About this policy
Sawghat, at sawghat.com, is operated by [LEGAL ENTITY NAME — to be provided by the owner], registered under number [REGISTRATION NUMBER — to be provided by the owner], at [REGISTERED ADDRESS — to be provided by the owner] ("Sawghat", "we", "us"). Sawghat is responsible for the personal information described here. Sawghat lets people living outside Afghanistan buy goods for someone inside Afghanistan and pay by card; we are the seller of those goods, and we pack and deliver them from our own warehouses.
This policy explains what information we handle, why, who else sees it, how long we keep it and what you can ask us to do with it. "Our Terms" means the Sawghat Terms of Use. You can reach us about anything in this policy at support@sawghat.com.
1. Information about you as a buyer
- Your account. Your email address, which must be verified, your name and your date of birth (accounts are for people aged 18 or over). You sign in with a one-time code that we email to you, and we keep only a hashed (scrambled) form of the code until it is used or expires. We use your email address for sign-in codes, receipts, order updates and the card payment.
- Orders. The package or products you bought, any fresh gifts, the prices in US dollars, the exchange rate, margin, service fee and delivery fee applied, any gift message, any delivery date you chose, and what you chose should happen if we cannot get an item.
- Checks made when you pay. The country of your IP address, the country that issued your card, whether your email address is verified, and the results of our limits and fraud checks.
- Our approval. Who at Sawghat approved or rejected your order and when, the warehouse that prepared it, and any item we marked as unavailable.
2. Card payments and Stripe
Sawghat takes card payments only, and they are processed by Stripe. You enter your card details in Stripe's payment form, which is loaded from Stripe and sends them to Stripe directly. Sawghat never receives or stores your full card number or security code. From Stripe we receive and keep: the card brand, the last four digits, the country that issued the card, the card's fingerprint (an identifier that Stripe derives from the card number, which lets us recognise the same card again without knowing its number), the result of any authentication your bank asked for, and the records of the payment hold, its capture or release, and of any refund or dispute. We use them to check that the card was issued outside Afghanistan, to apply our limits per card, to prevent fraud, to issue refunds and to answer disputes. If you save a card for later orders, Stripe keeps it and we keep only the details above.
Stripe processes your payment information to provide its payment service to us. It also uses it for its own purposes, such as preventing fraud, meeting its legal obligations and handling disputes with the card networks; for those purposes Stripe is an independent company responsible for the information under its own privacy policy (stripe.com/privacy), and does not act on our behalf. Stripe's payment form may also collect information about your device and connection in order to detect fraud.
3. Your country, from your IP address
When you use Sawghat, we look up which country your IP address belongs to. We do this with a copy of the DB-IP country database that runs on our own servers: your IP address is not sent to DB-IP or to anyone else for the lookup, and the lookup gives us a country, not a town or an address. We use the country:
- to decide whether you can pay on Sawghat, which is open only to buyers outside Afghanistan; and
- to prevent fraud and, if you dispute a charge, as evidence.
The country found when you check out and pay is kept with the payment record. The result used to show you whether you can pay is kept only for a short time and is not linked to your account.
4. Recipients
When you send an order, you give us the recipient's name, an Afghan mobile number, the city and district, the area and landmark directions, and, if you place one, a pin on the map. You can save recipients in your account to send to them again. We use these details to deliver the box:
- the staff of our warehouse, and either the courier from the delivery platform we work with or a member of our own delivery staff, receive what they need to deliver it;
- we send the recipient text messages (SMS) about the box and the delivery code to give the courier, through our SMS gateways; and
- the courier may call the recipient to find the door.
Before you give us someone's details, tell them that you are sending them a box and that we will contact them, and make sure they agree. A gift message you write is kept with the order and may be shown to the recipient.
5. Proof of delivery
At the door, the courier confirms delivery with the code we sent the recipient and photographs the box; the photo may show the recipient or their doorway. Where the delivery platform holds the photo, its links expire after a few minutes, so we keep a copy in our own storage. We show the proof to you on the order page and use it to resolve claims and card disputes.
6. Card disputes
If you dispute a charge with your card issuer, we send the issuer, through Stripe, the evidence we hold about the order: the receipt, the delivery record and the proof-of-delivery photos, the result of any authentication your bank asked for, the country that issued the card, the countries of the IP addresses used, and the version of our Terms you accepted. Stripe and the card networks handle that evidence under their own rules.
7. Who else handles your information
We do not sell your information, and we do not use it for advertising. Besides Stripe and the delivery platform described above, we use service providers who handle information only on our instructions: our hosting and file storage, our email provider (for sign-in codes, receipts and order updates) and our SMS gateways (for the recipient's messages). Each receives only what it needs for that job. We may also share information where the law requires it, or to protect our customers, our staff or Sawghat against fraud or misuse.
8. How long we keep it
- Payment, refund and dispute records, including the card details in section 2 and the country checks in section 3, are order and money records. They are kept for as long as tax, accounting and anti-fraud rules and the card networks' rules require, and then deleted. Stripe keeps its own records under its privacy policy.
- Your account is kept until you ask us to close it. Once it is closed, we delete or anonymise its details, apart from the order and money records we must keep.
- Saved recipients stay in your account until you delete them or close your account. The recipient's details on an order are kept with the order.
- Proof-of-delivery photos are kept with the order they belong to.
- Email sign-in codes are kept only in hashed form and stop working once they are used or expire.
9. Information sent outside your country
If you use Sawghat from another country, your information travels from that country to our servers in the United States and, so that the box can be delivered, to the people in Afghanistan who prepare and deliver it. Stripe processes payment information in the United States and in other countries where it operates. The laws of these countries may protect personal information differently from the law of the country where you live. We use Stripe and our other providers on terms consistent with this policy.
10. Cookies and storage on your device
Sawghat uses only what it needs to work: cookies that keep you signed in (sg_at and sg_rt), one that remembers your language (sg_locale) and one that remembers a completed date-of-birth step (sg_age_gate). Your send basket, an unfinished plan or group gift and an invitation link you followed are kept in your own browser's storage until you place the order or clear them. We use no advertising or tracking cookies.
11. Your rights
You can ask us what information we hold about you, to correct it, to delete it or to close your account, and you can object to how we use it. Write to support@sawghat.com; we may ask you to confirm the request from your account's email address. We answer every request within 30 days. Some records, such as payments and refunds, we must keep for the time section 8 gives even after you close your account. If you are not satisfied with our answer, you may be able to complain to the data protection authority where you live.
12. If you are a recipient
If someone has sent you a box through Sawghat, you do not need a Sawghat account; we do not create one for you, and we do not use your details for marketing. You can write to support@sawghat.com to ask what information we hold about you, to correct it, to stop the messages we send you about future boxes, or to have your details deleted. We may ask you to confirm the request with a code sent to your phone. While a box is on its way to you, we still need to send you its delivery code, and the records of orders already sent to you are kept as section 8 explains. We answer every request within 30 days.
13. Cash for the family
If you add cash for the family to an order (section 18 of our Terms), we keep with the order the amount, any fee, the amount in afghanis, the exchange rate and margin applied, and the record of how the cash was handled: the number of the sealed envelope, which member of staff sealed it and when, who carried it, its delivery with the box and, if the box comes back, when the envelope was returned, the amount counted back at our warehouse and any refund. You see the amount, the afghanis and where the cash is on your order page and in your emails; otherwise only the Sawghat staff who handle the cash or the order see it. The cash is not mentioned in the recipient's text messages, on the box label, or in the information the delivery platform and the courier receive, so that the box is not a target. We use this information to deliver the cash, to account for the cash held at our warehouses, to refund it, to apply our limits per account and per recipient, and to prevent fraud and misuse. It is kept as an order and money record (section 8).