Privacy policy

1. Introduction and who we are

The Chawshin app and website are developed, owned and operated by Chawshin (Chawshin Oil Change & Tyre Shop), an oil change and tyre shop in Erbil, in the Kurdistan Region of Iraq. Chawshin is owned and operated by Ashraf Imad, who also publishes the app on the App Store; the shop’s contact details appear on this page. The shop is responsible for the personal information described in this policy and decides why and how it is used; in data protection terms, the shop — that is, Ashraf Imad as its owner — is the “controller” of that information.

The app lets the shop’s customers follow the services the shop carries out on their vehicles, see oil change and tyre estimates, receive check-up reminders, request on-site service and receive messages from the shop. The shop’s own staff use the same app, signed in with administrator accounts, to run the shop. This policy describes the information involved in all of this, fully and in plain terms.

We have written this policy to match how the app actually works. Where this policy says that we “may” do something, it means that we are permitted to do it under this policy, not that we always do it.

Vehicle makes, logos and model names are trademarks of their respective owners and are used only to identify vehicles. Chawshin is not affiliated with or endorsed by them.

2. Scope of this policy

This policy applies to the Chawshin app for iPhone, to the server that handles the app’s data (app.chawshin.services), to the Chawshin website at chawshin.services (including this page and the support page) and to the services the shop provides through them, such as service history, estimates and reminders, on-site service and messages from the shop.

It does not apply to services of other companies that you choose to open from the app — for example your phone when you call the shop, WhatsApp when you message the shop, or a maps app when you ask for directions. Those services are governed by their own privacy policies. It also does not cover the shop’s ordinary business outside the app, except where information ends up in the shop’s records described in this policy.

This policy is published in Kurdish (Sorani), Arabic and English, and the three versions have the same meaning. If they ever differ, the Kurdish version applies.

3. Definitions

In this policy, the following words have the meanings given below:

App

The Chawshin mobile app for iPhone.

Website

The shop’s public website at chawshin.services, including this policy and the support page. It has no sign-in: customers and the shop’s staff use their accounts only in the app.

Server

The shop’s server at app.chawshin.services, which stores the app’s information and answers the app’s requests. It is used only by the app and is not a public website: it has no pages to visit and no administration pages.

The shop, we, us, our

Chawshin (Chawshin Oil Change & Tyre Shop), the oil change and tyre shop in Erbil owned and operated by Ashraf Imad, which develops, owns and operates the app, the server and the website.

You, customer

A person who uses the app as a customer of the shop, including a person whose account the shop created at their request.

Personal information

Any information that relates to you and identifies you directly or indirectly — for example your name, your mobile number, a plate number linked to your account, or the location of a pin you send.

Processing

Anything done with personal information, such as collecting, recording, storing, using, combining, disclosing or deleting it.

Service records

The shop’s own records of the work it carries out and the products it sells for a vehicle, kept under the vehicle’s plate number.

On-site service

A service, requested through the app, in which the shop comes to where your vehicle is.

Service providers

Companies that provide technical services for the app or process information on the shop’s behalf, such as hosting, notifications and maps.

4. Information you give us

We collect the following information when you enter it in the app, or when you give it to the shop so that the shop enters it for you:

Account information

Your name, your mobile number — which is also your sign-in name — and the password you choose. Your password is never stored as you type it: it is stored only as a one-way bcrypt hash, so nobody, including the shop, can read it.

Accounts created by the shop

The shop creates an account on your behalf only if you ask it to, at the counter. It then enters your name, your mobile number, a first password and, if you wish, your vehicles, which are approved at once. It gives you the sign-in details on its screen, or sends them to your own number by WhatsApp or another app you choose. Please change the password after you first sign in (Account → Change password). You can delete the account yourself in the app at any time (Account → Delete account).

Vehicle information

The plate numbers of the vehicles you add and, if you choose, their make, model, engine and model year.

Mileage readings

The odometer reading you enter for a vehicle, together with the date on which you entered it.

Tyre records

For tyres fitted somewhere other than the shop: the date they were fitted, the odometer reading at fitting (optional) and whether they were new or used.

On-site service requests

The problems you select, the description you write, the vehicle you choose, the pin you place on the map, the landmark or directions you add, and the phone number on which the shop can reach you.

Preferences

Your language, light or dark appearance and digit style.

Your requests to the shop

If you contact the shop about your account, your information or this policy, the shop uses what you tell it to answer you and to carry out your request.

Some information is required: without a name, a mobile number and a password you cannot create an account, and without a plate number the shop cannot show a vehicle’s service history. Everything else — vehicle details, mileage readings, tyre records and on-site requests — is optional and is provided only when you choose to.

5. Information created when you use the app

When you use the app, some information is created automatically by the app and by our server:

Sign-in information

The time of your last sign-in, when each active sign-in started and — updated at most about once an hour — when it was last used. The app also sends a general device label (for example “iPhone app”), not your phone’s personal name, which is stored with the sign-in. Each sign-in is protected by a random security key, of which our server keeps only a one-way hash.

Account and vehicle status

Whether your account and each of your vehicles are waiting for approval, approved or not approved, when the shop reviewed them, and whether your account is active.

On-site request history

The status of each request (sent, accepted, declined, on the way, arrived, completed or cancelled), the time of each step, the estimated arrival time, and the notes or reasons that you or the shop add when accepting, declining or cancelling a request.

The address of a pin

When you send an on-site request, our server looks up the street address of the pin (see “Sharing and service providers”). The address is shown to the shop only.

Notifications list and Offers & news

The time you last opened the list of messages from the shop, so that the app can show which messages are new; and whether and when you turned on “Offers & news”, as the record of your choice.

Notification token

If you allow notifications, the push token that Apple issues for your iPhone (a device identifier), linked to your sign-in. See “Notifications and reminders”.

Estimates and reminder plans

Oil change and tyre life estimates and the plan of your check-up reminders, which our server calculates from your own data each time the app asks for them.

Technical information

Like any internet service, our server receives technical information with each request from the app, such as your network (IP) address, the date and time, and the type of app making the request; the website receives the same kind of information, with the browser used, when you visit it. We use the network address to limit repeated sign-in and sign-up attempts, and our server, the website and our hosting provider may keep logs containing such information for a limited time.

The app does not contain any third-party analytics, crash-reporting or advertising software development kits (SDKs). It does not access your contacts, does not use the camera or photo library on customers’ screens, and does not collect your browsing history or Apple’s advertising identifier (IDFA).

6. Information from the shop’s records

The shop keeps its own service records for the vehicles it serves, under each vehicle’s plate number, as any shop keeps records of its work and sales. These records exist whether or not the vehicle’s owner uses the app. When you add a vehicle in the app and the shop confirms that the vehicle is yours, the app shows you the shop’s service records for that plate. Until the shop confirms the vehicle, its history is not shown; this protects the privacy of other vehicle owners.

The service records shown in the app may include:

• the date of each service and the vehicle’s mileage at that time;
• the mileage at which the next oil change is due;
• the engine oil, gear oil and filters used (for example oil, air, cabin and transmission filters);
• the tyres fitted, with their size, whether they were new or used, the grade of used tyres and their production date (DOT code);
• tyre pressure sensors (TPMS) and other products or services recorded for the vehicle.

Prices, costs, discounts, payment details and the shop’s internal notes are part of the shop’s records but are never shown in the app.

When the shop confirms a vehicle, it also creates or updates its own vehicle record for that plate (for example with the engine you chose), so that the vehicle’s history and future services are kept under the same plate. The shop may also keep its own customer and vehicle records for its daily work, such as a name and telephone number given at the counter.

7. Location information

Your location

The app uses your iPhone’s location only for on-site service. When you open the map to request on-site service, the app centres the map on your current position if you have already allowed location access, and it reads your position when you tap “Use my location”. This happens on your phone: your position is sent to the shop only as the pin you place, and only when you send the request. You can also place the pin by hand without allowing location access at all. For customers, the app asks for location access only “While Using the App”, and it never follows or records a customer’s location in the background. Only the shop’s own account shares its position, while it is on the way to a customer (see “The shop’s position” below).

The pin you send

The precise location of the pin, your landmark note and the street address looked up for it are stored with your request and are visible to the shop so that it can find you. They are kept in your request history until you delete your account.

The shop’s position

While the shop is on its way to you for an active request, the shop’s device shares its live position, and the app shows it to you on the map. This is the shop’s location, not yours. It is shown only to the customer of that request, only while the request is active, and it is deleted as soon as the request ends.

Maps

Map images in the app are downloaded directly from the map provider (OpenFreeMap, with OpenStreetMap data). As with any online service your device connects to, the map provider receives your device’s network (IP) address and the area of the map being displayed, but not your name, mobile number or account.

You can allow or deny location access at any time in your iPhone’s Settings.

8. Notifications and reminders

Push notifications

If you allow notifications, iOS gives the app a push token — an identifier for your iPhone issued by Apple. The app sends it to our server, which links it to your sign-in so that notifications reach the right phone. To deliver a notification, our server sends the token and the text of the notification to Apple’s push notification service. The token is removed from our server when you sign out, and also when Apple reports that it is no longer valid.

Updates about your requests

We use notifications to tell you about your on-site requests — for example when a request is accepted or declined, when the shop is on its way or has arrived, and when the job is completed or cancelled.

Messages from the shop

The shop may send messages to all of its app customers — for example news, opening times, service announcements or the shop’s own offers. These messages are listed in the app’s notifications list, which shows which ones you have not read yet. They arrive as a notification on your phone only if you turn on “Offers & news” (Account → Offers & news): it is off until you turn it on, and you can turn it off there at any time. Either way, the messages stay in the app’s notifications list. They are written by the shop and are never supplied by an advertiser.

Automatic check-up reminders

If you turn them on (Account → Oil, mileage and tyre reminders, or the invitation on the home screen), the app schedules reminders as local notifications on your iPhone: when an oil change is coming up, due or overdue, when it is time to update your mileage, and when it is time to check the tyre pressure, rotate the tyres or replace them. The plan is calculated on our server from your own data — your confirmed vehicles, the shop’s service records for them, your mileage readings and your tyre records — and is then scheduled on your phone, so the reminders appear even when the app is closed. The plan is refreshed when you open the app or update your information.

You can turn check-up reminders off at any time with the same switch in the app, turn off notifications of the shop’s messages with Account → Offers & news, and turn off all notifications from Chawshin in your iPhone’s Settings. Signing out cancels the reminders scheduled on that phone. Messages from the shop remain available in the app’s notifications list even when notifications are turned off.

9. How we use information

We use personal information only for the purposes described below, and we do not use it for a new purpose that is incompatible with them without informing you first.

10. Legal bases and consent

Where the law that applies to you requires a legal basis for processing personal information, we rely on the following:

Providing the service you ask for

Most processing is necessary to provide the app and the services you request: your account, your vehicles and their history, estimates, on-site requests and the related notifications.

Your consent

For location access, push notifications, check-up reminders and promotional notifications (Offers & news) we rely on your consent, which you give through the iOS permission prompts and the switches in the app. You can withdraw it at any time in the app or in your iPhone’s Settings; this does not affect processing that took place before.

Our legitimate interests

For security and fraud prevention, fixing and improving the app, internal statistics, planning our services and the shop’s own marketing to its customers, we rely on our legitimate interests as the operator of the app and the shop, and we make sure that these interests are not overridden by your rights and interests. You may object to this processing (see “Your choices and rights”).

Legal obligations

We keep business and accounting records, and we may disclose information where the law requires it.

By creating an account and using the app, you agree to the processing described in this policy. If you do not agree, please do not use the app; you may delete your account at any time.

11. Sharing and service providers

We share personal information only as described in this section, and each recipient receives only the information it needs for its task. We do not share information with anyone for their own marketing or advertising.

Hosting provider (Namecheap)

The server (app.chawshin.services), its database and the website run on a virtual private server (VPS) that the shop rents from Namecheap, in a data centre in the United States. Namecheap stores and processes the information on the shop’s behalf, only in order to provide the service.

Apple

Apple’s push notification service receives your notification token and the text of each notification in order to deliver it to your iPhone. The notifications that tell the shop’s staff about on-site requests also pass through it and may show the customer’s name and the problems selected. Apple also distributes the app through the App Store, under its own privacy policy.

OpenFreeMap

Provides the map images in the app, made from OpenStreetMap data. Your device downloads them directly (see “Location information”), so OpenFreeMap receives your device’s network (IP) address and the area of the map being displayed. The app uses no account or key with it, and your name and mobile number are never sent.

OpenStreetMap (Nominatim)

Our server sends the coordinates of your pin to OpenStreetMap’s Nominatim service to look up its street address, once per request. Only the coordinates are sent.

Navigation apps

When the shop’s staff choose to navigate to your pin, its coordinates (without your name or number) are opened in Google Maps, Apple Maps or Waze on the shop’s phone, and that provider’s own privacy policy then applies.

Within the shop

Access to customer information is limited to the shop’s administrators, who sign in to the app with administrator accounts and need it to approve accounts, serve your vehicles and handle your requests.

Legal requirements and protection

We may disclose information if the law, a court order or a competent authority requires it, or where this is necessary to protect the rights, property or safety of the shop, its customers or others.

Change of ownership

If the shop’s business is sold or transferred, the information may be transferred to the new owner, who must continue to protect it in accordance with this policy.

Services you open yourself

When you choose to call the shop, message it on WhatsApp or open directions in a maps app, you leave the app, and that service’s own privacy policy applies.

Every service provider that receives personal information from us receives only what its task needs and must protect it at least as well as this policy does.

Apart from these cases, we do not disclose your personal information to anyone.

12. No selling, no third-party advertising, no tracking

To be clear about what we do not do:

• We do not sell, rent or trade your personal information, and we do not give it to anyone in exchange for money or any other benefit.
• We do not show third-party advertising. The only advertising in the app is the shop’s own offers and news.
• We do not use advertising networks, advertising SDKs, or third-party analytics or tracking tools.
• We do not track you: we do not combine information from the app with information from other companies’ apps, websites or offline sources for advertising or advertising measurement, and we do not share it with data brokers. In Apple’s terms the app does not track you, and therefore it does not ask for permission to track.
• We do not use Apple’s advertising identifier (IDFA).
• We do not follow customers’ location: the app reads a customer’s location only on the on-site service map, to help them place the pin. Only the shop’s own account shares its position, while it is on the way to a customer.
• Prices, costs and the shop’s internal notes are never shown to customers in the app.

13. International processing

The shop is based in the Kurdistan Region of Iraq. The app’s server, its database and the website are hosted in the United States, on a virtual private server (VPS) from Namecheap. Our other service providers — Apple (notifications), OpenFreeMap (map images) and OpenStreetMap (addresses and map data) — process the information they receive on servers outside Iraq, for example in the United States, the United Kingdom or the European Union.

The laws of those countries may differ from the laws where you live. We limit what we send to each provider to what it needs — for maps, only coordinates — and we use providers that publish their own privacy commitments. By using the app, you understand that your information may be processed in this way.

14. How long we keep information

We keep personal information only for as long as it is needed for the purposes described in this policy:

Your account and what you enter

Your account information, settings, vehicle list, mileage readings and tyre records are kept for as long as your account exists and are deleted when you delete your account. A vehicle or a tyre record that you remove is deleted at once.

On-site requests

Your requests — including their pins, addresses, notes and contact numbers — are kept in your request history and are deleted together with your account. The shop’s live position is deleted as soon as each request ends.

The shop’s service records

The shop keeps its own service and sales records for the plates it has served — including services carried out on site, and its own customer and vehicle record for each plate — as business and accounting records, also after you delete your account. These records can still contain your name, phone number and plate: every sale names the car by its plate, and when an on-site job is completed, it is recorded as a sale under the car’s plate, and your name and the request’s contact number are copied into the shop’s customer record for that plate. They are kept for the shop’s accounting and are no longer linked to any app account.

Sign-ins and notification tokens

A sign-in ends when you sign out. Customer sign-ins expire after about six months; expired sign-ins are cleared when you sign in again, and all sign-ins are deleted with your account. Notification tokens are removed when you sign out, when Apple reports that they are no longer valid, or when your account is deleted.

Security counters and logs

Counters of failed sign-in and sign-up attempts are kept only in the server’s memory, for at most one hour. Server and hosting logs that may contain network addresses are kept for a limited time for security and troubleshooting, and are then deleted or overwritten.

Backups

The shop makes backup copies of its database to protect against loss. Deleted information may remain in a backup until that backup is replaced in the normal rotation. Backups are kept securely and are used only to restore the system.

Inactive or unapproved accounts

We do not delete accounts automatically just because they are inactive. The shop may delete accounts that were not approved, or that have not been used for a long time.

Where we must keep information for longer because the law requires it, or to establish, exercise or defend legal claims, we keep it only for as long as necessary.

15. How we protect information

We take appropriate technical and organisational measures to protect personal information against loss, misuse and unauthorised access, disclosure, alteration or destruction, including:

• storing the information on the shop’s own server and database; the server (app.chawshin.services) is used only by the app, handles requests only over encrypted connections (HTTPS) and has no public website or administration pages;
• storing passwords only as one-way bcrypt hashes and sign-in keys only as one-way hashes; on your iPhone, the sign-in key is kept in the system’s secure storage (the Keychain);
• temporarily blocking repeated failed sign-in attempts, and repeated sign-ups from the same network address;
• checking access on the server for every request, so that customers can see only their own information and access to customer information is limited to the shop’s administrator;
• showing a vehicle’s service history only after the shop confirms that the vehicle belongs to the account;
• ending the other sign-ins of an account when its password is changed or reset;
• making backup copies of the database and keeping them securely.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password secret and contact the shop immediately if you think someone else has used your account. If a security incident affects your personal information, we will take steps to contain it and will inform you where the law requires it.

16. Cookies and storage on your device

The app stores on your iPhone what it needs to work: your sign-in key (in the Keychain), your settings, whether reminders are turned on, and the reminders it has scheduled. Removing the app from your phone does not delete your account; to delete it, first use Account → Delete account.

The app does not use cookies: it uses its own sign-in key to connect to our server. The website (chawshin.services) has no sign-in and does not use advertising or analytics cookies. It uses only a cookie that remembers the language you choose, and browser storage that remembers for a week that you dismissed the pop-up about the app, so that it does not appear again during that time.

17. The shop’s staff and administrator accounts

The shop’s staff run the shop from the same Chawshin app, signed in with administrator accounts; there is no separate administration website. For these accounts we process the staff member’s name, user name, password (stored only as a bcrypt hash), settings and sign-in times, and, as part of the shop’s records, we record which administrator carried out actions such as sales, purchases, stock changes, approvals and messages sent.

When an administrator drives to a customer for on-site service, the administrator’s device shares its live position — also in the background — only while that request is on the way or has arrived; the position is shown to that customer and deleted when the request ends. If an administrator allows notifications, the app tells them about new on-site requests and about requests that customers cancel: as for customers, the phone’s push token is stored with the sign-in and the notifications are delivered through Apple’s push notification service. An administrator’s phone keeps receiving these notifications for up to 30 days after its sign-in expires, unless the administrator signs out or the password is changed.

On staff screens only, the app may use the camera to scan product barcodes, and the photo library to add product photos or save receipt images. Customers’ screens do not use the camera or the photo library.

18. Your choices and rights

You are in control of your information. In particular, you can:

See and correct your information

See your account details, vehicles, mileage readings, tyre records, service history and on-site requests in the app; change your name, settings and password; update your mileage and tyre records; and remove vehicles. For anything you cannot change in the app — such as your mobile number, the details of a vehicle or an error in a service record — contact the shop.

Delete

Remove a vehicle or a tyre record at any time, or delete your whole account in the app (see “Deleting your account”).

Control notifications

Turn check-up reminders and promotional notifications (Account → Offers & news) on or off in the app, and allow or turn off notifications from Chawshin in your iPhone’s Settings.

Control location

Allow or deny location access; without it you can still place the pin on the map by hand.

Request access, correction or deletion

Ask the shop for a copy of the personal information it holds about you, for its correction or deletion, or for more information about how it is used.

Object and withdraw consent

Object to processing based on our legitimate interests — including the use of your information to choose which of the shop’s offers are relevant to you — and withdraw any consent you have given.

Complain

If you are not satisfied with our answer, you may contact the authority responsible for data protection where you live, if there is one.

To exercise these rights, contact the shop using the contact details on this page. To protect your information, we may ask you to confirm that the request comes from you — for example from the mobile number of the account. We will answer within a reasonable time and within any period that the law requires. Some information may have to be kept even after such a request — for example the shop’s business and accounting records — as explained in “How long we keep information”.

19. Deleting your account

You can delete your account at any time in the app: Account → Delete account. To protect you, the app asks for your password to confirm. Deletion takes effect immediately and cannot be undone.

When you delete your account, we delete your account information (name, mobile number, password hash and settings), your sign-ins, the phones registered for notifications and their notification tokens, your vehicle list with its details, mileage readings and tyre records, and your on-site requests with their pins, addresses, notes and contact numbers. The app then signs out and cancels the reminders scheduled on your phone.

The shop keeps its own service and sales records for the plates it has served, as explained in “How long we keep information”. They are no longer linked to any account, but they can still contain your name, phone number and plate, because every sale names the car by its plate and a completed on-site job copies your name and contact number into the shop’s records of that sale. They are kept for the shop’s accounting. Copies of deleted information may remain in backups until those backups are replaced.

If you cannot use the app, you can ask the shop to delete your account; the shop will do so after confirming that the request comes from you. Removing the app from your phone does not delete your account.

20. Children

The app is intended for vehicle owners and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe that a child under 13 has given us personal information, contact the shop and we will delete it.

21. Changes to this policy

We may update this policy from time to time — for example when we add features, change service providers or when the law changes. We will publish the new version on this page with a new “last updated” date. If a change significantly affects how we use your personal information, we will also inform you in the app or by notification before it takes effect, where reasonably possible. If you continue to use the app after a change takes effect, the updated policy applies to you.

22. Contact us

If you have any question about this policy or your personal information, or you want to exercise your rights, contact Chawshin Oil Change & Tyre Shop:

Owner and operator

Ashraf Imad

Phone and WhatsApp

0750 833 8828 (from outside Iraq: +964 750 833 8828)

Email

support@chawshin.services

The shop’s address and its call and WhatsApp buttons are also below.