In plain words
We collect what we need to connect homeowners with tradespeople and to keep both sides safe: your phone number and name; for homeowners, the job address, pin and photos; for providers, CNIC images, a photo, a police certificate, a utility bill and a reference. We show a homeowner's address and phone to one provider only, at the moment the homeowner accepts, and vice versa. We do not sell your data and we do not show ads. Our servers are in Singapore. We keep verification documents for the life of the provider's account plus a year, complaint records for a year after closure, and payment records for two years, so that we can investigate incidents and answer the authorities. You can ask to see, correct or delete your data by emailing [email protected].
1.1 This Privacy Policy explains how Karighar Home Services (Private) Limited ("KariGhar", "we") collects, uses, stores, shares and protects personal data when you use the KariGhar.pk platform (the "Platform"), receive messages from us, or contact us. It applies to homeowners, providers, people who browse without registering, personal references named by providers, and anyone else whose data reaches us through the Platform.
1.2 Pakistan does not yet have a comprehensive personal data protection statute in force. We handle personal data in line with the Prevention of Electronic Crimes Act 2016 (as amended), the constitutional right to privacy, the principles of the draft Personal Data Protection Bill, and internationally accepted practice. If a data protection law comes into force we will update this Policy to comply with it.
1.3 We process your personal data on the bases set out in Section 5 (Lawful basis). Where we rely on your consent for a particular use — marketing, the upload of verification documents, and the storage of those documents outside Pakistan — we tell you on the screen where you give it, and the time you continued past that screen is our record of it. For everything else, we process your data because it is necessary to provide the service you asked for, because the law requires it, or because we have a legitimate interest in keeping users safe and the Platform secure that does not override your rights.
1.4 Users outside Pakistan. The Platform is offered in Pakistan for homes in Pakistan. If you use it from abroad, we still process your data under this Policy and Pakistani law; we do not target users in other countries and make no commitment under their laws, but you may exercise the rights in Section 10 wherever you are.
2.1 We collect only what the Platform needs to work and to keep users safe. We do not sell personal data. We do not run advertising on the Platform and do not share your data with advertisers. We show a homeowner's contact details to one provider only, and only after the homeowner has chosen that provider. We store verification documents privately and show them only to our own verification staff. We keep data no longer than the periods in Section 8.
3.1 From everyone who registers:
| Data | When and how |
|---|---|
| Mobile phone number | At registration (one-time passcode). This is your account identifier. |
| First name | Providers: at registration. Homeowners: with your first request (optional). |
| City and area | At registration. |
| Language preference | Homeowners: selected on screen and stored at login. |
| Ratings you give and receive, tags, comments | After each job. |
| Complaints you file or that are filed about you, including description and up to three photos | When a complaint is filed. |
| Time of acceptance of the Terms and every request, offer, acceptance, cancellation, arrival, completion and rating | Automatically, as a record of your agreement and your use. |
3.2 From homeowners:
| Data | When and how |
|---|---|
| Job address, sector, landmark and a map pin (GPS point) | With each request. Your last address and pin are saved to pre-fill your next request. |
| Job description, category, tags, timing (ASAP or scheduled) | With each request. |
| Photos of the job | Optional, with each request. |
| Favourite providers | When you save one. |
3.3 From providers:
| Data | When and how |
|---|---|
| Trade, skills, years of experience, tagline, profile text | At registration. Shown publicly. |
| Face photograph | At registration. Shown publicly (small avatar). |
| CNIC number, and images of the front and back of your CNIC | At registration. Private. |
| Police Character Certificate image and its expiry | At registration and on renewal. Private. |
| Utility bill image, and whose name it is in (self, family, landlord, other) | At registration. Private. |
| Home address, area, landmark and a map pin | At registration. Address private; area shown publicly. |
| Personal reference: name, phone number and relationship to you | At registration. Private. See 3.6. |
| Who referred you, and which field agent signed you up | At registration, if applicable. |
| Wallet balance and every wallet transaction; top-up channel, transaction reference, date and payment screenshot | When you top up or a fee, refund or correction is applied. |
| Cancellation count, no-show count, strike and warning count, engagement stage, verification status and admin notes | Generated by your activity and our reviews. |
3.4 Collected automatically: IP address; device and browser type; pages visited and actions taken, with timestamps; delivery status of messages we send; whether a link we sent was used; matching-engine decision logs (which providers were considered for which request and why); and security logs. We use these to run, secure, debug and improve the Platform and to detect fraud and abuse.
3.5 From other users about you: a homeowner's rating, tags and complaints about a provider; a provider's rating, tags and complaints about a homeowner; a homeowner's answer to "did the provider arrive?"; a provider's answer about a homeowner's conduct.
3.6 Personal references. A provider gives us the name, phone number and relationship of one person who can vouch for them. We may call that person to confirm what the provider told us. We use their details for that purpose only and keep them with the provider's verification record. The provider is responsible for having that person's agreement. When our field team or verification desk calls a reference we tell them who named them, that we hold their name and number for that purpose only, and that they can ask us to remove their details. If you have been named as a reference and object, email [email protected] and we will delete your details.
3.7 What we do not collect: passwords (we use one-time passcodes); card numbers or bank credentials (you pay into our account, we never take payment details from you); your contacts, location in the background, or any data from your device beyond what the browser sends; and the price you and the provider agree for the work.
4.1 To run the Platform: identify you, log you in, create and route requests, invite providers, show offers, create leads, release contact details at the Reveal, track arrival and completion, apply ratings and blocks, apply cancellation and no-show rules, run the wallet and verify top-ups, and send you the messages the Platform requires.
4.2 To verify providers: review documents, record the CNIC number, check it against our block list, contact the reference, and manage certificate renewal.
4.3 To keep people safe and resolve complaints: investigate complaints and incidents, apply warnings, suspensions and removals, maintain the block list, detect patterns such as repeated estimate disputes or cancellations, and respond to the police and courts.
4.4 To detect and prevent fraud and abuse: duplicate accounts, circumvention, payment fraud, scraping, and misuse of contact details.
4.5 To improve the Platform: analyse how it is used, tune matching, fix errors, and develop new features, using aggregated or de-identified data wherever possible.
4.6 To comply with law: tax, accounting, regulatory and legal obligations, and lawful requests from authorities.
4.7 To send marketing, only if you opt in. We will tell you how to opt out in every marketing message, and opting out does not stop the service messages the Platform needs to send.
| Use | Data involved | Lawful basis |
|---|---|---|
| Account, log-in and one-time passcodes | Phone number, passcode, session cookies | Necessary to provide the service you asked for (contract) |
| Requests, matching, offers, leads, the Reveal, arrival and completion tracking | Name, address, pin, job details, photos, timing, provider profile | Necessary to provide the service (contract) |
| Provider verification documents (CNIC images and number, photo, police certificate, utility bill) | Documents listed in 3.3 | Your consent, given by uploading after the notice on the upload screen; and our legitimate interest in the safety of homeowners |
| Contacting a personal reference | Reference name, phone, relationship | Legitimate interest (verification); the reference is informed and may opt out |
| Block list of rejected and removed providers | CNIC number, outcome | Legitimate interest (safety of users and the Platform) |
| Wallet, top-ups and payment records | Balance, transactions, payment reference, screenshot | Necessary to provide the service (contract); legal obligation (tax and accounting records) |
| Ratings, no-show answers, cancellation and no-show counts | Ratings, tags, counts | Necessary to provide the service (contract); legitimate interest (quality and safety) |
| Complaints and investigations | Complaint text, photos, admin notes, outcomes | Necessary to provide the service (contract); legitimate interest (safety, fraud prevention) |
| Security logs, fraud and abuse detection | IP, device, timestamps, action logs | Legitimate interest (security and integrity of the Platform) |
| Service messages (SMS, in-app) | Phone number, message content | Necessary to provide the service (contract) |
| Marketing messages | Phone number | Your consent, which you may withdraw at any time |
| Storage on servers outside Pakistan | All data | Necessary to provide the service (contract); your explicit consent for verification documents |
| Disclosure to police, courts and regulators | Data relevant to the request | Legal obligation; legitimate interest in preventing crime and protecting people |
| Improving the Platform | Aggregated or de-identified usage data | Legitimate interest (service improvement), using anonymised data wherever possible |
6.1 With other users, only as the Platform requires: a homeowner's first name, area, job description, photos and timing are shown to the providers invited to that request; the homeowner's address, landmark and phone number are shown only to the one provider whose offer the homeowner accepts, at the Reveal, and the provider's phone number is shown to that homeowner at the same moment; a provider's name, photo, trade, rating, experience, tagline, profile text and area are shown publicly on the Platform; ratings and tags are shown to other users; the identity of a person who gives a 1- or 2-star rating is not shown to the person rated. Users who receive another user's data may use it only for the job it was released for.
6.2 With service providers who process data for us, under contract and only for the purpose we specify: cloud hosting and database services (currently DigitalOcean, Singapore region); private file storage for documents and photos (currently DigitalOcean Spaces); an SMS gateway in Pakistan for delivering messages to your phone (currently Jazz CMT), which receives your phone number and the message text; a mapping and geocoding service (currently Google Maps), which receives the address or pin you enter in order to place it on a map and check it is inside our service area; and, if we introduce WhatsApp messaging in future, Meta Platforms, which would receive your phone number and the message text. Each of these providers is bound by its published data-processing terms and processes your data only on our instructions.
6.3 With our own staff and contractors, on a need-to-know basis. Our verification, support and operations team see provider documents and complaint details. Our field agents see only the sign-up data for the providers they recruit. Our executive sees the whole platform: every service request and the offers on it, every homeowner and provider record with their activity and ratings, platform payment and wallet totals, the record of actions our staff take, and — unlike other staff, who see them masked — customers' full phone numbers. That access exists so that one accountable person can resolve a dispute, trace a payment or answer a lawful request; it is not used for anything else.
6.4 With the police, courts, regulators and other authorities where the law requires it or where we receive a Lawful Request (as defined in the Terms of Service). In an incident involving theft, damage, injury, threats or harassment we will provide the identity and verification details of the account involved to the police or a court on a Lawful Request. Outside a Lawful Request we disclose personal data to the authorities only where we reasonably believe there is an imminent risk to someone's life or physical safety, and then only the minimum needed. We do not give one user's data or documents directly to another user.
6.5 With a buyer or successor if our business is sold, merged or reorganised, in which case the new owner will be bound by this Policy.
6.6 We do not sell personal data, do not share it with advertisers, and do not share it with any other third party except as described above.
7.1 Our servers, database and file storage are located in Singapore, operated by DigitalOcean. Your data is therefore transferred to and stored outside Pakistan. SMS messages are delivered through a gateway in Pakistan. Map look-ups are processed by Google, which may process them outside Pakistan. By using the Platform you agree to these transfers, and providers agree to the storage of their verification documents outside Pakistan by uploading them after the notice on the upload screen. We choose providers that apply recognised security standards, our hosting provider encrypts stored data at rest, and we protect data in transit with encryption.
| Data | Retention |
|---|---|
| Provider verification documents (CNIC images, photo, police certificate, utility bill) | Life of the account, plus 12 months after removal or closure, to support the block list and any investigation. |
| CNIC number of a provider removed, or rejected for a forged, borrowed or mismatched document or on safety grounds (block list) | 10 years from listing, reviewed every 2 years; a listing for fraud, violence, theft or a safety incident may be renewed for a further 10 years on executive decision. A rejection for document quality is not listed. |
| Complaint descriptions and photos | Life of the complaint, plus 12 months after resolution, for pattern detection and audit. |
| Wallet ledger, payment records and top-up screenshots | Life of the record, plus 24 months, for reconciliation, tax and regulatory audit. |
| Admin notes | Life of the record they relate to. |
| Phone number, name, address and profile | Life of the account. |
| Ratings, tags, cancellation and no-show counts | Life of the account. |
| Job requests, offers, leads and messages | Life of the account, plus a reasonable period for dispute resolution. |
| Staff action log (which member of staff did what, when, and on which record) | Life of the record it concerns, plus 24 months. This is an accountability record, not an automatic log: the row below does not cover it, and entries are never edited or deleted within that period. |
| Automatic logs (technical and security logs generated by our systems) | For the period our hosting and messaging providers keep them, and no longer than we need them for security. |
8.1 When a period ends we delete or irreversibly anonymise the data. Anonymised statistics may be kept indefinitely. Where the law requires a longer period, we keep the data for that period. We review records against these periods periodically.
9.1 All traffic to and from the Platform is encrypted (HTTPS). Sessions use secure, HttpOnly cookies. Documents and photos are stored in private storage that is encrypted at rest and are never publicly accessible; our staff view them through time-limited signed links. Contact details are hidden from all users until the Reveal. Action links in messages are signed, tied to one job and one person, and expire. The wallet ledger is append-only and reconciled daily. Access to admin tools is limited to named staff. We are building a staff action log that records what each of them does; until it is in service, admin access is controlled by named accounts rather than by a per-action record. Free-text fields are scanned to stop contact details being shared early.
9.2 No system is perfectly secure. We cannot guarantee that your data will never be accessed without authorisation. If we become aware of a security breach affecting your personal data that is likely to cause you harm, we will notify you without undue delay and in any event within 7 days of becoming aware of it, and will notify any authority within the period the law requires. Our notice will describe what happened, what data was affected, and what we are doing about it.
9.3 You help protect your data by keeping your phone secure, never sharing a passcode or link, and reporting any suspicious message claiming to be from KariGhar.
10.1 You may ask us, by email to [email protected] from your registered number or with proof of identity: to tell you what personal data we hold about you; to correct data that is wrong; to delete your account and data, subject to the retention periods in Section 8 and to any open job, complaint or debt; to receive a copy of the data you gave us in a common electronic format; to object to a particular use of your data, in which case we will stop unless we have a compelling reason to continue; to stop marketing messages; or to explain a decision we made about you.
10.2 To protect your data we will verify a request by sending a passcode to your registered number before acting on it, and we keep a log of every request and what we did. We will respond within 30 days. We may refuse or limit a request where the law requires us to keep the data, where it would reveal another user's data, where it relates to a block-list record, or where the request is unfounded or repetitive. We will tell you why.
10.3 Some data cannot be changed by you directly at present (for example, your name or phone number); ask Support.
10.4 Service messages (about your requests, jobs, ratings, wallet and account) cannot be switched off while your account is active, because the Platform cannot work without them.
10.5 When your account is deleted, ratings, tags and complaint outcomes you gave remain on the other user's record in anonymised form, because they are part of that user's history; your name and number are removed from them.
11.1 The Platform uses only the cookies needed to keep you logged in (secure session cookies) and to remember your language and draft request while you use the site. We do not use advertising cookies or third-party tracking cookies. Screens that show a map load Google Maps, which may set its own cookies under Google's privacy policy. If we add analytics cookies in future we will update this Policy and, where required, ask your consent.
12.1 The Platform is for adults. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it and close the account.
13.1 We may update this Policy. The version number and effective date at the top will change, and for a change that materially affects how we use your data we will notify you by SMS or in-app message before it takes effect. Continued use after that is your acceptance.
14.1 Karighar Home Services (Private) Limited, Floor 02, Innovista Technology Zone, DHA Commercial Broadway, Phase 8, Lahore, Pakistan. Email: [email protected] (write "Privacy" in the subject line for data requests; this address is our data-protection contact).
Opens all 14 sections on this page
Privacy Policy · Version 0.6 · Effective from publication