Privacy Policy

Kaasb Technology LLC ("Kaasb", "we", "our", "us") operates the online freelancing marketplace available at kaasb.com (the "Platform"). This Privacy Policy (the "Policy") describes the categories of personal data we collect, the purposes and legal bases for processing, the parties with whom we share data, the security measures we apply, and the rights available to you.

This Policy applies to visitors, registered buyers (clients), registered sellers (freelancers), and administrators. By registering, logging in, or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood it.

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data, including collection, storage, use, disclosure or erasure.
• Data Controller — the party that determines the purposes and means of Processing. For this Platform, that party is Kaasb.
• Sub-processor — a third party that processes Personal Data on behalf of Kaasb under contract.
• User — any natural person who creates an account on the Platform, whether as a Buyer or Seller.

The Data Controller responsible for your Personal Data is:

We have not appointed a Data Protection Officer, as none is required under the laws currently applicable to us. All data-protection enquiries should be addressed to the privacy email above.

Payments on the Platform are processed in Iraqi Dinars (IQD) through one of two independent gateways — Qi Card or Zain Cash. The end-to-end flow for each is set out below.

6.aQi Card

1. You initiate a payment on the Platform. Kaasb creates a payment session and signs the redirect URL with HMAC-SHA256 to prevent tampering.
2. You are redirected to Qi Card's environment where you enter your card or wallet details. Kaasb never sees that data.
3. Qi Card processes the payment and redirects you back with a signed reference.
4. Kaasb verifies the signature, records the reference, and holds the funds logically in escrow until the order is completed, auto-completed, cancelled, or resolved by dispute.
5. Payouts to Sellers are initiated manually by Kaasb administrators through the Qi Card merchant app, because Qi Card does not currently expose a payout API.

6.bZain Cash

1. You initiate a payment on the Platform. Kaasb obtains an OAuth2 access token using its merchant credentials, then creates a payment through Zain Cash's API, which returns a transaction identifier.
2. You are redirected to Zain Cash's hosted page where you authenticate against your Zain Cash mobile wallet. Kaasb never sees your wallet PIN, password, or any credential entered there.
3. Zain Cash processes the payment and redirects you back with a token (a JWT signed by Zain Cash) that echoes the operation identifier and the outcome.
4. Kaasb verifies the token signature using its client secret, checks the transaction through Zain Cash's inquiry API, matches it to the originating order, and holds the funds logically in escrow on the same terms as Qi Card.
5. Payouts to Sellers may be processed via the Qi Card or Zain Cash mobile app, depending on which payout method the Seller has configured. The funding gateway and the payout gateway are independent — a payment funded via Zain Cash may be paid out via Qi Card if that's the Seller's preferred payout channel.

Qi Card and Zain Cash are independent payment processors. Their handling of your payment credentials is governed by their own privacy terms, which are outside the scope of this Policy.

Personal Data is transferred outside the Republic of Iraq to the locations of the Sub-processors listed in Section 7 (primarily Germany and the United States). We take reasonable contractual and technical measures — including standard data-protection clauses, encryption in transit (TLS), and least-privilege access controls — to ensure an adequate level of protection. By using the Platform, you acknowledge that your Personal Data may be processed in those jurisdictions.

We apply a defence-in-depth approach, including:

• TLS encryption for all traffic between your device and our servers.
• Bcrypt password hashing with per-user salt; passwords are never stored or logged in plain text.
• Short-lived JWT access tokens (30 minutes) and rotating refresh tokens (14 days, renewed on use) stored as HTTP-only cookies.
• Automatic revocation of all active sessions and token-version bump on password change or reset.
• HMAC-SHA256 signing of Qi Card redirect URLs to prevent payment tampering.
• Redis-backed single-use controls on password-reset tokens.
• Rate limiting, CSRF protection, and security-relevant HTTP headers.
• Automated scanning of user-to-user messages for prohibited content.
• Dual-control approval required for administrative payouts above the threshold configured under Iraqi law.
• Immutable admin audit log for sensitive operations.
• Centralised error tracking with PII stripped before submission.

No security measure is absolute. If you discover a vulnerability, please report it responsibly to security@kaasb.com.

Subject to applicable law, you have the right to:

• Access the Personal Data we hold about you and receive a copy in a structured JSON format.
• Rectify inaccurate or incomplete data through your profile settings, or by contacting us.
• Delete your account and Personal Data, subject to the retention obligations in Section 9.
• Restrict or object to certain processing, including direct marketing (if introduced in the future).
• Withdraw consent where Processing is based on consent, at any time. Withdrawal does not affect lawfulness of Processing carried out before withdrawal.
• Lodge a complaint with the competent authority in the Republic of Iraq or with Kaasb directly.

You may exercise most of these rights from Account Settings (including data export and account deletion). Other requests should be sent to privacy@kaasb.com. We respond within thirty (30) days. We may request proof of identity before acting on a request.

We use strictly necessary cookies to keep you signed in and to secure your session, and remember preferences you chose, such as your language. We do not use analytics or advertising cookies, so no consent prompt is needed and none is shown. A detailed list, and the cookie-free counting we do, is in our Cookie Policy.

The Platform is not directed to persons under eighteen (18) years of age, consistent with the legal-capacity threshold under the Iraqi Civil Code. We do not knowingly collect Personal Data from children. If we become aware that Personal Data of a child has been collected, we will delete it and terminate the associated account.

In the event of a confirmed Personal Data breach that is likely to result in a risk to your rights or interests, we will notify affected Users within seventy-two (72) hours of confirmation, by email and by in-Platform notification. The notice will describe the nature of the breach, the data categories affected, the measures taken to mitigate it, and the steps you can take to protect yourself.

We may update this Policy to reflect changes in our practices or in applicable law. Any material change will be notified at least thirty (30) days in advance through email and/or in-Platform notification. The version number and effective date at the top of the page identify the currently effective revision. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

This Policy is published in Arabic and English. In the event of any conflict, discrepancy, or ambiguity between the two versions, the Arabic version shall prevail. This precedence is a term of this document; Arabic is also the language in which Iraqi courts conduct proceedings.