Privacy Policy

This policy applies to our website, the web app (PWA), the dashboard, public pages built on Kioar and the student area for courses. “We” means Kioar (the brand and platform operated by Rahpouyan Khallagh Ayandeh Co.), “Page Owner” means a user who creates an account and page, and “Visitor” means anyone who views a Page Owner’s page or submits a form, booking or registration on it.

Our role depends on the data. For a Page Owner’s own account and billing data we are responsible for the processing. For data that Visitors submit on a Page Owner’s page (for example a name and phone number in a form or booking) we store it on behalf of, and on the instructions of, that Page Owner, who decides why and how it is used.

1. Information you give us

• Account data: mobile number (used to sign in with a one-time code), optionally an email address, first and last name, and a profile picture.
• Page content: page name and address (slug), bio, links, images, products, menus, templates and appearance, and booking, form and course blocks.
• Business data, if you provide it: business details, a custom domain, payment methods shown to your visitors (such as a card or account number) and tax settings.
• Messages you send to support (Telegram, email, phone or the help form).

2. Information your Visitors submit

• Form answers, booking details (name, mobile number, time and type of session), course and event registrations, and payment receipts.
• Any identifying information that a Page Owner chooses to request; the Page Owner is responsible for not asking for unnecessary or sensitive data.

3. Information collected automatically

• Technical and security data: IP address, browser and device type, sign-in time and security events (to prevent abuse and rate-limit requests).
• Aggregated (daily) page-view and link/product click statistics and, where possible, approximate location (city/country) derived from IP, to show reports to Page Owners.
• An anonymous visitor identifier (cookie) used to count unique visitors, without storing a name or phone number.

4. Payment information

Online payments are processed through the Zarinpal payment gateway. Full card numbers, PINs and CVV codes are never entered into Kioar and we do not receive or store them; we keep only the transaction result, amount, reference number and invoice details. If a Page Owner enables “card-to-card” payment, the payment is made directly between the Visitor and the Page Owner and Kioar is not a party to that transaction.

We do not intentionally ask for the sensitive categories of data covered by Article 58 of the Electronic Commerce Law (such as racial or ethnic origin, religious belief, or physical, mental or sexual condition). Page Owners are likewise required not to collect such data from Visitors without their explicit consent.

• To build and show your page, run bookings, forms, courses and payments, and provide the dashboard.
• To authenticate you and keep sessions safe: sending one-time codes, detecting suspicious sign-ins and preventing fraud and abuse.
• To issue invoices, send renewal and trial-ending reminders, and handle payments and refunds.
• To send transactional SMS and notifications (sign-in codes, booking confirmations, session reminders, payment receipts). Kioar’s SMS number is not used to send advertising to your Visitors.
• To provide support, fix errors, improve the product and understand overall usage.
• To meet legal obligations and respond to competent judicial and law-enforcement authorities.
• To send product announcements and offers to account holders; you can opt out at any time.

We do not sell your or your Visitors’ personal information and we do not provide it to third parties for their advertising.

Page Owners are legally responsible for the lawfulness of how they collect and use their Visitors’ data. Page Owners must:

• request only information needed to deliver their service and tell the Visitor why it is needed;
• obtain consent before sending promotional messages and offer a way to opt out, in line with advertising and e-commerce law;
• not use or publish Visitor data for any purpose other than the one disclosed, or contrary to law;
• respond to Visitor requests for access, correction or deletion.

If you are a Visitor and want your information removed from a page, contact that Page Owner first. If you get no response, contact us using the details below and we will help within our technical and legal powers.

We share information only in the following cases and only as far as necessary:

• Payment gateway (Zarinpal): to process online payments.
• SMS provider (Kavenegar): to deliver sign-in codes and transactional messages; the recipient number and message text are sent to it.
• Storage and infrastructure: our database, file storage and servers are hosted in data centres located in Iran.
• Analytics: we use a self-hosted, open-source analytics tool that runs on our own infrastructure and does not send data to advertising networks.
• Optional integrations: if you connect Google Calendar/Meet, Zoom, Instagram or a similar service, the data needed for that feature is exchanged between us and that service. You can revoke access at any time. Connection credentials are stored encrypted.
• Authorities: when required by an order or lawful request from a competent judicial or law-enforcement authority.
• Business transfer: in a merger or transfer of the business, subject to this policy and with prior notice.

Some features (such as extracting a menu from an image or enhancing a product photo) send the relevant content, for example that image or text, to third-party AI model providers outside Iran for processing, and only when you run the feature. We do not use this content to train our own models and we do not keep it longer than needed to deliver the result. Please do not upload other people’s personal data or confidential information to these features.

Kioar does not install an offline-caching service worker on your device. We use cookies and browser storage for:

• Essential: the sign-in session (kioar_session, stored hashed), your active page, and short-lived cookies that resume flows such as bookings, forms and registration after sign-in. The service does not work without them.
• Analytics: an anonymous visitor identifier (kioar_vid) to count unique visitors.
• Referral and campaigns: storing a referral code or traffic source (kioar_ref, kioar_attr, kioar_cmp) to calculate referral rewards and assess campaigns.
• Local preferences: such as the timezone you choose in a booking, kept on that device.

You can delete or block cookies in your browser settings; parts of the service, such as signing in, may then stop working.

Kioar’s core data is stored on servers and databases inside Iran. We use encrypted connections (HTTPS), hashed session tokens, role-based access control, rate-limiting (for example on one-time codes) and regular backups. Staff access is limited to what their work requires and authorised personnel are bound by confidentiality.

No system is entirely risk-free. Protecting your device and sign-in codes is your responsibility; tell us immediately if you suspect unauthorised access.

• While your account is active we keep your account and page data.
• When you request deletion, we delete or anonymise your account, page and related content. Records the law requires us to keep (such as invoices, financial and tax records, and logs needed to investigate fraud or to answer authorities) are kept until the legal period ends.
• Aggregated statistics that cannot be tied to an individual may remain.
• Backups expire on their normal cycle.

At any time, through account settings or by contacting us, you can:

• view and correct your account and page information;
• export a copy of your data (such as contacts, bookings and form responses);
• request deletion of your account and data;
• stop marketing messages or revoke connected third-party services.

We normally review requests within a few business days. For security we may ask to verify the account holder’s identity first.

Kioar is not designed for independent use by anyone under 18. If we learn that data of a person under 18 was registered without the permission of a parent or legal guardian, we will delete it. If you are a guardian and believe this has happened, please contact us.

We may update this policy, for example when new personal-data protection legislation is enacted in Iran or when we add features. The new version will be published on this page with its date, and for significant changes we will notify you in the dashboard or by SMS. Continuing to use Kioar after publication means you accept the new version.

If the Persian and English versions differ, the Persian version prevails.

For any question or request about privacy, contact Rahpouyan Khallagh Ayandeh Co. (National ID 14012238860), operator of the Kioar brand: email hello@kioar.com, phone 021-91557675, address: No. 14, Pakistan St., Shahid Beheshti Ave., Tehran, Iran, postal code 1531715513.