Privacy Policy

distro.pk provides distribution management software to businesses. This policy explains what information we hold, why we hold it, and what we do and don't do with it.

Who controls the data

Each distributor using distro.pk controls the business data inside their own account — their shops, products, bills, payments and staff records. We store and process that data on their behalf, and we act on their instructions. If you are a shopkeeper or an employee and want to know what a distributor holds about you, ask that distributor directly.

What we hold

• Business records your staff enter — customers and shops, products and stock, invoices, payments, returns and routes.
• User accounts — names, usernames, roles and passwords, which are stored hashed and are never readable by us or anyone else.
• Location data, only where a distributor turns it on for field staff: periodic position samples and shop coordinates, used to show route coverage and field presence.
• Photos attached to records — product images, and on-duty check-in photos where that feature is enabled.
• Technical logs — errors and access records kept to diagnose faults and keep the service running.

Where it is kept

Every distributor's data is held in a separate database and served from its own address. Data is not pooled, mixed or shared between distributors. Backups are taken regularly and stored on the same infrastructure.

What we do with it

We use the data to operate the service for the distributor who owns it: displaying it back to their authorised users, generating their reports and documents, sending the notifications they have configured, and providing support when asked.

We do not sell data. We do not share it with advertisers. We do not use one distributor's data to build products for another.

Access by us

Our staff can access a distributor's account when it is needed to provide support, fix a fault or comply with the law. Such access is logged.

Third parties

• Hosting — servers are operated by our hosting provider, who holds the data at rest on our behalf.
• SMS — where a distributor sends SMS, messages are delivered through a phone or gateway that the distributor themselves provides and controls.
• Email — automated notices are sent from our servers to addresses the distributor configures.

How long we keep it

Business records are kept for as long as the distributor's account is active, because distribution records have long-term accounting value. On closure we will, at the distributor's request, provide an export and then delete the data within a reasonable period, except where we are required to keep it by law.

Security

Access is over HTTPS. Passwords are hashed. Permissions are role-based, so users only reach the parts of the system they have been granted. No system is perfectly secure, and we do not claim otherwise — but we treat business data as the sensitive material it is.

Your rights

You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. Where the data belongs to a distributor's account, we will refer the request to that distributor and support them in answering it.

Changes

We will update this page when our practices change, and the date at the top will reflect that.

Contact

Questions about this policy: hello@distro.pk