This policy explains what personal data the SKINPLUS mobile app ("SKINPLUS", "we", "us") collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the SKINPLUS app on iOS and Android (app ID com.skinplus.iq) and to this website.
In short: we use your data to run the store and deliver your orders. We don't sell your data, we don't show third-party ads, and we don't track you across other companies' apps or websites. You can delete your account in the app at any time.
1. Who we are
SKINPLUS is an online store for skincare, hair care and body care products for customers in Iraq. We are responsible for the personal data described in this policy. You can reach us at privacy@blackdm.co.uk or on WhatsApp at +964 776 665 6529.
2. Data we collect
You can browse and order as a guest, or create an account. Depending on how you use the app, we collect:
| Category | What | When |
|---|---|---|
| Account details | Name, email address, password (stored in protected form), and phone number if you add one | When you create or use an account |
| Order and delivery details | Full name, phone number, alternative phone number, governorate, address, nearest landmark, order notes, the items you order, promo codes and order amounts | When you place an order (as a guest or signed in) |
| Shopping activity | Cart contents, wishlist (saved products), order history and order status | When you use the cart, wishlist and orders |
| Search activity | The text you search for and the app language | When you search in the app |
| Photos for photo search | The photo you take or choose. Location data (EXIF) is removed and the image is resized on your device before it is sent. | Only when you use photo search |
| Offers and messages | Whether in-app offer messages were shown to you and which buttons you tapped, and coupons you saved | When an in-app offer appears |
| Identifiers and device data | A random shopper ID created by the app (used for guests and signed-in users), your account ID, a push notification token, Firebase installation ID, device platform (iOS/Android), app language and app version | When you use the app, and when you allow notifications |
| Support conversations | The messages and details you send us | When you contact us on WhatsApp, Instagram or by email |
Photos sent for photo search are processed by our own search service only to find matching products. They are not stored after results are returned, they are not linked to your account or shopper ID, and they are not sent to third-party AI services.
3. Data stored on your device
Some data stays on your phone and is not sent to us:
- Your app language and whether you finished the welcome screen.
- Your last 5 searches per language, so you can repeat them.
- Delivery addresses you save at checkout. You can edit or remove them in More → Manage addresses.
- Your sign-in session, kept in the device's secure storage (iOS Keychain / Android Keystore).
Uninstalling the app removes this data from your device.
4. Data we don't collect
- No GPS or precise location. You type your delivery address yourself.
- No bank card or payment details. Orders are paid in cash on delivery.
- No contacts, calendar, microphone recordings, or health data.
- No advertising ID, no third-party advertising, and no cross-app tracking.
- No third-party analytics or crash-reporting tools.
5. How we use data
- To provide the store: show products and prices, run your cart, wishlist and account, and remember your language.
- To process and deliver orders: confirm orders, prepare them, deliver them, collect cash on delivery, and handle cancellations, returns and questions.
- To run search: return results for text and photo searches, and show popular searches.
- To send notifications you allowed: new arrivals, offers and store news. You can turn them off at any time.
- To show in-app offers and apply coupons, and to measure which offers are useful.
- To improve the store: understand which products and searches are popular, using our own records.
- To keep the service safe: prevent fraud and abuse, secure accounts, and meet legal, tax and accounting obligations.
- To answer you when you contact support.
We process data because it is needed to provide the service you ask for, because you agreed (for example to notifications, camera or photo access), to meet legal obligations, or for our legitimate interest in running and protecting the store.
6. Who we share data with
We do not sell your personal data. We share it only as needed with:
- Delivery partners, who receive the name, phone numbers, address, order contents and amount due in order to deliver your order and collect payment.
- Our e-commerce platform and hosting providers, which store and process data on our behalf to run the app, the store backend, product images and photo search.
- Google Firebase Cloud Messaging and Apple Push Notification service, which receive your push token and the notification content in order to deliver notifications.
- Expo (EAS Update), which delivers app updates. When the app checks for an update, technical data such as app version, platform and IP address is processed.
- WhatsApp and Instagram (Meta), only if you choose to contact us there. Their own privacy policies apply.
- Authorities or advisers, when the law requires it, or to protect our rights, our customers or the public.
- A buyer or successor, if our business is reorganized or sold. This policy will continue to protect your data.
These service providers may use your data only to provide their services to us.
7. Permissions
- Camera and photos (optional): used only for photo search when you start it. The app uses the system photo picker, so it can only see the photo you choose.
- Notifications (optional): used for new arrivals, offers and store news. If you decline, everything else works, and you can change this in your device settings.
8. How long we keep data
- Account details: until you delete your account.
- Orders: as long as needed to deliver them, handle returns and questions, and meet accounting, tax and legal obligations. These records may be kept after account deletion only for those purposes.
- Cart and wishlist: until you remove the items or delete your account.
- Search and offer activity: only as long as needed to run and improve the store, then deleted or anonymized.
- Photos for photo search: not stored. They are discarded as soon as results are returned.
- Push tokens: until you sign out, turn off notifications, uninstall the app, or the token expires.
- Support conversations: as long as needed to resolve your request and keep a record of it.
9. Deleting your account and data
In the app: open More → Account → Delete Account and confirm.
Without the app: follow the steps on our account deletion page, or email privacy@blackdm.co.uk from the email address on your account.
When your account is deleted, we delete your account details, wishlist, cart and the push registration linked to your account. We keep order records only where required for accounting, tax, fraud-prevention or legal reasons, and only for as long as required. Web requests are completed within 30 days. Guests can ask us to delete their guest orders using the same contact details.
10. Your rights and choices
You can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct inaccurate data (you can also edit your details in the app);
- delete your data, as described above;
- stop using your data for offers and notifications (turn notifications off in your device settings);
- withdraw consent you gave, without affecting past processing.
Email privacy@blackdm.co.uk. We may ask you to confirm your identity first, and we reply within 30 days.
11. Security
All data between the app and our servers is encrypted in transit (HTTPS/TLS). Sign-in sessions are kept in your device's secure storage, and access to customer data is limited to people and providers who need it. No system is perfectly secure, but we work to protect your data and will act quickly if a problem occurs.
12. International transfers
Our service providers may process data on servers outside Iraq. When this happens, we rely on providers that protect data in line with this policy.
13. Children
SKINPLUS is not directed to children under 13, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
14. This website
This website does not use cookies, analytics or advertising. Our hosting provider (Cloudflare) processes technical data such as IP addresses to deliver and secure the site. Fonts are loaded from Google Fonts, which receives your IP address.
15. Changes to this policy
We will update this page when our practices change and update the effective date above. If a change is significant, we will also tell you in the app.
16. Contact us
- Privacy questions and requests: privacy@blackdm.co.uk
- Customer support: support@blackdm.co.uk
- WhatsApp: +964 776 665 6529