Jointt (Private) Limited (“Jointt”, “we”, “us”, or “our”), company registration number 0336117, NTN J015187, operates the Jointt customer mobile application and the website at www.jointt.pk (together, the “Service”). This Privacy Policy explains what information we collect about you when you use the Service, why we collect it, who we share it with, how long we keep it, and the choices you have.
This policy covers shoppers. Riders and brand partners who use the Jointt Rider and Jointt Merchant apps are covered by our separate Rider & Merchant Privacy Notice. By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.
We collect only what we need to run a fast, safe on-demand shopping service:
We do not collect biometric data, your contacts, or your photo library beyond the individual photos you choose to send us. We do not knowingly collect health, religious, or other sensitive categories of data.
We contact you in two different ways, and you control the second one:
Login OTPs, order confirmations, delivery OTPs, rider updates, refund notices, support replies, and important changes to our terms. These are sent by SMS, WhatsApp, email, or push notification to the contact details on your account. They are not marketing and you receive them as long as you have an account and active orders.
Offers, coupon codes, new-store announcements and reminders. We send these only to customers who have opted in, and never to anyone who has asked us to stop.
We do not sell, rent, or lease your personal data to anyone, and we do not share it with advertisers or data brokers. We share it only with the parties needed to serve you:
To make the catalogue easier to browse we use Google Vertex AI Search for Retail. It receives a record of the products you view, search for, add to cart and buy, linked to your device identifier and, when you are signed in, your account ID — never your name, phone number or address. It uses that activity to rank products and suggest similar items. This affects only what you see first; it does not change prices, and it never makes a decision that has a legal or similarly significant effect on you.
Our fraud checks are also automated in the first instance, but no order is refused and no account is suspended on that basis without review by a member of our team, and you can always ask us to reconsider (section 8).
We protect your data with Transport Layer Security (TLS) encryption in transit, encryption at rest, automated backups, firewalled infrastructure, role-based staff access, and login by one-time password rather than stored passwords. Card payments are handled entirely on the bank's certified payment page.
No system is completely secure. You can help by never sharing your login or delivery OTP with anyone other than the assigned rider, and by contacting us straight away at privacy@jointt.pk if you think your account has been accessed without your permission. If a security incident ever affects your personal data, we will tell you and any relevant authority without undue delay.
Your data is yours. You can exercise any of the following at any time, free of charge:
Email privacy@jointt.pk from the address or phone number on your account and we will respond within 30 days. We may ask you to confirm your identity first, so that nobody else can request your data. We will never treat you differently for exercising a right.
A cookie is a small file a website stores on your device. We use two kinds, and only one of them is optional:
Keep you signed in, hold your basket between pages, remember your delivery location, and protect against fraudulent requests. The site cannot work without these, so they are not optional.
We use Google Analytics 4 (Google LLC) to count visits and see which pages and products people use. It records pages viewed, approximate location, device and browser type, with your IP address truncated before storage. It never receives your name, phone number or payment details.
Analytics does not run unless you accept it. Until you choose, and if you decline, no analytics script is loaded and no analytics cookie is set. You can change your mind whenever you like:
The mobile app does not use cookies or advertising identifiers. You can also block or delete cookies in your browser settings; blocking strictly necessary cookies will stop you signing in or checking out.
We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires:
| Account details, saved addresses, carts, wishlist | Until you delete your account |
| Order, invoice, payment and J.Points recordsRetained after account deletion, as tax and accounting law requires | 6 years |
| Support conversations and claim photos | 24 months |
| Delivery location data | 12 months |
| Browsing and recommendation activity | 12 months |
| Crash and diagnostic logs | 90 days |
| Push-notification tokens | Until you sign out or delete the app |
| Website analytics data | 14 months |
When a retention period ends, data is deleted or irreversibly anonymised. Where we are investigating fraud, a payment dispute or a legal claim, we may keep the specific records involved until the matter is closed.
Jointt (Private) Limited is based in Karachi, Pakistan, and that is where we operate. Some of the providers we rely on — Google Cloud, Firebase, Vertex AI, Google Maps, Meta (WhatsApp), and Sentry — process data on servers outside Pakistan. Where data leaves the country, we use only providers that commit contractually to protect it to the standard described in this policy, and we share the minimum needed for them to do their job.
Jointt is for adults. Our Terms of Service require account holders to be at least 18, and we do not knowingly collect data from anyone under 18. If you believe a child has given us their information, email privacy@jointt.pk and we will delete it.
The Service may link to brand partners' websites, social media pages, or the bank's payment page. Those sites have their own privacy policies, which we do not control. The Apple App Store and Google Play also collect their own data when you download or update the app, under their respective policies.
We update this policy when our practices change. The “last updated” date at the top of the page always reflects the current version. If a change materially affects how we use your data, we will tell you in the app, by email or by WhatsApp before it takes effect, so you have the chance to object or close your account.
Questions about this policy, or about how we have handled your data, go to our privacy contact at privacy@jointt.pk, or by post to Jointt (Private) Limited, Suite 502, Bali Business Boulevard, DHA Phase 2 EXT, Karachi 75500, Pakistan. We aim to acknowledge complaints within 3 working days and resolve them within 30 days. If you are not satisfied with our answer, you may raise the matter with the relevant authority in Pakistan.
Want to request account deletion or export your profile data? Our privacy team will acknowledge your request within 48 hours.