Privacy Policy

Kaasb Technology LLC ("Kaasb", "we", "our", "us") operates the online freelancing marketplace available at kaasb.com (the "Platform"). This Privacy Policy (the "Policy") describes the categories of personal data we collect, the purposes and legal bases for processing, the parties with whom we share data, the security measures we apply, and the rights available to you.

This Policy applies to visitors, registered buyers (clients), registered sellers (freelancers), and administrators. By registering, logging in, or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood it.

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data, including collection, storage, use, disclosure or erasure.
• Data Controller — the party that determines the purposes and means of Processing. For this Platform, that party is Kaasb.
• Sub-processor — a third party that processes Personal Data on behalf of Kaasb under contract.
• User — any natural person who creates an account on the Platform, whether as a Buyer or Seller.

The Data Controller responsible for your Personal Data is:

We have not appointed a Data Protection Officer, as none is required under the laws currently applicable to us. All data-protection enquiries should be addressed to the privacy email above.

Payments on the Platform are processed in Iraqi Dinars (IQD) through one of three independent gateways — Qi Card, Zain Cash, or FIB (First Iraqi Bank). The end-to-end flow for each is set out below.

6.aQi Card

1. You initiate a payment on the Platform. Kaasb creates a payment session and signs the redirect URL with HMAC-SHA256 to prevent tampering.
2. You are redirected to Qi Card's environment where you enter your card or wallet details. Kaasb never sees that data.
3. Qi Card processes the payment and redirects you back with a signed reference.
4. Kaasb verifies the signature, records the reference, and holds the funds logically in escrow until the order is completed, auto-completed, cancelled, or resolved by dispute.
5. Payouts to Sellers are initiated manually by Kaasb administrators through the Qi Card merchant app, because Qi Card does not currently expose a payout API.

6.bZain Cash

1. You initiate a payment on the Platform. Kaasb signs an init request with the merchant secret (HS256 JWT) and submits it to Zain Cash, which returns a Zain Cash operation identifier.
2. You are redirected to Zain Cash's hosted page where you authenticate against your Zain Cash mobile wallet. Kaasb never sees your wallet PIN, password, or any credential entered there.
3. Zain Cash processes the payment and redirects you back with a token (a JWT signed by Zain Cash) that echoes the operation identifier and the outcome.
4. Kaasb verifies the token signature against the merchant secret, matches the operation identifier to the originating order, and holds the funds logically in escrow on the same terms as Qi Card.
5. Payouts to Sellers may be processed via the Qi Card, Zain Cash, or FIB mobile app, depending on which payout method the Seller has configured. The funding gateway and the payout gateway are independent — a payment funded via Zain Cash may be paid out via FIB if that's the Seller's preferred payout channel.

6.cFIB (First Iraqi Bank)

1. You initiate a payment on the Platform. Kaasb obtains an OAuth2 access token from FIB's authorization server (using merchant credentials known only to Kaasb and FIB), then creates a payment via FIB's REST API. FIB returns a payment identifier and a redirect link that opens the FIB mobile app.
2. You approve the payment in the FIB app using your FIB account credentials. Kaasb never sees those credentials, your account balance, or any other data inside the FIB app.
3. FIB POSTs an unsigned status notification to a callback URL on Kaasb's server when your payment outcome is decided.
4. Kaasb verifies that notification by calling FIB's authoritative status endpoint with the payment identifier. Only the API response is trusted; the callback body alone is treated as a notification, not as proof of payment. This protects against forged callbacks.
5. Once verified as PAID, Kaasb holds the funds logically in escrow on the same terms as the other gateways. FIB-funded payments may be refunded programmatically through FIB's refund API within FIB's standard 7-day post-charge window; outside that window refunds are processed manually.

Qi Card, Zain Cash, and FIB are independent payment processors. Their handling of your payment credentials is governed by their own privacy terms, which are outside the scope of this Policy.

Personal Data is transferred outside the Republic of Iraq to the locations of the Sub-processors listed in Section 7 (primarily Germany and the United States). We take reasonable contractual and technical measures — including standard data-protection clauses, encryption in transit (TLS), and least-privilege access controls — to ensure an adequate level of protection. By using the Platform, you acknowledge that your Personal Data may be processed in those jurisdictions.

We apply a defence-in-depth approach, including:

• TLS encryption for all traffic between your device and our servers.
• Bcrypt password hashing with per-user salt; passwords are never stored or logged in plain text.
• Short-lived JWT access tokens (30 minutes) and rotating refresh tokens (7 days) stored as HTTP-only cookies.
• Automatic revocation of all active sessions and token-version bump on password change or reset.
• HMAC-SHA256 signing of Qi Card redirect URLs to prevent payment tampering.
• Redis-backed single-use controls on password-reset tokens.
• Rate limiting, CSRF protection, and security-relevant HTTP headers.
• Automated scanning of user-to-user messages for prohibited content.
• Dual-control approval required for administrative payouts above the threshold configured under Iraqi law.
• Immutable admin audit log for sensitive operations.
• Centralised error tracking with PII stripped before submission.

No security measure is absolute. If you discover a vulnerability, please report it responsibly to security@kaasb.com.

Subject to applicable law, you have the right to:

• Access the Personal Data we hold about you and receive a copy in a structured JSON format.
• Rectify inaccurate or incomplete data through your profile settings, or by contacting us.
• Delete your account and Personal Data, subject to the retention obligations in Section 9.
• Restrict or object to certain processing, including direct marketing (if introduced in the future).
• Withdraw consent where Processing is based on consent, at any time. Withdrawal does not affect lawfulness of Processing carried out before withdrawal.
• Lodge a complaint with the competent authority in the Republic of Iraq or with Kaasb directly.

You may exercise most of these rights from Account Settings (including data export and account deletion). Other requests should be sent to privacy@kaasb.com. We respond within thirty (30) days. We may request proof of identity before acting on a request.

We use strictly necessary cookies to keep you signed in and to secure your session, and a single preference key to remember your cookie-consent choice. We do not currently use analytics or advertising cookies. A detailed list is available in our Cookie Policy.

The Platform is not directed to persons under eighteen (18) years of age, consistent with the legal-capacity threshold under the Iraqi Civil Code. We do not knowingly collect Personal Data from children. If we become aware that Personal Data of a child has been collected, we will delete it and terminate the associated account.

In the event of a confirmed Personal Data breach that is likely to result in a risk to your rights or interests, we will notify affected Users within seventy-two (72) hours of confirmation, by email and by in-Platform notification. The notice will describe the nature of the breach, the data categories affected, the measures taken to mitigate it, and the steps you can take to protect yourself.

We may update this Policy to reflect changes in our practices or in applicable law. Any material change will be notified at least thirty (30) days in advance through email and/or in-Platform notification. The version number and effective date at the top of the page identify the currently effective revision. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

This Policy is published in Arabic and English. In the event of any conflict, discrepancy, or ambiguity between the two versions, the Arabic version shall prevail, consistent with Article 14 of the Iraqi Civil Code and the customary rule of Iraqi courts.