Privacy Policy

We only collect data needed to operate a regulated recharge and credit service:

• Account data: full name, email address, mobile phone number, account role (owner, wholesaler, customer) and account status.
• Authentication data: encrypted password credentials and a hashed transaction PIN. We never store your PIN or password in readable form.
• Transaction data: mobile recharge orders (destination phone number, mobile operator, amount, status) and credit ledger movements between accounts.
• Device and session data: device identifier, app version, IP address and sign-in timestamps, used to secure your account and detect fraud.
• Support data: messages and notifications exchanged with your wholesaler or with our operations team.

We do not collect contacts, photos, precise location, advertising identifiers, or health data, and we do not use tracking for advertising purposes.

• To create and manage your account and verify who you are when you sign in.
• To process mobile recharges and to record credit transfers accurately in the ledger.
• To prevent fraud, unauthorised credit transfers and abuse, including device binding and PIN verification.
• To provide support, notifications and receipts about your transactions.
• To meet legal, accounting and record-keeping obligations.

We process your data to perform the service contract you enter into when you register, to comply with legal obligations, and for our legitimate interest in keeping the platform secure. Where consent is required, you may withdraw it by closing your account.

We do not sell personal data. We share it only in these cases:

• Mobile network operators, to deliver the top-up you request to the destination number.
• The wholesaler or account owner above you in the account hierarchy, who can see your transactions and credit balance for reconciliation.
• Infrastructure providers that host our database, authentication and application servers under contractual confidentiality obligations.
• Competent authorities where disclosure is required by law.

Data is stored in a managed PostgreSQL database with row-level access rules so each account can only reach its own records and those of accounts it directly supervises. Traffic is encrypted in transit, passwords and transaction PINs are stored hashed, and sensitive operations (credit transfers, status changes) are recorded in an immutable audit log.

Transaction and ledger records are retained for as long as required for financial record-keeping and dispute resolution. Account and session data are kept while your account is active and for a reasonable period afterwards to complete reconciliation.

You may request access to your personal data, correction of inaccurate details, deletion of your account, or a copy of your transaction history. Contact us at the address below and we will respond within 30 days. Some records must be kept where the law requires it.

Quraishy Pay is not intended for children under 18. We do not knowingly create accounts for minors, and we delete such accounts when identified.

We may update this policy as the service evolves. Material changes will be announced in the app and the "last updated" date above will change.

Questions or privacy requests: support@quraishy.app. Postal contact: Quraishy Pay, Kabul, Afghanistan.