Privacy policy

1. Who we are

VYLI is an online marketplace that connects shoppers in Iraq with independent fashion stores and delivers their orders. In this policy “VYLI”, “we” and “us” mean the VYLI marketplace. Contact: vyliapp@outlook.com or WhatsApp +44 7776 731246.

2. What we collect

Account details: your name, email address, phone number, and how you sign in (email, Google or Apple).

Delivery details: addresses, the map pin you choose, and delivery notes.

Orders and activity: what you buy, returns, customer cases, saved pieces, stores you follow and pieces you view.

Optional AI features: photos and text you choose for photo search or Beauty assistance, and saved Beauty brand, shade, finish and budget preferences used for suggestions. Search activity produces aggregate search trends.

Messages and photos you send to stores or to VYLI support.

For sellers: store details, product listings and photos, stock, sales, payout details and staff accounts.

For drivers: name, phone, delivery activity, location while on a delivery, and cash collected.

Technical data: device and browser type, pages visited, and small cookies/local storage that keep you signed in and remember your language and preferences.

3. How we use it

To run your account, take and deliver orders, collect cash on delivery, handle returns and support, pay sellers, prevent fraud and abuse, keep the service secure, and improve VYLI. We send service messages about your orders. We don't sell your personal information.

4. Who we share it with

The store you buy from gets what it needs to prepare your order (your first name, items and city) and the messages you send it. Drivers get your name, phone, address and pin to deliver.

Service providers who run VYLI for us: Supabase (accounts, database and file storage), Vercel and Render (hosting), Google (sign-in, maps and delivery route estimates), Apple (sign-in and delivery Live Activity updates), and OpenAI (for optional customer photo search, Beauty assistance, shop branding, listing tools and virtual try-on — shop details, logos and product photos help create editable branding and listings; try-on photos are sent to OpenAI to generate previews. VYLI does not store original try-on photos. Unsaved previews expire after 45 minutes; saved previews are kept for 30 days. Provider safety retention may apply). AI sharing starts only after your permission; you can cancel and shop without AI. OpenAI safety retention may apply. Providers may process data outside Iraq.

OTPIQ delivers phone verification codes through WhatsApp or SMS. Optional AI support uses Anthropic to process your messages, recent conversation and relevant account/order details. The website asks permission before starting AI support; you can use ordinary support instead. AI support history is removed when a customer deletes their account, while necessary support-case and financial records may remain as explained below.

Authorities, if the law requires it or to protect people from harm or fraud.

5. How long we keep it

We keep your account data while your account is open. Order, payment and delivery records are kept as long as needed for accounting, returns and legal reasons, even after an account is deleted, with completed orders anonymised. Active delivery details remain until the order is completed. Necessary support and financial records may be retained to handle disputes and legal obligations. Sign-in and uploaded-photo cleanup is retried automatically if a provider is unavailable. A minimal inactive account identifier remains to prevent old sessions from restoring access.

6. Your choices and rights

You can see and change your details in Account. You can sign out of every device from Account. You can delete your account at any time from Account → Delete my account (customers) or by messaging support (sellers, drivers and staff). You can ask us for a copy of your data or to correct it by contacting us.

7. Deletion requests

You can request deletion without signing in or reinstalling the app. Visit vyli.app/delete-account to request deletion of your account and associated personal data, or vyli.app/delete-data to request deletion of selected data while keeping your account. Both pages provide direct email and WhatsApp contact options, verification steps, and details of data deleted or retained. We explain any additional retention period that applies to your request.

8. Security

Connections to VYLI are encrypted, passwords are handled by our sign-in provider and never stored by us in readable form, secret keys stay on our servers, and staff only see what their role needs. No system is perfectly secure, so please use a strong password and tell us if you notice anything wrong.

9. Young shoppers

VYLI shopping accounts are for people aged 13 and over. If you are under 18, use VYLI with permission from a parent or guardian, including when placing orders or using optional photo features. Seller, driver and business staff accounts are for adults aged 18 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data, contact vyliapp@outlook.com to request its deletion.

10. Changes

We may update this policy. If the changes are important we'll tell you in the app before they apply. The date at the top shows the latest version.