Privacy Policy
Effective date: September 2, 2026
Last updated: September 2, 2026
1Who we are
Qamru is operated by Qamru Technologies LLC, a Texas limited liability company (“Qamru”, “we”, “us”).
Qamru is a reverse marketplace: buyers post what they need, vendors bid, and the two sides agree terms in a private Trade Room. We serve buyers and vendors in Pakistan and Malaysia, and buyers internationally.
This policy covers the Qamru app and qamru.com.
Privacy contact: privacy@qamru.com.
2The short version
- We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.
- We do not build advertising profiles about you.
- We cannot read your messages. Chat is end-to-end encrypted; the keys are on your devices, not ours.
- We never see your card number. Payments are taken on our payment providers’ own pages.
- We collect what we need to run a marketplace and settle money, and no more.
The rest of this document is the detail behind those five statements.
3What we collect
You give us:
| Data | Why |
|---|---|
| Name, email, phone number | Account creation, sign-in, security notices |
| Identity and business documents (vendors) | Verifying who is selling; legal and payment-provider requirements |
| Payout details (vendors) | Paying you |
| Requests you post, bids you make | Running the marketplace |
| Files and documents you upload to a Trade Room | Delivering the deal |
| Delivery address, where goods are shipped | Getting the goods to you |
| Support messages | Answering you |
Generated by using Qamru:
| Data | Why |
|---|---|
| Transaction records — amounts, dates, parties, status | Settlement, disputes, tax and accounting records |
| Delivery confirmations and dispute evidence | Deciding disputes and defending chargebacks |
| Message and call metadata — who, when, how long | Delivering messages, abuse prevention, dispute evidence |
| Device and app data — device type, OS version, app version | Making the app work |
| IP address and approximate location | Security, fraud prevention, legal obligations |
We run no third-party analytics, advertising, or crash-reporting services. We do not track you across other apps or websites.
4What we do not collect, and what we cannot see
This section is specific because the general claims elsewhere depend on it.
Message content — we cannot read it. Chat is end-to-end encrypted using the Signal protocol. Our servers relay encrypted envelopes and hold no key that opens them. We can see that a message passed between two accounts and when. We cannot see what it said.
Call content — it does not reach us in readable form. Voice and video calls are peer-to-peer and encrypted device to device (DTLS-SRTP). There is no media server, and calls are never recorded. Where a relay is needed to connect two devices behind restrictive networks, it passes encrypted data it cannot decrypt. Our servers handle only call setup and presence.
One honest distinction: chat carries Signal-protocol guarantees. Calls are encrypted in transit between the two devices, but call key exchange happens over our signalling channel and there is no in-app key verification for calls. We describe chat as end-to-end encrypted and calls as encrypted device to device, and we mean the difference.
Card numbers — we never receive them. Card payments are entered on the payment provider’s own hosted page (Safepay in Pakistan, Stripe internationally). Card data does not pass through Qamru’s systems at any point. Those providers carry PCI DSS responsibility for it.
5Why we use your data, and on what basis
| Purpose | Basis |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Matching requests to vendors, delivering bids and messages | Performance of our contract |
| Taking payment, holding it, settling vendors | Performance of our contract |
| Verifying identity, preventing fraud and abuse | Legal obligation; our legitimate interest in a safe marketplace |
| Deciding disputes and defending chargebacks | Performance of our contract; our legitimate interest in recovering losses |
| Keeping transaction and tax records | Legal obligation |
| Service emails — receipts, disputes, security, changes to terms | Performance of our contract |
| Marketing emails, if any | Your consent, withdrawable at any time |
Where local law requires consent for a purpose, we ask for it, and you can withdraw it.
6Who we share data with
We share only what each recipient needs.
Between users. When a vendor bids and you open a Trade Room, each side sees the other’s name, the request, agreed terms, and whatever they choose to share in that room. Vendors shipping physical goods receive the delivery address. Buyers do not receive vendors’ payout details, and vendors do not receive buyers’ payment details.
Payment providers.
| Provider | Role | Where |
|---|---|---|
| Safepay (Private) Limited | Pakistan Rupee payments; regulated by the State Bank of Pakistan | Pakistan |
| Stripe | International card payments | United States and Ireland |
They receive what they need to take and settle payment, and act as independent controllers for their own compliance purposes under their own privacy policies.
Service providers (processors) who run the platform for us.
| Provider | Role | Where |
|---|---|---|
| Cloudflare | Hosting and content delivery for the Qamru site | Global edge network |
| Render | Application servers, database, and stored files (account, deal and document data) | United States |
| Resend | Sending receipts, invoices and notices by email | United States |
| Twilio; Meta (WhatsApp) | Sending phone verification codes (SMS / WhatsApp) | United States; global |
| Apple (APNs); Google (Firebase Cloud Messaging) | Delivering push notifications, including call rings, to your device | United States |
If Qamru later adds analytics or other processors, we will name them here before they are used.
Professional advisers, where they need it and under confidentiality.
Authorities, where we are legally required to disclose, or where disclosure is necessary to prevent serious harm. We will tell you unless legally prohibited.
A buyer or successor, if Qamru is sold or reorganised. You would be told before your data moved.
We do not sell personal data, and we do not share it for anyone’s advertising.
7Where your data goes
Qamru is a Texas company, and some of our providers sit outside Pakistan and Malaysia — so operating the service means transferring your data internationally, including to the United States.
We require providers who handle personal data for us to protect it under written terms, and where local law requires your consent for such a transfer, we obtain it at sign-up.
8How long we keep it
| Data | Retention | Why this length |
|---|---|---|
| Account data | While your account is open, then 30 days | Lets you change your mind; short enough to be honest |
| Transaction and settlement records | 7 years from the transaction | Tax and accounting record-keeping |
| Dispute evidence and delivery confirmations | 2 years from deal close | Card scheme reversal windows run well past the 120-day refund limit |
| Undelivered encrypted message envelopes | 30 days, then deleted | We cannot read them; there is no reason to keep them longer |
| Delivered message envelopes | Removed from our servers within 24 hours of delivery | Once your device has the message, we have no reason to hold the envelope |
| Support correspondence | 3 years | Complaint and warranty tails |
| Device data and diagnostics | 90 days | Long enough to fix a bug, short enough not to accumulate |
| IP address and security logs | 12 months | Fraud and abuse investigation |
After these periods we delete the data or irreversibly anonymise it. Where a legal hold, open dispute or investigation applies, we keep what it covers until it ends.
9Your rights
Wherever you are, you can:
- Ask what we hold about you and get a copy.
- Correct anything wrong.
- Delete your account and the data we are not legally required to keep. Transaction records generally must stay — we will tell you what remains and why.
- Withdraw consent to anything you consented to, marketing included.
- Object to processing based on our legitimate interests.
- Complain to us, and to your local regulator.
To exercise any of these, contact privacy@qamru.com. We respond within 30 days. We may need to verify your identity first — we will not hand your data to someone claiming to be you.
Deleting your account does not delete a vendor’s copy of what you sent them in a Trade Room, and does not remove records we must keep by law.
10Security
- Chat is end-to-end encrypted; calls are encrypted device to device (see §4).
- Vendor payout details and other sensitive fields are stored encrypted, with the key held outside the database.
- Card data never enters our systems — payments are taken on the provider’s own page.
- Data in transit is protected with TLS, and access to production data is limited to people who need it for their work.
No service is perfectly secure, and we do not claim otherwise.
If a breach happens. We will notify the relevant regulator and affected users where the law requires. In Malaysia that means notifying the Personal Data Protection Commissioner within 72 hours where a breach causes or is likely to cause significant harm or affects more than 1,000 people, and notifying affected users within 7 days of that notification.
11AI features (Qamru AI)
Qamru includes optional AI features: the Qamru AI assistant (answers questions about using Qamru and about vendor catalogs) and an AI category suggestion when you post a request. These features are off until you agree to a clear in-app disclosure, and declining leaves every other part of Qamru working normally.
What is sent, and to whom. When you use Qamru AI, the text of your question (plus the Qamru help articles and vendor-catalog excerpts needed to answer it) is processed by Groq, Inc. (a United States AI infrastructure provider) to generate the reply. When you use the category suggestion, the title and description you typed are sent for classification after contact details (emails, phone numbers) are stripped. Requests reach Groq through Qamru’s own servers — the app never talks to the AI provider directly, and no account data, contacts, private messages, payment details, or phone numbers are included.
Use, retention and protection. This data is used solely to generate the answer or suggestion you asked for. It is not used by Qamru to build advertising profiles and is not sold. Groq processes it as a service provider under its API terms, which do not permit using customer API data to train AI models, providing protection consistent with this policy. You can withdraw consent at any time by simply not using the AI features; the assistant asks again before anything is ever sent after a decline.
12Age
Qamru is for people aged 18 and over. We do not knowingly collect data from children. If we learn an account belongs to someone under 18, we will close it and delete the data we are not required to keep.
13Regional notes
Malaysia. We process personal data in Malaysia subject to the Personal Data Protection Act 2010 as amended. You may request access to and correction of your personal data as set out in §9, and may complain to the Personal Data Protection Commissioner.
Pakistan. Pakistan has no comprehensive data protection statute in force; the Personal Data Protection Bill remains pending. We apply the standards in this policy to Pakistani users regardless, and we comply with the Prevention of Electronic Crimes Act 2016 and the payment rules that reach us through our payment provider.
Everywhere else. Where your local law gives you rights beyond this policy, you keep them. Nothing here removes a right you cannot waive.
14Changes
We will post any change here and update the date at the top. If a change materially affects your rights, we will tell you before it takes effect — by email or in the app — and where the law requires your consent, we will ask for it.
15Contact
Qamru Technologies LLC
Privacy: privacy@qamru.com
Support: support@qamru.com