Diwan
Privacy Policy
Effective 7 September 2026 · Last updated 7 September 2026
On this page
1. Who we are
Diwan is point-of-sale software operated by Hamza Waheed, an individual sole proprietor trading as “Diwan”. Diwan is not a registered company; it is operated by an individual in his personal capacity. Throughout this policy, “we”, “us” and “our” refer to that sole proprietorship.
We are the data controller for the personal data described below. Our contact details are in section 14.
2. What we collect
We collect only what we need to sell you a licence, deliver it, and support it.
| Account data | Your email address, and a one-way cryptographic hash of your password. We never store your password itself and cannot read it. |
|---|---|
| Order data | Your phone number (collected at checkout), the product purchased, the amount and currency, our own order reference, and the payment processor’s transaction identifier. |
| Licence data | A cryptographic hash of your licence key, an encrypted copy of the key so we can re-send it to you from your dashboard, the first segment of the key for support lookups, and the dates on which it was issued and activated. |
| Device data | A hashed device identifier and a short, coarse description of your operating system, such as “Windows 11 x64”. See section 5. |
| Technical records | IP addresses recorded against sign-in attempts, licence activation attempts, download requests, and password-reset or email-verification link requests. We use these solely to rate-limit abuse and to investigate suspected fraud. |
| Support correspondence | Emails you send us, and our replies, so we have a record of your issue. |
3. What we never collect or store
We never see or store your card details. Card numbers, expiry dates and security codes are entered on our payment processor’s own hosted page and are transmitted directly to them. They never pass through, and are never stored on, our servers.
We also do not collect:
- Your password in readable form — only a one-way hash.
- The raw hardware or device identifier of the computer you install on.
- Any of the business data you enter into Diwan itself — your sales, stock, customers and pricing stay on your own device. Diwan is offline-first and does not upload your trading data to us.
- Location data, contacts, browsing history, or advertising identifiers.
4. Why we collect it
- To fulfil your order — to take payment, issue a licence key and email it to you.
- To manage your licence — to let you retrieve your key, download installers, and activate the software.
- To enforce licence terms — to ensure one licence key activates on one device, as described in our Terms & Conditions.
- To provide support — to identify your order when you contact us.
- To prevent abuse and fraud — to rate-limit repeated failed sign-ins, activations and downloads.
- To meet legal and accounting obligations — to keep records of sales as required by law.
5. Device activation data
Diwan licences are locked to a single device. To make that work, the application calculates an identifier for the computer it is running on and sends it to us when you first activate.
We never receive your raw device identifier. The application hashes it before it leaves your computer, and our server hashes it again before storing it. What we hold is a value that lets us recognise the same device presenting the same licence key — and nothing more. It cannot be reversed to reveal your hardware, and it cannot be used to identify you anywhere else.
Alongside it we store a short, plain-text description of the platform, capped at 64 characters — for example “Windows 11 x64”. This exists only so that our support team can tell you which device your licence is currently bound to when you ask us to move it.
6. Who we share it with
We do not sell your personal data, and we do not share it for advertising. We share it only with the following, and only to the extent needed:
- Our payment processor — to take payment and to process refunds and disputes. They receive your email address and the order amount; they handle your card details independently of us under their own privacy policy.
- Our email provider — to deliver your licence key, email verification links and password reset emails.
- Our hosting provider — which stores the database and server logs on our behalf.
- Legal authorities — where we are required by law to disclose information, or where disclosure is necessary to establish or defend a legal claim.
7. How long we keep it
| Account and licence records | For as long as your account exists, and for 7 years after your last purchase, to meet tax and accounting record-keeping obligations. |
|---|---|
| Order and payment records | 7 years from the date of the transaction, for the same reason. |
| Activation and download attempt logs | Automatically deleted after 1 hour. These exist only to enforce rate limits. |
| Sign-in attempt records | Retained for up to 90 days, then deleted. |
| Raw payment notification records | Retained for up to 12 months for reconciliation and dispute handling, then deleted. |
| Support correspondence | Retained for up to 3 years from the close of your enquiry. |
8. Your rights
You may ask us to:
- Give you a copy of the personal data we hold about you.
- Correct anything that is inaccurate.
- Delete your personal data, subject to the limits below.
- Stop using your data for a particular purpose.
Email us at hamzawaheed057@gmail.com from the address on your account. We will respond within 30 days.
Two honest limits on deletion. First, if you hold an active licence, deleting your licence record will stop that licence working — we cannot delete it and leave your software running, so we will ask you to confirm you understand that before proceeding. Second, we are required to keep records of completed sales for 7 years for tax purposes, so we cannot delete order records within that period. We can, however, delete your account, your contact details and your support history at any time.
9. Cookies
We use a single cookie: a session cookie that keeps you signed in while you use your dashboard. It is deleted when you sign out or when your session expires.
We do not use analytics cookies, advertising cookies, tracking pixels or third-party trackers of any kind on this website.
10. International transfers
We operate from Pakistan. Our payment processor, email provider and hosting provider may process and store data on servers outside Pakistan. Where that happens, we rely on those providers’ own contractual safeguards for international transfers.
11. Security
The website is served over HTTPS. Passwords are stored only as one-way hashes. Licence keys are stored hashed, with a separately encrypted copy used solely for re-sending them to you. Device identifiers are double-hashed. Our application code and configuration files are stored outside the public web directory and are not reachable by URL.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you without undue delay.
12. Children
Diwan is business software sold to traders. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
13. Changes to this policy
If we change this policy we will update the “last updated” date at the top. Where a change materially affects how we use your data, we will email account holders before it takes effect.
14. Contact us
For any privacy question, or to exercise any right above:
Hamza Waheed (sole proprietor, trading as Diwan)
Email: hamzawaheed057@gmail.com
Phone: 0314 3288112
I-10/2, Islamabad 44000, Islamabad Capital Territory, Pakistan