deliver the service.

12. Account and data deletion

You can delete your account from account settings inside the app. Deletion removes your personal profile data, addresses, vehicles, preferences, favorites and follows, and deletes your device notification token.

Deletion may be temporarily blocked by an outstanding obligation — such as an active crane trip or unpaid dues — and the reason is shown to you in the app. Financial and operational records required by law are retained in anonymized form.

Full step-by-step instructions are on the user data deletion page.

13. Children

The app is intended for people with the legal capacity to enter contracts in Iraq and is not directed at children. If an account is found to belong to a child below that age, it will be closed and its data deleted.

14. Changes to this policy

We may update this policy when the service or legal requirements change. The version number and effective date are published at the top of this page, and the version published here is the one in force.

15. Contacting us

For any privacy question, or to exercise any of your rights, contact us through the official support channel on WhatsApp: +964 783 353 7823. See also the contact page.

Privacy Policy