ޕްރައިވެސީ ސިޔާސަތު

1. Introduction

iruali ("we", "us", "our") operates the iruali online marketplace. This Privacy Policy explains how we collect, use and protect your personal information when you use our website and services.

2. Information we collect

• Name, email address and mobile number: to create your account, sign you in and contact you about your orders.
• Password: stored only in hashed (scrambled) form; we cannot read it.
• Google, Facebook or Apple sign-in: if you choose to sign in with one of them, we receive your name, email address and an account ID from it, and nothing else (no posts, contacts or passwords). You can disconnect it in My Account.
• Delivery address and island: to deliver your orders.
• Order history: to show your orders, give loyalty points and handle returns.
• Payment information: the payment method, amount, and the transaction reference and status sent to us by Bank of Maldives. We never receive or store your card number, expiry date or security code.
• Reviews and questions you post, with your name.
• Sellers: business name, contact person, island and the details in the seller application.
• Technical information: IP address, browser type and pages visited, in our server logs.

3. How we use your information

• Process, deliver and support your orders, cancellations, returns and refunds
• Send one-time codes for secure sign-in and two-step verification
• Send order confirmations, delivery updates and receipts by email or SMS
• Run loyalty points, referrals, your wishlist, cart and saved items
• Provide customer support and prevent fraud
• Send our newsletter and offers, only if you subscribed
• Improve our website and meet legal and accounting obligations

4. SMS and email communications

By giving us your mobile number and email address, you agree to receive:

• one-time verification codes (needed to verify and secure your account);
• order confirmations, status updates and receipts;
• our newsletter and offers, only if you subscribed.

Opt out: to stop the newsletter or offers, use the unsubscribe link in any newsletter or contact us using the details above. Order and security messages are part of the service and continue while you have an account.

5. Card payment security

All card payments are processed exclusively on Bank of Maldives' (BML) secure payment page. iruali does not store, view, process or retain any card details (card number, CVV, expiry) on its servers. Card data is handled entirely by BML using SSL/TLS encryption. See Payment Security.

We strongly recommend you keep a copy of your order confirmation and payment receipt for your records.

6. Data security

We use industry-standard measures to protect your personal data against unauthorised access:

• encrypted data transmission (HTTPS / TLS) on every page;
• hashed passwords and optional two-step sign-in;
• role-based access for staff; each seller sees only the orders for their own shop;
• photos you add to a return request stored outside the public website, shown only to you, the shop and our administrators;
• every payment result checked directly with Bank of Maldives, never trusted from the browser;
• regular reviews of access and security.

7. Data sharing

We do not sell or rent your personal information. We share it only with:

• The shop you buy from: your name, phone, delivery address and what you ordered, to prepare and deliver it;
• Bank of Maldives (BML): to process card payments and refunds;
• Delivery partners: your name, phone and address for delivery;
• Our SMS and email providers: your phone number or email address, only to deliver messages;
• Authorities: when required by Maldivian law.

Product videos are hosted by YouTube, TikTok, Instagram or Facebook. Nothing is loaded from them until you press play on a video; the video site then receives your IP address and browser details under its own privacy policy.

8. Cookies

We use only the cookies needed for the website to work: keeping you signed in, your cart, your language, and items you recently viewed or are comparing. We do not use advertising cookies.

9. Data retention

Order and payment records are kept for at least 5 years to meet accounting and tax rules. Other information is kept while your account is open. If you ask us to delete your account, we delete or anonymise your information except records we must keep by law.

10. Your rights

• Access your personal data (see My Account)
• Request correction or deletion of your data
• Opt out of the newsletter and offers

11. Contact

For any privacy question or request, use the contact details at the top of this page or on About & Contact. We may update this policy; the latest version is always on this page.