Privacy Policy

RateIt
Last updated: 30 June 2026
Effective date: 30 June 2026

This policy explains what data RateIt collects, why, how we protect it, and the choices you have. RateIt is operated from Lahore, Pakistan. Questions about your data go to info@rateit.pk.

1. The honest state of the law

Pakistan does not yet have a comprehensive data protection law in force. The Prevention of Electronic Crimes Act 2016, amended in 2025, is the main statute that addresses misuse of data, but it is a criminal law, not a general privacy framework. A Personal Data Protection Bill has been in draft for several years and has not been passed by Parliament. There is, at present, no national data protection authority in operation.

We tell you this plainly because we would rather you understand the real position than read a policy that pretends a law exists. In the absence of a comprehensive statute, RateIt chooses to follow recognised data protection principles, consent, purpose limitation, data minimisation, security, and giving you control over your own data. If and when Pakistan enacts a data protection law, we will update this policy to comply with it.

2. What we collect

We collect only what the service needs.

To create your account and verify identity: your phone number, and your email address if you sign in by email. Verification uses a one time code. Your phone number is the core of your identity on RateIt because the platform exists to fight fake and anonymous abuse, so a verified phone is what separates a real account from a throwaway one.

Your public profile: a system generated handle, and anything optional you add such as an avatar, your city, and your language preference. We generate the handle so that your real name is never required to be public.

Your reviews and the proof behind them: the rating, the text, photos you attach, and proof artifacts you submit such as a consignment number, a wallet or transaction reference, or a receipt image. Proof artifacts can contain sensitive details, so we store them privately and use them only to verify the review.

Fraud and safety signals: device and technical signals, including a device fingerprint, used to detect fake reviews, review rings, and abuse. This is core to the integrity of the platform.

Usage data: basic logs and analytics needed to run and secure the service.

We do not collect your CNIC unless a specific verification step requires it, and where we do, we store it in a protected, non public form.

3. Why we collect it

To run the service: to create your account, publish your reviews, show businesses and their trust scores, and let businesses respond.

To verify and to fight fraud: to assign proof tiers, compute trust scores, detect fake reviews and review manipulation, and protect both consumers and honest businesses. This is the heart of what RateIt does.

To communicate with you: to send sign in codes and service messages.

To comply with the law: to respond to lawful orders and meet our obligations under Pakistani law.

We rely on your consent when you sign up and submit content, and on our legitimate interest in running a safe, fraud resistant platform.

4. What is public and what is not

Public: your handle, your reviews, your ratings, photos you attach to a review, and your reviewer reputation.

Private, never shown publicly: your phone number, your email, your real name if we ever hold it, your CNIC if ever collected, proof artifacts such as receipts and transaction references, and fraud and device signals. Access to these is restricted, and even our own staff reach the most sensitive records only through controlled, logged paths.

The point of RateIt is public, verifiable trust. The verification details that make a review trustworthy stay private; only the fact and tier of verification is shown.

5. Where your data is processed

RateIt is built on third party services, and some of them process data outside Pakistan. We tell you this honestly so you can make an informed choice.

Our database and file storage are hosted on Supabase, in the Singapore region. Our website is hosted on Vercel. Domain and network protection use Cloudflare. Sign in and service emails are sent through Resend. Review moderation uses Anthropic and Voyage AI to help detect policy violations and near duplicate or fake reviews.

This means your data, including review content and the technical signals described above, may be transferred to and processed on servers outside Pakistan operated by these providers. We choose providers that we consider to apply strong security practices. Because there is no Pakistani law currently restricting cross border data transfer, this is permitted, but we disclose it so your consent is informed.

6. How long we keep it

We keep your account data while your account is active. Reviews are kept as part of the public record of a business even after you close your account, in an anonymised form, so that the trust history of a business is not erased by individual account deletions. When you delete your account we remove or anonymise your personal identifiers, the link between you and your reviews is severed, your handle is removed, and your phone, email, and any sensitive fields are deleted or anonymised. The review text itself may remain, detached from you.

We keep fraud and safety signals for as long as needed to protect the platform.

7. Your choices

You can edit your profile, your handle, avatar, city, and language, at any time.

You can delete your account, which triggers the anonymisation described above.

You can contact us at info@rateit.pk to ask what we hold about you or to raise a concern.

Because your phone number is your verified identity, changing it is treated as a security sensitive action.

8. Security

We protect data with access controls, restricted privileges on sensitive fields, encrypted transport, and logged access to the most sensitive records. No system is perfectly secure, and we cannot guarantee absolute security, but we design the platform so that the most sensitive data is the hardest to reach. There is currently no mandatory data breach notification law in Pakistan; even so, if a breach affected your data in a way that posed real risk to you, we would aim to inform you.

9. Children

RateIt is not for anyone under 18. We do not knowingly collect data from people under 18. If we learn that we have, we will delete it.

10. Changes to this policy

We will update this policy as our practices and Pakistani law change, including if a data protection law is enacted. The date at the top shows the latest version.

11. Contact

Questions about your data: info@rateit.pk
Complaints and removal requests: complaints@rateit.pk

This policy reflects the law of Pakistan as understood at the date above, including the fact that no comprehensive data protection statute is yet in force and that PECA 2016 as amended in 2025 is the governing instrument for data misuse. It is not legal advice. RateIt should have this policy reviewed by a qualified Pakistani lawyer, and should revisit it if the Personal Data Protection Bill is enacted.