Privacy Policy

1. Who we are

Nano Technologies (“Nano”, “we”, “us”) operates the Nano app and website and is the controller of the personal data described in this policy. You can reach us at [email protected] or at Nano Technologies, Erbil, Kurdistan Region, Iraq.

Independent partners — restaurants, market sellers, shops, event vendors and couriers — process some of your data for the purpose of fulfilling your order. Where they decide independently how to use it, they act as their own controllers and their own privacy notices apply.

2. What we collect

Data you give us

• Account data: phone number, name, email address, profile photo if you add one, and language and appearance preferences.
• Order data: delivery addresses, order contents, notes to the partner or courier, recipient details for Nano Express, and celebration booking details.
• Payment data: the payment method you choose and the transaction result. Card numbers are entered directly with certified payment providers; Nano does not store your full card number.
• Support data: the messages, photos and order references you send when you contact support.
• Partner and courier data: business registration documents, identity documents, vehicle details and payout details where you join Nano as a seller or courier.

Data collected automatically

• Location data: used to show what is deliverable to you, to place a pickup pin and to track an active delivery. Background or precise location is requested only for features that need it, and only with your permission, which you can withdraw in your device settings at any time.
• Device and technical data: device model, operating system, app version, language, crash reports, IP address and approximate region derived from it.
• Usage data: screens opened, searches, items viewed and orders placed, used to operate and improve the service.
• Cookies and similar technologies on the website — see our Cookie Policy.

3. Why we use it, and on what legal basis

• To perform our contract with you: creating your account, taking and delivering orders, processing payments and refunds, and providing support.
• For our legitimate interests: keeping the platform secure, preventing fraud and abuse, verifying partners and couriers, measuring and improving service quality, and defending legal claims.
• With your consent: location permissions, push notifications, marketing messages, and non-essential cookies. You can withdraw consent at any time without affecting processing already carried out.
• To comply with legal obligations: tax and accounting records, consumer-protection requirements and lawful requests from authorities.

We do not sell your personal data, and we do not use it for automated decisions producing legal effects about you.

4. Who we share it with

• Partners fulfilling your order — the restaurant, seller or vendor receives the order contents and the details needed to prepare it.
• Couriers — receive your first name, delivery address, the delivery note and a masked contact channel, for the duration of the delivery only.
• Payment providers — certified processors that handle card authorisation, refunds and chargebacks.
• Service providers — hosting, maps and routing, messaging, analytics, crash reporting and customer-support tooling, all bound by contract to process data only on our instructions.
• Authorities — where disclosure is required by law or necessary to establish, exercise or defend legal claims.
• Business transfers — if Nano is involved in a merger or acquisition, data may transfer under the same protections, and we will notify you.

5. International transfers

Some of our providers process data outside your country. Where that happens, we rely on an adequacy decision or on standard contractual clauses together with technical safeguards such as encryption in transit and at rest.

6. How long we keep it

• Account data: while your account exists. After you ask us to delete it, the account is closed immediately and the data is erased or anonymised 30 days later — the window in which you can still change your mind.
• Order and transaction records: for the retention period required by tax and accounting law, typically up to ten years.
• Support conversations: up to three years after the case closes.
• Precise location traces of a delivery: kept only as long as needed to resolve disputes about that delivery.
• Marketing consents: until you withdraw them, plus a record that you did.

7. How we protect it

Traffic is encrypted in transit, sign-in tokens are stored in protected device storage (Keychain on iOS, Keystore-backed storage on Android), access to production data is restricted and logged, and we run reviews before releases. No system is perfectly secure, so we also maintain an incident process and will notify you and the relevant authority where a breach is likely to affect your rights.

8. Your rights

You have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is inaccurate or incomplete;
• delete your data where we have no overriding legal basis to keep it;
• restrict or object to certain processing, including profiling for marketing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time;
• lodge a complaint with your data-protection authority.

Exercise any of these from your profile in the app, or write to [email protected]. We respond within one month and may ask you to confirm your identity first.

Deleting your account

You can start the deletion yourself, without writing to anyone: Delete your account verifies the phone number on the account by SMS, asks why you are leaving, and closes the account straight away. Your personal data is erased 30 days later; until then you can return to the same page and keep the account. The records listed under “How long we keep it” survive the erasure because the law requires them, and are anonymised where they no longer need to identify you.

The reason you give is stored with the request and used to understand why people leave and to improve the service — never to advertise to you afterwards.

9. Children

Nano is not directed at children under 16, and we do not knowingly create accounts for them. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We update this policy when our processing changes. The effective date above always reflects the current version, and material changes are announced in the app before they take effect.

11. Contact

Privacy questions and requests: [email protected]. Postal address: Nano Technologies, Erbil, Kurdistan Region, Iraq.