Version 1.0 · Published
Effective date: 2026-10-05
StitchHub connects customers with independent tailors, designers, boutiques, CMT businesses and other stitching providers in Pakistan. This policy explains how personal information is used when you browse, create an account, communicate, place orders or contact us.
The operator responsible for this policy is StitchHub, a sole proprietorship operated by Nabila Sarfraz, at 729 Eden Lane Villas 2, Pine Avenue Rd, Lahore. Contact us through Help, by email at stitchhub4@gmail.com, or by phone or WhatsApp on +92 328 8168169.
Account information includes your name, email, phone number, account role, city and area, and information needed to sign in and manage your account. Providers may also supply business descriptions, service categories, experience, opening hours, portfolio images and qualifications.
Order information includes quotation requests and replies, prices, quantities, delivery dates, fabric arrangements, order status, reviews and communications. Measurements and design information can include body measurements, fit instructions, design references and photographs of handwritten measurement sheets.
If you apply for verification, we collect the documents requested in that process. Submit only the requested proof; do not post identity documents, bank details or certificates containing private identifiers in your public portfolio.
Payment records may include the order amount, transaction reference, payment status, refund and settlement records. While StitchHub is in testing no live payment gateway is connected, so payment records created now are test records. Where a payment partner processes a payment or provider onboarding, it may collect financial or identity information under its own notice. Never send card security codes, banking passwords or one-time passwords through chat.
The app and its infrastructure process IP addresses, browser and device information, timestamps, error records and security logs to operate and protect the service. City and area information supports local search; any precise device-location feature must request permission when used.
Checked in the current app: StitchHub sets no cookies of its own, uses no analytics or advertising tools, and loads no third-party tracking scripts. The app stores your language preference and your saved-providers list in your browser’s local storage, and relies on the sign-in session kept by our hosting platform so you do not have to sign in on every visit. Essential sign-in and security technologies are operated by that platform.
If optional analytics, advertising or other non-essential technologies are added later, this section will be updated and any choice required for that use will be offered before they are used.
We use relevant information to create accounts, display provider listings, match searches, exchange quotations, fulfil orders, share measurements and designs, send service notifications, process payment records, review verification applications and respond to support requests.
We also use necessary records to investigate complaints, prevent fraud and account misuse, maintain security, correct faults and meet applicable recordkeeping or legal requirements. Marketing communications, if offered, will have a separate choice and an unsubscribe route.
Provider profile details, portfolio content and published reviews are visible to people viewing the relevant listings. Provider phone numbers are not intended to be public. Do not put a private number or home address into a public description or image.
The customer and provider on an order can see the information shared for that order. Measurement and design drafts are intended to remain private until Send Changes is used. Shared measurement photos and notes are not public portfolio content.
Ordinary chats are not intended for routine admin browsing. Relevant dispute communications and evidence may be reviewed by authorised staff handling that dispute. Information may also be accessed where necessary for a reported safety incident, a lawful request or essential technical support. This is not a claim of end-to-end encryption.
Checked in the current app: provider listings and provider profiles require a signed-in user and expose only public profile fields — provider phone numbers are not published. Reviews show the customer’s display name. Measurements, design drafts, dispute evidence and chats are limited to the two parties on the order and to authorised staff reviewing a dispute or a reported incident. The app collects no delivery address, so no delivery address is shared through it. These controls will be re-checked whenever the app changes.
StitchHub’s app data and its user records are stored in the United States by Base44, the platform that hosts this app (our hosting platform). Base44’s data-residency setting for this app is the United States, and that setting covers the app’s stored records and its user accounts.
Base44 states that its servers are currently located in the United States, and that media files uploaded to the app, our Base44 account details and billing information are stored in the United States as well and are not moved by the residency setting.
Residency controls where data is stored, not where it is processed: when the app runs, a request may be handled by Base44 services in another region before the result is saved to the United States. We cannot confirm the processing locations used by every supplier behind the app, so we do not claim that all processing happens in the United States.
Base44 states that its vendors who receive personal information are bound by data processing agreements governing transfers to the United States, using approved transfer mechanisms such as adequacy decisions, Standard Contractual Clauses or the Data Privacy Framework, and it publishes a subprocessor directory listing the vendors that handle data. We cannot verify the safeguards of each individual supplier beyond that, and we cannot confirm a complete list of suppliers or processing locations for every service the app uses.
We share necessary information with Base44, the platform that hosts this app, and with the hosting, database, authentication, file-storage and email services Base44 provides for it. Access should be limited to the purpose being performed. No payment partner and no delivery partner receives information from us today, because none is connected or engaged: a future payment or delivery partner must not be described as a current recipient. If one is engaged, this section will name it before it receives any information, and its own legal obligations and privacy notice will apply at that point.
We may disclose relevant records where legally required, to address fraud or security incidents, to establish or defend a legal claim, or as part of a business transfer with appropriate protection and notice. We do not authorise providers to reuse customer information for unrelated marketing.
AI training — our own use, which is separate from Base44’s: we do not use customer or provider content to train AI models, and no feature of the app sends order content to an AI service. Base44’s disclosed use, which we do not control: Base44 publishes a rule that depends on the workspace plan. On Enterprise plans workspace data is not used to train AI models, while on other plans — including Business — workspace data may be used for that purpose. This workspace is not on an Enterprise plan, so under Base44’s published terms the data held in this app may be used by Base44 for that purpose. Base44’s statement covers data submitted through an app’s forms; it does not separately address the prompts and instructions written by a builder. We cannot verify or control Base44’s internal training use, and we will update this section if Base44’s terms change or the workspace moves to a plan where the exclusion applies.
We retain information only for the operational purpose, outstanding order, dispute, security need or legal recordkeeping obligation that requires it. Deleting an account may not immediately remove records needed for these purposes.
Deleted records: our hosting platform documents that deleted records are kept in a recoverable state for 30 days and are then permanently deleted.
Backups: the platform publishes its full backup and data-retention schedule in its Trust Center, and documents automatic app-data backups with a 7-day retention on Elite and 30 days on Business or Enterprise. On our current plan, automatic app-data backup and restore is not included, and the platform does not state whether backup copies are physically deleted at the end of a retention period. We cannot verify a backup-deletion deadline and we do not promise one.
Current retention rule during testing: test accounts, chats, measurement photos, verification records and the files uploaded with them, and simulated payment records are deliberately cleaned up before real customer launch and no later than 21 days after testing ends. Removal from active data, the recovery period that Base44 applies to deleted database records, and the handling of files and backups are three different things: Base44 keeps a deleted database record recoverable for 30 days before permanent deletion, while uploaded files are stored separately from records and Base44 does not publish a file-retention period, and Base44 publishes backup retention for plans that include automatic backups rather than a guarantee that backup copies are erased. We do not promise permanent erasure of copies held by Base44, and we do not state a fixed statutory retention period for records we must keep.
Retained records: the owner and administrator account and the app’s configuration are kept so the service can run. Support conversations, audit entries recording administrative decisions (for example verification, cancellation, dispute and moderation decisions) and security logs are retained while they are needed to evidence what was decided, to handle a related dispute or legal claim, and to meet recordkeeping obligations.
Deletion requests: when you ask us to delete information, we review the request against the records and files under our control and remove what we can. Where we must keep something — for example a record needed to evidence an administrative decision, an open order or dispute, or a legal obligation — we explain what is kept and why. We do not apply a fixed statutory retention period.
What we can remove ourselves: the app’s records and the files uploaded through the app can be managed with the controls available to us, so a deletion request covers those records and files and we remove them where no exception applies. Removing a record and removing the file uploaded with it are two separate steps, because the platform stores uploaded files separately from records, so both are handled deliberately.
What we cannot remove ourselves: platform-level logs, the recovery copies the platform keeps for 30 days after a record is deleted, and any backup copies are held by Base44 and are not reachable through the app’s own controls. We cannot delete those from inside the app. Where a request reaches them, we refer that part to Base44 support and tell you we have done so.
Controls checked in the current app: access to records is restricted by the platform’s role and ownership rules, so a customer, a provider and an administrator can each reach only the records their role allows; verification documents, measurement photos, progress photos and dispute evidence uploaded through the current app are stored privately and opened only through short-lived, authorised links rather than public addresses; provider phone numbers are not published; and administrative decisions are recorded in an admin-only audit log. This lists the controls we have checked in this app, not a claim of complete security.
Known exception we are still resolving: before private storage was introduced, verification files were uploaded to public addresses. Five such addresses are still reachable and their revocation is outstanding, so we do not claim that every historical verification file is already private. We do not publish those addresses here, and we treat the outstanding revocation as an open item rather than a resolved control. If you receive a link to a verification document from outside the app, treat it as unverified and report it to us.
We take proportionate organisational and technical steps to protect information. No online system is entirely risk-free, and we do not claim round-the-clock monitoring, a dedicated security team, or that any incident can be prevented.
Incident response: on learning of suspected unauthorised access or a data leak we will assess the report, restrict the affected access where we can, contact Base44 support, preserve the information needed as evidence, and inform affected users and the relevant authorities where required.
This app is in a testing period. Accounts, orders, messages, reviews, verification records and the files uploaded with them that were created during testing are test data.
Before real customers are served we will remove those test accounts, records and their uploaded files. This is a planned cleanup procedure that we carry out deliberately: it is not an automatic deletion feature and no deadline is applied automatically. It will be completed before launch and no later than 21 days after testing ends.
The owner and administrator account, the app’s configuration and the published policies are preserved. During that cleanup we will deliberately remove both the test records and the files uploaded with them; we do not rely on any automatic link between a record and its file, because the platform stores uploaded files separately from records. As with any deletion, we cannot promise a specific deadline for the removal of copies from the platform’s backups (see Retention and security).
You can correct available profile fields and contact Help, email stitchhub4@gmail.com, or call or WhatsApp +92 328 8168169 to request access, correction, account closure or deletion of your personal information. We may verify your identity using proportionate information before acting. We will explain any records we must retain and any limits that apply.
Privacy requests should be sent to stitchhub4@gmail.com. Our target is to give an initial response within 48 hours. That is a response target, not a guarantee that the request will be resolved within 48 hours: resolution can take longer where records must be retrieved or where an order or dispute is open.
You may withdraw permission for optional uses where provided. This does not reverse processing already performed or prevent necessary order and legal recordkeeping. If you have not received an initial response within 48 hours, follow up by phone or WhatsApp on +92 328 8168169 and refer to your original request so it can be traced; the same number can be used for any privacy question.
Accounts are intended for people aged 18 or over. A parent or guardian may arrange stitching for a child through their own account and should share only the measurements and design details needed for the order. Avoid including a child’s face, school details or unrelated identifying information.
If you upload information about another person, you must have appropriate authority to share it for the order. Contact us if you believe an underage account or inappropriate disclosure has occurred.
Each version of this policy shows the date it was published as its effective date. The effective date of this policy is the date it is first published on this page. Material changes will be communicated through an appropriate app or account notice; a new optional use will not be treated as authorised merely because this notice changed. Privacy questions can be sent through Help, by email to stitchhub4@gmail.com, or by phone or WhatsApp on +92 328 8168169.