Privacy Policy

This policy explains how Chemical X Corp, which operates Kaprayy, handles information about you when you browse, order or contact us.

It covers what we do with your information. Once a brand receives your delivery details it becomes responsible for them under its own policy as well, and we require every brand to use them only to fulfil your order. Couriers and payment providers are likewise bound by their own obligations.

Account details

Your name, email address, phone number and password. You can browse without any of this; you need it to order.

Delivery addresses

The addresses you save, with any landmark or instruction you add for the rider.

Orders

What you bought, from which brand, what you paid, when it was delivered, and anything you returned or complained about.

Payment information

The method and the last four digits of a card, for your records and ours. We never receive or store the full number — see section 5.

What you write

Reviews you post, and the messages you send us on email or WhatsApp, including any photograph you attach to a claim.

How you use the site

Pages viewed, searches run, filters applied, items saved. This is what makes search and recommendations work.

Device and connection

IP address, browser, device type and approximate city, gathered for security, fraud prevention and diagnosing faults.

We do not collect your CNIC, and we never ask for it. We do not collect information about your health, religion, politics or ethnicity, and we would ask you not to put any of it in a message to us.

• To take your order, take payment for it, and get it delivered.
• To keep you informed — confirmations, dispatch notices, tracking, and delays.
• To handle returns, refunds and complaints, which needs the order history.
• To run the platform: search, size filters, saved items, recommendations.
• To detect and stop fraud, and to protect accounts from takeover.
• To meet our own legal obligations, including tax reporting (section 4).
• To send you marketing, but only if you asked for it (section 7).

We do not sell your personal information. We have never done so and this policy commits us not to.

The brands you buy from

Name, phone, delivery address, and the items in their part of your order. Only the brands you actually ordered from, and only for that order.

Couriers

Name, phone and address, passed on by the brand so a rider can find you. On cash on delivery they are also told the amount to collect.

Payment providers

Licensed processors that take your card or wallet payment. They receive what they need to process it; we receive only the result.

Service providers

Hosting, email delivery, error monitoring and analytics, acting on our instructions and not permitted to use your information for their own purposes.

The Federal Board of Revenue

Since 1 July 2025 the Finance Act 2025 requires online marketplaces to file monthly statements about the vendors on the platform and their turnover. Those statements are about the brands, not about you.

Law enforcement and courts

Where we are lawfully required to disclose. We check that a demand is valid before acting on it, and tell you where we are permitted to.

If the business is ever sold or merged, information may transfer with it. You would be told, and this policy would continue to apply until you were given notice of a replacement.

Your card details go directly to a licensed payment provider. They do not pass through Kaprayy's servers and we do not store them.

What we keep is the type of card, its last four digits and whether the payment succeeded, so you can recognise it on your order and we can process a refund back to the same place.

Refunds always go back to the method you paid with. That is partly a rule of the card schemes and partly the simplest defence against refund fraud.

Necessary

Keep you signed in, hold your bag, and protect the checkout from cross-site request forgery. The site does not work without these.

Preferences

Remember your language and the way you like the catalogue arranged.

Analytics

Aggregate counts of which pages are used and where people give up, so we can fix what is broken.

You can clear or block cookies in your browser. Blocking the necessary ones will stop you from signing in or checking out — that is a consequence of how they work, not a penalty.

We send marketing email only to people who asked for it. Every one has an unsubscribe link that works immediately and does not require you to sign in.

Messages about an order you actually placed — confirmations, dispatch, delivery, refunds — are not marketing. We keep sending those while an order is live, because not sending them would be worse.

• Account details: while your account is open, then up to 12 months after you close it in case you come back or a dispute is still running.
• Orders, invoices and payment records: at least 6 years, because tax and company law require it. This is why closing an account cannot erase your order history.
• Support messages: 3 years.
• Analytics: aggregated, and no longer tied to you, after 26 months.
• Fraud and security records: as long as needed to prevent it happening again.

• Everything is encrypted in transit. Payment pages are handled by providers holding the card industry's own certification.
• Passwords are stored hashed. Nobody at Kaprayy can read yours.
• Access to customer data is restricted to staff who need it, and it is logged.
• We keep no full card numbers, so there are none to lose.

No system is perfectly secure and we will not claim otherwise. If a breach affects your information we will tell you and the relevant authorities promptly, explain what happened, and say what to do about it. Under section 38 of the Prevention of Electronic Crimes Act 2016 we are in any case restrained from disclosing subscriber information except as the law permits.

Kaprayy runs on cloud infrastructure that may store or process data outside Pakistan. Where information leaves the country, we require the provider by contract to hold it to the standards in this policy.

Brands and couriers you order from operate in Pakistan, so your delivery details stay here.

Pakistan has no general data protection statute in force yet, so these are commitments we make to you contractually rather than rights the law currently grants. We honour them regardless.

See it

Ask for a copy of the information we hold about you.

Correct it

Fix anything wrong, from your profile or by asking us.

Delete it

Close your account and have it removed, except records we are required to keep under section 8.

Take it with you

Get your orders and addresses in a machine-readable file.

Stop marketing

Unsubscribe, at any time, with one click.

Object

Ask us to stop a particular use, and we will unless we are required to continue.

Write to [email protected]. We answer within 30 days and do not charge for it.

Kaprayy is not for under-18s. We do not knowingly collect information about children, and if we discover we have, we delete it. A parent or guardian who believes their child has an account should write to us and we will remove it.

As of the date at the top of this page, Pakistan has no comprehensive data protection statute in force. The Personal Data Protection Bill has completed consultation but has not been enacted, and the National Commission for Personal Data Protection it would create is not yet operating.

So the instruments that actually apply to us are the Prevention of Electronic Crimes Act 2016, the Electronic Transactions Ordinance 2002, and the consumer protection legislation of the province you live in. We have written this policy to the standard the Bill would impose, so that when it commences we are already meeting it rather than scrambling.

How your information is used in an order also depends on the Terms of Service, which explain who is selling to you and why the brand needs your address.

We update this policy as the platform and the law change. The date at the top tells you which version you are reading, and we give notice of anything material before it takes effect.

Operator

Chemical X Corp

Privacy queries

[email protected]