Privacy Policy

Effective date: 15 May 2026
Last updated: 18 July 2026

This policy explains what Pyro Business ("the Service"), operated by Pyro for Agency & Commission Trade Co. in Kuwait, collects, why, and what choices you have. The Service is used by shops and their staff to run invoicing, point-of-sale, repairs, store management, and deliveries; it is not aimed at the general public.

Who this covers

Vendors and their team - the businesses and staff who sign in to use the Service.
Customers of vendors - the individuals a vendor sells to, buys from, or repairs for, whose details a vendor records on an invoice, repair, or delivery.
Carrier companies and their drivers - the delivery businesses that fulfil deliveries on the platform.

You, the vendor, decide what customer information to collect and are responsible for obtaining your customers' consent. Pyro stores and processes that information on your behalf to provide the Service.

What we collect

About your business and team:

Business name, trade name (English and Arabic), and business category.
Owner and staff names, email addresses, and phone numbers.
Your shop logo, signature, invoice branding, and your saved pickup locations (up to ten named business addresses, each with a contact phone and an optional map pin; the location you choose for a delivery is shared with the carrier and driver so they can collect the order).

About your customers (entered by you):

Full name and, where you record it, customer ID number, date of birth, and nationality.
Phone number and address.
Photos of the customer's ID card (front and back) and the customer's signature.

About transactions:

Invoice details: items, serial or IMEI numbers, condition, quantities, and prices.
Sell or buy direction, the payment method recorded (cash, KNET, or card), and any refunds, voids, or added service charges.

About repairs:

The item taken in, its serial or IMEI number where recorded, the reported issue, photos of the item at intake, the promised ready-by date, the repair's status history, and the repair warranty period printed on the invoice.

About deliveries:

The drop-off area and address, the recipient's name and phone as entered, the delivery fee, and the delivery's status history.
For drivers of carrier companies: a single live location while the driver is online, used for dispatch and the carrier's fleet view. It is not location history - the position is replaced as the driver moves and removed when the driver goes offline or signs out.

Flagged-device reports:

Serial or IMEI numbers you report as belonging to stolen devices, shared across the vendor network.

Technical:

Sign-in and security information needed to keep your account safe, and basic device information for delivering notifications.

Your data belongs to you. We don't show ads, and we never sell, rent, or trade your information or your customers'.

Why we collect it

To create and store invoices, ring up sales, and keep your commercial records organised.
To run your repair and service jobs from intake to hand-back, including the photos and dates that document them.
To arrange, dispatch, and track deliveries, and to collect the delivery fee from your customer.
To send documents you choose to send - such as an invoice PDF to your customer over WhatsApp.
To show you analytics about your own business.
To verify identity at the point of a transaction, as your business requires.
To operate the shared flagged-device registry that helps vendors avoid handling stolen goods.
To manage your subscription, send service messages, and provide support.
To keep the platform secure and investigate misuse.

Where your data is stored

Database: a managed cloud database and authentication provider.
Files (logos, signatures, ID photos, repair intake photos): a cloud file-storage provider, stored privately and encrypted at rest. Files are reachable only through short-lived, signed links.
Email: an email delivery provider, used to send service emails.
WhatsApp messages: one-time sign-in and security codes, delivery-fee payment links, and invoice PDF documents sent to your customer at your instruction.
Push notifications: a push-notification provider, used to deliver app notifications. We send a device token and the message content; no other data is shared with it.
Payments: UPayment, a licensed payment processor in Kuwait, used for subscription payments, wallet top-ups, and delivery fees. Card details are entered with UPayment and are not stored by Pyro.

These providers process data on our instructions to run the Service. Your data is encrypted in transit and at rest.

How long we keep it

Invoices, customer records, repairs, and deliveries: kept for 5 years, in line with Kuwait commercial record-keeping expectations. Voided and refunded invoices are kept as part of this legal record.
Customer ID photos attached to a customer remain while the customer record exists.
Repair intake photos remain with the repair record for the same 5-year period.
Flagged-device reports: kept for 5 years.
Delivery tracking links go dark shortly after a delivery completes or is cancelled; a driver's live location is removed as soon as the driver goes offline.
Account data: kept while your account is active. If you delete your account, it can be restored for 30 days, after which it is removed - except records we are required to retain for the 5-year period above.

Keeping customers separate

Each vendor's customers are private to that vendor. There is no shared customer directory, no cross-vendor lookup, and no merging of customers between vendors. The only information shared across vendors is the flagged-device registry, which holds device serial/IMEI numbers, not customer profiles.

Who we share with

We share data only with the service providers listed above, and only as needed to run the Service. When you schedule a delivery, the assigned carrier and driver receive what they need to deliver it: the recipient's name, phone, address, and the items summary. We may disclose information where required by law, or to protect the platform, its users, or the public.

Your choices and rights

Access and export: request a copy of your data by emailing support@pyro.com.kw.
Correction: edit your business and customer information in the app.
Deletion: delete your account from Settings. Data is removed within 30 days, except records we must keep for the 5-year period.
Flagged-device disputes: if you believe a report is wrong, contact support so it can be reviewed.

Children

The Service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18 as a user of the Service.

Changes

We may update this policy from time to time. The current version is always available in the app and on our website, and material changes will be communicated through the app.

Contact

Questions about your privacy or this policy? Contact us at support@pyro.com.kw.