Last updated: 29 October 2026
This policy describes information processed through epagespk.com. Contact the ePagesPK team at business@epagespk.com about privacy, access, corrections or removal. Business contact information can also identify an individual; publishing it online elsewhere does not remove privacy concerns.
1. Information we handle and its sources
- Accounts: name, email, account type, password hash and session information when you register or sign in.
- Booking requests: your account name and email, contact phone, selected service/product, requested time, quantity, listed price, accepted booking conditions, optional message and request status. These records are shared with the selected business’s authorised manager and our administrators to handle the request. Service notifications are sent to your account email and the business’s configured notification email through our email provider. Booking records are not public directory content. Do not submit medical histories, patient documents or other sensitive information in booking messages. Cancellation changes the request status; it does not delete its saved history.
- Business submissions and profiles: business/representative name, business contact details, address, selected map point, services, opening hours, description, links and uploaded media. These may come from a representative, earlier directory records or publicly accessible online business sources. A researched profile is not necessarily claimed or authorised by the business.
- Reviews and support: ratings, comments, review dates, correspondence and evidence needed to investigate a request. Public review names are shortened where possible; the associated account remains identifiable to our administrators.
- Browsing and technical data: visited paths, visit dates and times, page/business identifiers, browser-generated visitor/session identifiers and operational/security logs. Our first-party visit endpoint stores hashed visitor/session identifiers; these are pseudonymous, not a promise of complete anonymity. Hosting and enabled third-party services may also receive IP addresses and browser/device information.
2. What becomes public
Published business names, descriptions, business contact details, addresses, selected locations, hours, services, media and reviews may be visible to anyone and appear in search engines. Account passwords and unpublished submission media are not intended for public display. Do not include a home address, personal number, patient/customer details or other sensitive information in public fields unless you have an appropriate basis and intend it to be published.
Quotation/product enquiries: your account name and email, phone, selected item, quantity, requirements, optional service/delivery location and the business’s replies or quoted total are saved privately and shared with the selected business’s authorised manager. Email notifications are sent to your account email and the configured business email. An enquiry does not reserve a time, stock or payment and does not automatically expire after 24 hours. Cancelling or closing it preserves its saved history. Do not send medical histories, confidential documents or unnecessary personal information. Enquiry drafts may be saved in your browser tab for up to 30 minutes when continuing through login, and are removed after successful sending or when read as invalid/expired; browser session restoration may retain local storage copies.
Google sign-in: if you choose Google, we receive your verified Google identity identifier, email and basic profile name to create or link your ePages account. Existing password accounts must be authenticated before linking. Google sign-in does not grant Calendar access and does not change your existing password or business ownership.
Optional Google Calendar connection: an approved business owner can separately authorise creating and managing an ePagesPK secondary calendar. We store the Google account identifier/email, calendar identifier and encrypted offline access token. Confirmed appointment service names, customer names and reserved times are sent to that calendar; quotation enquiries, message text and pending appointments are not sent. Website cancellations remove the corresponding event. This is one-way sync: personal events or edits in Google are not imported into ePages availability. The connection is used only to provide the requested calendar feature, not advertising, sale of Google data or training general-purpose AI models. Disconnecting deletes this business’s saved token and stops future sync, but retains existing Google events and connection history. An already-running sync may finish. You can revoke access in your Google account’s third-party connections; doing so may affect all your businesses connected through ePages. Contact us to request removal of remaining connection records. Google API data use follows the Google API Services User Data Policy, including its Limited Use requirements.
3. How we use information
We use information to operate search and profiles, manage accounts and submissions, send service/approval messages, investigate errors and complaints, administer paid services, prevent abuse and understand directory usage. New-submission details may be emailed to our authorised team members for review. This policy is not consent to unrelated marketing or permission to use third-party material unlawfully.
Private chat: signed-in customers and authorised managers of an approved business can exchange plain-text messages. We save the participants, business, messages, timestamps, read position and block settings. Your account name is visible to the other participant; your account email is not automatically shown in chat. Conversations are not public or end-to-end encrypted; authorised service administrators may access stored records for support, security or legal requests. Do not send payment-card details, medical histories, passwords or sensitive documents. Blocking prevents new messages but does not delete saved history. Contact business@epagespk.com to report abuse or request access, correction or removal.
Optional phone notifications: when you explicitly enable alerts, we save an encrypted browser push subscription linked to your current login and its expiry. The browser’s push provider (such as Apple, Google or Mozilla) receives encrypted notification deliveries and connection metadata. Notification previews contain only a generic new-message or appointment alert, not message text, names or contact details. You can disable alerts in your account or device settings; signing out removes subscriptions for that login where the service is available. A delivery already in progress can still arrive. Re-enable after signing in again. Subscriptions expire with the login; notification job records are cleaned up after seven days when delivery processing runs. Chat and booking history is retained separately until removed under our retention process. Mobile notifications depend on supported devices, installation, permissions, connectivity and system settings and are not guaranteed.
4. Cookies and browser storage
Signed-in accounts use a session cookie. Favourites, recently visited businesses and first-party analytics identifiers use browser local/session storage. Recent-history display is limited to recent entries; the browser’s stored copy can remain until replaced or cleared. Clear this site’s cookies/storage in your browser to remove local copies; this may sign you out and remove saved favourites. It does not delete server-side records.
If you continue a booking through login, the selected item, date/time, quantity, contact phone and optional message are saved in that browser tab’s session storage so you can resume. The resume window expires after 30 minutes; the draft is removed after a successful request or when an invalid/expired draft is read. Closing the tab normally clears session storage, although browser session restoration may retain it. Booking drafts are not placed in login URLs, do not contain passwords, and are never submitted automatically after login.
Google Analytics/Google tags or other scripts enabled by the site administrator may use their own cookies or identifiers and send information to their providers. Browser blocking/privacy settings can affect these scripts. This policy page is a disclosure, not a consent-management system; where prior consent is required, non-essential tracking must be configured accordingly.
5. Location, maps and external services
When a business representative actively searches for an address, the entered search text is sent to Photon (photon.komoot.io), an OpenStreetMap-based geocoding service, to return matches. Selecting “Locate me” requests browser permission to obtain device location; the selected map point is submitted with the business if you save it. You can decline geolocation and choose the point manually. Map tiles may load from third-party servers, which can receive connection data.
Opening Google Maps directions, WhatsApp, a business website or a video link connects you to the relevant provider. Hosting, database, email, mapping, analytics and media providers process information as needed for their services, potentially outside Pakistan. Their own policies apply to their processing. We may disclose relevant information where required by applicable law or reasonably necessary to address fraud, security or rights complaints.
6. Retention and security
We retain account, listing, submission, review and support information while needed to run the service and handle contractual, security, dispute or legal obligations. Deactivation hides a listing but does not erase it. Backups, logs and third-party caches can retain copies after a change; deletion is not necessarily immediate across every system. We do not currently promise a fixed automatic deletion period for all server records.
Access controls, password hashing and secure connections help protect information, but no service can guarantee absolute security. Do not send account passwords, full payment-card information or unnecessary identity documents to support.
7. Your choices and requests
You can manage linked approved business information after signing in. For access, correction, account closure, deletion, a private-contact concern or an unclaimed listing, email us with the specific URL, requested change and enough information to establish your connection to the business. We may ask for proportionate verification and retain a limited record of the request where needed. Do not attach identity documents unless we request a suitable secure verification method.
You do not need to buy a paid plan to raise a privacy or correction request. We assess requests under applicable law and any legitimate need to retain records. External search engines and websites control their own cached copies. See our listing & removal process.
8. Children and policy changes
Account and business-management features are intended for adults or appropriately authorised representatives, not for collecting children’s personal information. Contact us if such information has been submitted improperly. We will update the date on this page when this policy changes.