Privacy Policy

Last updated: 19 October 2026

This policy explains what personal data Povito collects when you use the Povito website and app as a shopper, why we collect it, who we share it with, how long we keep it and the choices you have. Shops that sell on Povito have their own privacy notice in the seller dashboard.

Who we are

Povito is run by Mesopo Agency, Erbil, Kurdistan Region, Iraq, which is responsible for your personal data. You can reach us about privacy at legal@povito.com.

What we collect

Account and contact details: your mobile number, name, and email address if you give one. Your mobile number is how you sign in.
Delivery details: your addresses, and the map location of your address if you choose to pin it.
Orders: what you ordered, from which shops, the amounts, delivery progress, cancellations, returns and refunds.
Payments: the payment method, the payment provider's references and the payment's status. Card numbers are entered with the payment provider and are never stored by Povito. If you save a card, we keep only the provider's token for it.
Messages and support: your requests to the Povito team, messages about your orders, and reviews or questions you post.
Photos you search with: if you use Search by image, the photo you upload, to find matching products.
Referrals: if you arrive through a creator's link or use a creator's code, which creator referred you, so we can pay them for the sale.
Device and usage: your IP address, device and browser details, and the pages you view and links you click on Povito, to run, secure and improve the service. We also record signals that help us stop fraud and abuse, such as how often a device or number tries something.

What we do not do

We do not sell your personal data.
We do not use advertising trackers or show you ads from other companies.
We do not track you across other companies' apps or websites.

How we use your data

To take and deliver your orders, and to handle cancellations, returns and refunds.
To sign you in and keep your account secure.
To send you messages about your orders and account, by WhatsApp, SMS, email or app notification.
To answer you when you contact us and to settle disagreements with a shop.
To pay shops and creators what they are owed, and to keep our accounts.
To prevent fraud and abuse, and to keep Povito secure.
To understand how Povito is used and make it better.
To meet our legal, tax and accounting obligations.

Who we share it with

The shop that sells to you receives your name, phone number, delivery address and what you ordered, so it can prepare and deliver your order. Shops may use these details only for your order.
Couriers. Where a shop uses a courier arranged by Povito (currently Hi-Express), the courier receives what it needs to deliver your parcel.
Payments: Povito Checkout, Povito's payment service, and the payment provider you choose (NassPay or ZainCash).
Service providers that run Povito for us: Google Cloud, which hosts our systems and data and provides the AI services behind features such as Search by image; Vercel, which serves our website; OTPIQ, which sends sign-in codes and messages by WhatsApp and SMS; WhatsApp (Meta), which carries WhatsApp messages; Resend, which sends our emails; Google Firebase, which delivers app notifications; and OpenStreetMap, which turns a pinned map location into an address (it receives the location, not who you are).
Creators learn that a sale came through their link or code so they can be paid. They do not receive your contact details from Povito.
Authorities, when the law requires it, and professional advisers where needed to protect our rights.

Where your data is kept

Povito's systems and data are hosted by Google Cloud in its Doha, Qatar region. Some service providers listed above, and some Google AI services, process data in other countries. We choose providers that protect the data they handle for us.

How long we keep it

Account details: while your account is open.
Orders, payments and accounting records: up to seven years, as the law and our accounts require, including after an account is closed.
One-time sign-in codes: 24 hours.
Raw messages from payment providers: 90 days.
Other data: only as long as we need it for the purposes above.

Cookies and analytics

The website uses cookies it needs to work: to keep you signed in, keep your basket, remember your language and remember your analytics choice. Povito counts page views and clicks on its own pages with its own tools; there are no third-party advertising cookies. You can turn analytics off from the notice shown on your first visit, and we treat your browser's Global Privacy Control signal as a request to turn it off.

Your choices and rights

See and correct your details: in your account, or by writing to us.
Get a copy of your data: write to legal@povito.com.
Delete your account: write to legal@povito.com from the phone number or email on your account. We delete or anonymise your data, except records we must keep by law, as described above.
Notifications: turn off app notifications in your phone's settings. Messages about an order you placed are part of the service.
Analytics: turn it off at any time, as described above.

We will confirm it is you before acting on a request, and we answer within 30 days.

Security

Everything between your device and Povito travels over encrypted connections. Card details are handled only by the payment providers. Access to personal data inside Povito is limited to staff who need it, and staff actions on accounts are recorded.

Children

Povito is meant for adults. If you are under 18, use Povito only with a parent or guardian.

Changes to this policy

When we change this policy we update this page and the date at the top. For significant changes we also tell you on the site or in the app.