This Policy explains how we collect your personal data on the Aman-Fix platform, how we use, retain, and share it, what rights you have over it, and how you exercise them.
This Policy forms an integral part of the Terms of Use and is accepted by both the Customer and the Provider. It addresses the "User" generally and sets out Provider-specific provisions where needed.
Read it in full before using the Platform; using the Platform after its effective date constitutes your agreement to the processing described in it.
1Introduction and Scope
1.1This Policy applies to every processing of personal data carried out through the Aman-Fix mobile application, its website, its control panels, and the related services.
1.2This Policy addresses the User generally, meaning both the Customer and the Provider, and sets out provisions applying to the Provider alone where that is expressly stated.
1.3This Policy does not apply to processing carried out by a Provider on its own account outside the Platform, nor to third-party websites or applications you reach through links inside the Platform.
1.4The currently active country is the Arab Republic of Egypt and the currency in use is the Egyptian Pound (EGP); this Policy is read in light of the laws of the Arab Republic of Egypt.
2Definitions
2.1"Platform" means the Aman-Fix application, its website, its panels, its programming interfaces, and every digital service we provide through them.
2.2"User" means any person who creates an account on the Platform or uses it, whether a Customer or a service Provider.
2.3"Provider" means the independent technician or maintenance center that performs the service as an independent contractor, not as our employee and not as our subordinate.
2.4"Personal Data" means any information relating to an identified or identifiable natural person, including name, phone number, address, location, and image.
2.5"Processing" means any operation performed on personal data, including collection, recording, organization, storage, alteration, retrieval, use, disclosure, erasure, or anonymization.
2.6"Processor" means a third party that processes data on our behalf, on our instructions, and under a contract restricting its use to the purpose of the service.
3Who We Are and the Data Controller
3.1Aman-Fix is a digital intermediary platform connecting Customers with independent service Providers; it is not the service provider and it is not the Provider's employer.
3.2We are the data controller in respect of user accounts, orders, payments, fraud prevention, and support inside the Platform.
3.3The Provider is an independent controller of the data it collects itself outside the Platform, and bears sole responsibility for the lawfulness of that processing.
3.4You may contact us on any matter relating to this Policy through the official support channels inside the application.
4Identity Data and Contact Data
4.1We collect from every User their full name, phone number, preferred language, and the role selected at registration.
4.2We collect the date of birth to verify eligibility; registration is not accepted for anyone under 19 years of age, nor for anyone above 80 years of age.
4.3We collect additional verification data from the Provider, including gender, national identification number, images of identity documents, and details of trade, specialty, and service area.
4.4Phone verification is performed with a one-time code sent by the channel you select, and we send no code before you select the channel and request the send.
4.5We may collect an alternative contact provided by the Provider for operational emergencies, and the Provider represents that it has obtained that person's consent.
5Address Data and Location Data
5.1We collect the address you enter for an order, its coordinates on the map, and any access notes you add.
5.2We collect your device location, approximate or precise, when you request a service, so the order can be broadcast to nearby Providers and time and distance can be estimated.
5.3We collect the Provider's location during an active visit to enable arrival tracking, distance calculation, and dispute resolution, and collection stops when the visit ends.
5.4We do not collect location without your operating-system level permission, and you may withdraw that permission at any time from your device settings.
5.5Withdrawing location permission does not cancel your existing orders, but it may prevent features that depend on it, such as geographic broadcast and arrival tracking.
6Media: Images and Video
6.1We collect the images and video you upload to describe a fault, to evidence condition before and after performance, or to verify the Provider's identity.
6.2Uploaded media may contain metadata and background details you did not intend to reveal; we strip metadata as set out in Section 14, but responsibility for what appears in the image itself remains yours.
6.3Do not upload media containing another person's personal data without their consent, nor documents unrelated to the order or to verification.
6.4Media is stored on cloud storage (Cloudflare R2) behind time-limited links and is not publicly browsable.
7Order Data and Fault Descriptions
7.1We collect the details of every order: the service type, the fault description, the requested time, and the notes you write.
7.2We collect the full order trail: broadcast or selection, acceptance, the visit, the on-site estimate, your approval or refusal, performance, and closure.
7.3We collect in-app chat content and in-app call metadata, namely times, parties, and duration, to evidence the dealing, resolve disputes, and protect user safety.
7.4We collect your ratings, your complaints, and any evidence you attach to them.
7.5For finishing services performed by the company itself, we also collect the visit, stage, and installment data associated with the project.
8Financial Data and Wallet Data
8.1We collect the record of order amounts, visit fees, the published commission, the Provider's net amount, wallet movements, and withdrawal requests.
8.2We keep a double-entry accounting record of every financial movement; that record is legally binding and is not deleted when an account is deleted.
8.3We do not store your full bank card details on our systems; payment processing occurs with a licensed payment service provider, and we receive from it only the transaction reference, its outcome, and limited identifying digits where available.
8.4We collect from the Provider the account or wallet details to which it asks its dues to be transferred, and we use them for that purpose and to evidence disbursement only.
8.5We use financial data to detect and prevent fraud and money laundering, and to meet our accounting and tax obligations.
9Device Data, Technical Data, and Usage Data
9.1We collect automatically the device type and its operating system, the application version, the device language, the notification token, the internet address (IP), and the country inferred from it.
9.2We collect technical logs including sign-in and sign-out times, active sessions, the screens you open, and the errors the application encounters.
9.3We keep a security log of sensitive events such as failed sign-in attempts, password changes, enabling two-step verification, and blocking and unblocking events.
9.4We use this data to secure your account, keep the service stable, and detect abusive use, not to build an advertising profile about you.
10How We Collect Your Data
10.1We collect data directly from you when you create an account, place an order, upload a document, or contact support.
10.2We collect data from your use of the Platform, that is, from what your transactions, messages, ratings, and order trail generate.
10.3We collect data automatically from your device when the application runs, according to the permissions you have granted to the operating system.
10.4We receive limited data from our processors, such as the outcome of a payment, the delivery status of a message, or the result of a notification send.
10.5We receive data from the other party to a transaction where necessary, such as the Customer's address for the Provider whose offer was accepted, or the Provider's name for the Customer.
11Purposes of Processing
11.1We process your data to create and administer your account, and to verify the Provider's identity before activation.
11.2We process your data to operate the service model: broadcasting or routing the order, arranging the visit, conveying the on-site estimate, recording your approval or refusal, and closing the order.
11.3We process your data for financial settlement: computing the published commission, updating the Provider's wallet, executing withdrawals, and reconciling records.
11.4We process your data for security and to prevent fraud, impersonation, and abusive use, and to protect users' lives and property.
11.5We process your data to improve the service through aggregated analytics, for support and dispute resolution, and to comply with a legal obligation or an order of a competent authority.
12Legal Bases for Processing
12.1Performance of contract: all processing necessary to deliver the service you requested, or to enable the Provider to work on the Platform.
12.2Legitimate interests: Platform security, fraud prevention, service quality measurement, product improvement, and protection of our legal rights, provided they do not override your rights and freedoms.
12.3Legal obligation: retention of financial and tax records, and response to orders of law-enforcement and regulatory authorities.
12.4Explicit consent: access to location, camera, photos, and notifications, marketing communications, and processing of the verification video.
12.5Where consent is the basis of processing, you may withdraw it at any time, and withdrawal does not affect the lawfulness of processing carried out before it.
13Location and Tracking During the Visit
13.1We collect the Customer's location only when the order is created or its address is changed, and we do not track that location afterwards.
13.2We collect the Provider's location during the active visit only: collection begins when the Provider accepts the order and sets out, and ends when the visit is closed or cancelled.
13.3Provider location collection may operate with the application in the background during an active visit, to show arrival to the Customer and evidence arrival time, and the operating system indicator for this is displayed.
13.4We do not use location data to track the Provider outside active visits, nor to build a map of the Provider's personal movements.
13.5You may disable location access entirely from your device operating system settings; that is the decisive control and it does not depend on any in-application setting.
14Metadata Stripping and Encryption of Sensitive Documents
14.1We strip metadata (EXIF) from uploaded images, including location data, device model, and capture times, before storing them or making them available to the other party to the transaction.
14.2Sensitive verification documents are encrypted at rest, and access to them is limited to a small number of authorized staff by reason of their role.
14.3All transfer of data between your application and our servers occurs over an encrypted connection.
14.4Metadata stripping does not erase what appears inside the image itself, so review the content of an image before uploading it.
15The Provider Verification Video
15.1The Provider is required to record a short verification video as one step of identity verification, its purpose being to establish that the person submitting the documents is their holder and a real person.
15.2The video is recorded without audio, and we do not request microphone permission for this step.
15.3The verification video is not shown to Customers or to any Provider other than the one who submitted it, is not published anywhere, and is viewable only by the authorized review team.
15.4The video is reviewed by a human before the Provider's account is activated, and is retained for as long as needed as set out in Section 21.
15.5Refusing to provide the verification video prevents completion of verification, and therefore prevents activation of the Provider's account and receipt of orders.
16Sharing Between the Customer and the Provider
16.1When your order is accepted we share with the Provider only what is necessary to perform it: your name, a contact channel, the address and its coordinates, and the fault description with attached media.
16.2We share with the Customer the Provider data necessary for trust and communication: name, professional photo, rating, verification status, and an in-application contact channel.
16.3We never share your national identification number, your verification documents, or your verification video with the other party to the transaction.
16.4Each party undertakes to use the other party's data for the purpose of the order alone; using it for marketing, for contact outside the purpose of the order, or transferring it to a third party is prohibited.
16.5Availability of direct contact details is limited to the duration of the order and to the period following it only so far as necessary for warranty or dispute.
17Processors and Service Providers
17.1We engage processors that act on our behalf and on our instructions, for the following purposes:
- Cloud storage of media and documents.
- Maps, route and distance calculation, and address geocoding.
- Push notifications to devices.
- Sending text messages and messaging-application messages for phone verification and operational alerts.
- Payment and transfer processing.
- Hosting, technical monitoring, and error logging.
17.2We bind every processor by a contract restricting use of the data to the purpose of the service, prohibiting use for its own account, and imposing appropriate security measures.
17.3We share with each processor the minimum amount of data sufficient to perform its task, and no more.
17.4Our engagement of a processor does not make our liability for its acts absolute; our liability rests on due care in its selection and on binding it to the contracted measures.
18Legal Disclosure and Business Transfers
18.1We disclose your data to judicial, law-enforcement, or regulatory authorities upon receipt of a valid legal request, or where disclosure is necessary to protect life or prevent a crime.
18.2We disclose your data to our legal advisers or auditors where necessary to establish or defend a right or to meet a regulatory obligation.
18.3On a merger, acquisition, or transfer of all or part of our business, data may be transferred to the successor provided it commits to protection no lower than that of this Policy, and we notify you of this.
18.4We notify you of a legal request where notice is legally permitted and does not endanger an investigation or any person's safety.
19What We Do Not Do With Data
19.1We do not sell your personal data, we do not rent it, and we do not barter with it.
19.2We do not share your data with data brokers or advertising networks for third-party behavioral marketing purposes.
19.3We do not read your chat content except within a defined scope: a complaint, a dispute, an abuse report, a legal obligation, or a security investigation, and only so far as necessary.
19.4We do not take purely automated decisions producing serious legal effects on you without the possibility of human review on your request.
20Cross-Border Transfers
20.1Your data may be stored or processed on servers located outside the Arab Republic of Egypt, with processors acting on our behalf.
20.2We apply appropriate safeguards to every transfer, including contractual data protection terms, purpose limitation, and security measures and encryption.
20.3In selecting storage locations we observe the requirements applicable law imposes on data of high sensitivity.
20.4By using the Platform you acknowledge that operating a cross-border digital service entails such transfers within the limits we have described.
21Retention Periods
21.1Account data is retained for the life of your account, then anonymized on account deletion as set out in Section 23.
21.2Order, chat, and media data is retained for a period sufficient for warranty, dispute, and audit, then deleted or anonymized.
21.3Provider verification documents and the verification video are retained for the validity period of the verification, and for the period afterwards necessary to evidence that we verified as the law requires, then deleted.
21.4Financial, accounting, and tax records are retained for the period applicable law imposes, and are not subject to a deletion request conflicting with that.
21.5Security logs and error logs are retained for a limited period sufficient to investigate incidents and detect abusive patterns, then deleted or aggregated.
22Data Subject Rights and How to Exercise Them
22.1You have the right to access your data, to know the purposes of its processing, and to know with whom we have shared it.
22.2You have the right to correct inaccurate data and complete incomplete data; some fields may require re-verification before amendment.
22.3You have the right to request deletion, the right to object to processing based on legitimate interests, and the right to request restriction of processing while your objection is examined.
22.4You have the right to port the data you provided in a machine-readable format, and the right to withdraw any consent you granted.
22.5These rights are exercised from the account settings page inside the application or by a request through the official support channels inside the application; we respond within 30 days of verifying your identity, and we may extend that period once by the same length for complex requests, notifying you of the reason.
22.6We may refuse a request in whole or in part where it conflicts with a legal obligation on us, prejudices the rights of others, or is repetitive without cause, and we will state the reason for refusal.
23Account Deletion and Anonymization
23.1You may request deletion of your account from inside the application, and we do not ask you for a reason.
23.2Deletion is carried out by anonymization: your personal identifiers are severed from the records and replaced or erased, so the account is no longer attributable to you.
23.3Legally binding financial records remain after deletion, stripped of your identifiers so far as the law permits, because erasing them would breach our accounting and tax obligations.
23.4Records necessary to establish or defend a right in an existing or potential dispute likewise remain until that dispute ends.
23.5Deletion does not cancel an existing order or any financial obligation owed by you or to you, so settle what you owe and collect what is owed to you before requesting deletion.
23.6An account cannot be restored once anonymization is complete, and any later use requires a new registration.
24Minors and Eligibility Age
24.1The Platform is not directed to anyone under 19 years of age, and we do not knowingly accept such a registration.
24.2If we learn that an account belongs to a person under 19 years of age, we suspend it and delete their data except what the law requires us to retain.
24.3A guardian should contact us through the official support channels inside the application if they believe a person in their care registered without permission.
24.4Misstating the date of birth does not relieve the User of responsibility, and creates no liability on us for an account opened on an untrue statement.
25Information Security
25.1We apply technical and organizational measures including transport encryption, encryption of sensitive documents at rest, and access control on a least-privilege basis.
25.2We record sensitive events in an audit log, allow you to enable two-step verification on your account, and display your active sessions so you can end them.
25.3No system is absolutely secure, so we give no warranty that data will never be subject to any breach, however strong the measures.
25.4You are responsible for the confidentiality of your password and the verification codes sent to you, for the security of your device, and for all activity occurring from your account by reason of your default in that.
25.5Notify us immediately through the official support channels inside the application if you suspect unauthorized access to your account.
26Data Breach Notification
26.1If a personal data breach occurs that is likely to create a risk to you, we notify you and notify the competent authority as applicable law requires and without undue delay.
26.2The notice states the nature of the breach, the categories of data affected, the expected impact, the measures we have taken, and what we recommend you do.
26.3We investigate every incident, limit its impact, remedy its cause, and update our measures according to what the investigation reveals.
26.4We require your cooperation in the investigation where the breach arises from your account, your device, or your disclosure of your sign-in credentials.
27Identifiers, Tracking Technologies, and Analytics
27.1We use technical identifiers, cookies, and local storage technologies on the web to operate the session, provide security, and remember your language.
27.2In the application we use an installation identifier and a notification token, and we do not use the advertising identifier to build an advertising profile about you.
27.3We use aggregated usage analytics to understand service performance and where users encounter difficulty, and we endeavor to aggregate or anonymize that analytics data.
27.4You may manage non-essential cookies from your browser settings, noting that disabling essential cookies prevents sign-in and operation of the service.
28Notifications and Marketing Communications
28.1We send operational notifications necessary to the service: order status, Provider arrival, the estimate, payment, and security alerts.
28.2Operational notifications are part of the service and cannot be switched off entirely while the account remains active; if you disable them at the operating system level you may miss information concerning your order.
28.3We send marketing communications only with your consent, and you may stop them at any time from account settings or by the means stated in the message itself.
28.4Stopping marketing communications does not stop operational notifications or legal messages such as notice of amendment of this Policy.
29User Responsibility for Third-Party Data
29.1If you enter another person's personal data, such as a relative's address, a resident's phone number, or an image containing people, you represent that you have a lawful basis for doing so.
29.2You are solely responsible for notifying the data subject and obtaining their consent where required, and we process that data to perform your own order.
29.3Uploading sensitive data unrelated to the order is prohibited, such as health records or religious, political, or financial data belonging to another person.
29.4On the request of the data subject we delete what you entered about them where it is established that it was entered without a lawful basis, so far as this does not conflict with a legal obligation on us.
30Limits of Our Liability and Exclusions
30.1We are a digital intermediary, so we bear no liability for a Provider's or a Customer's use of the other party's data outside the purpose of the order; that liability rests on whoever committed the act.
30.2We bear no liability for harm arising from your disclosure of your sign-in credentials, your use of a compromised device or an insecure network, or your own publication of your data.
30.3We bear no liability for any indirect or consequential damage, loss of profit, loss of opportunity, or reputational harm arising from data processing, to the extent applicable law permits.
30.4We bear no liability for a failure or breach occurring at a processor, a network operator, or an operating system beyond our reasonable control, and no liability for force majeure.
30.5Our aggregate liability for any claim relating to data processing is limited, to the extent the law permits, to the equivalent of the commission we collected from you in the twelve months preceding the incident, or the value of your transactions in that period, whichever is lower.
30.6This Policy does not limit our liability for fraud or gross fault, nor for anything whose exclusion may not lawfully be agreed.
31Indemnity and Release
31.1You undertake to indemnify us against every loss, claim, fine, or expense, including reasonable legal fees, arising from your breach of this Policy or from your processing of another person's data without a lawful basis.
31.2This undertaking covers third-party claims arising from your uploading of media or documents to which you have no right.
31.3You release us, our staff, and our processors from every claim arising out of a dispute between you and the other party to a transaction concerning use of data, while your right to hold the actual wrongdoer accountable remains intact.
31.4We may assume the defense of any claim covered by this Section, you may participate with your own counsel at your expense, and you shall not settle a claim affecting us without our written consent.
32Complaints, Governing Law, and Arbitration
32.1If you have a grievance relating to the processing of your data, submit it first through the official support channels inside the application, and we will seek an amicable resolution within 30 days.
32.2This Policy is governed by and construed in accordance with the laws of the Arab Republic of Egypt.
32.3Every dispute not resolved amicably is referred to arbitration before the Cairo Regional Centre for International Commercial Arbitration (CRCICA) in Cairo, under its rules, by a sole arbitrator, in the Arabic language, and its award is final and binding.
32.4Your right to any claim relating to the processing of your data lapses if it is not brought within one year from the date you became aware of the event giving rise to it, to the extent the law permits.
32.5This Section does not prevent you from lodging a complaint with the competent data protection supervisory authority where the law confers that right.
33Amendment of the Policy and Notice of It
33.1We may amend this Policy as the service develops or upon a legal or regulatory change, and we publish the amended version inside the Platform with a version number and an effective date.
33.2We notify you of a material amendment inside the application a reasonable time before it takes effect, and we may require your acceptance of the new version before you continue using the Platform.
33.3The current version displayed inside the Platform is the reference, and your acceptance is recorded with its version and time to evidence the agreement.
33.4This operational template requires the approval of a licensed lawyer in every active country before final adoption.
34Precedence and Effectiveness
34.1This Policy is issued in two versions, Arabic and English, and in the event of any conflict or difference in interpretation the Arabic version prevails.
34.2This Policy takes effect from the effective date displayed with its version inside the Platform, and replaces every earlier privacy policy for the same service.
34.3Your continued use of the Platform after you are notified of the new version and after its effective date constitutes your acceptance of it.
34.4The invalidity or unenforceability of any clause of this Policy does not affect its remaining clauses, and the invalid clause is replaced by the nearest valid clause achieving its purpose.
Aman Fix is a digital intermediary only; providers are independent and responsible for their own work.