Privacy

Who runs this site

Pakistan360 — pakistan360.online, its city sites, and the city domains that lead to them, such as murreeview.com — is a directory of businesses and services with reviews, a map, directions and advertising. It is run from Pakistan, and its servers are rented from Scaleway, a hosting company, in France.

Questions about this page, and requests about your own data, go to Haris at admin@murreeview.com, who answers within 24 hours.

Most listings here were not submitted by the business

Pakistan360 is built largely from OpenStreetMap, an open map that volunteers contribute to and which is published under the Open Database Licence. The great majority of the businesses on this site were listed from that data. Nobody at Pakistan360 asked them first, and most of them do not know they are here.

If there is a page about you or your business and you want it taken down — Every listing carries a Take this page down link, and you do not need an account to use it. You will get a reference number and a timestamp. Requests go to Haris (admin@murreeview.com), who answers within 24 hours.

A takedown request itself — your name, email address, phone number if you give one, what you tell us, and a one-way hash of the internet address it came from — is seen by the staff who handle it and kept as the record of what was asked and what was done.

If you make an account

We hold your name, your email address, the language you chose, and your password — the password only as a hash, which means we cannot read it and neither can anybody who takes a copy of the database. We hold what you post: reviews, photographs, comments, corrections, suggested edits, and any lists and day-out routes you make.

When you create an account on the website we record that you agreed to the terms and to this page, which version of them, when, and a one-way hash of the internet address you did it from.

You keep the copyright in your photographs. Publishing one here gives us permission to show and resize it, which is set out in full on the terms page — this page is about what we hold, not about what we may do with it. Every photograph is re-encoded when it arrives, which removes the hidden details a camera stores in the file — including where it was taken.

A review posted anonymously hides your name from other readers. It stays linked to your account internally — This is because a review nobody can be held to is a review anybody can write forty of. Moderators can see who wrote it.

What is public: a review shows your name unless you post it anonymously, and a list you choose to share shows your name. A service provider's profile — phone numbers, WhatsApp, email, the areas they cover — is public because showing it is what the profile is for. The owner of a listing sees its reviews, and the weekly summary we email owners names the people who reviewed them, except those who posted anonymously.

Other things you may send us

• Claiming a business: the phone number we may call to check the claim, anything you write as evidence, and a record of the check.
• Applying to run a city: your name, email address, phone number, and what you tell us about yourself and your plans. Only the platform team sees it.
• Feedback: your message, your email address if you give it, the page you were on, and your browser's description of itself.
• The mobile app: for each device you sign in on, its name, platform and app version, when it was last used, and a sign-in token that expires after 180 days (14 days on staff devices).
• Staff: the role and city each person works in, and, for staff using the field tools, the position recorded with each visit they make.

Advertising and payments

If you advertise, we hold your company name and phone number if you give them, your adverts and bids, and a ledger of every rupee in and out of your advertising balance.

Paying by bank or mobile-wallet transfer: the method, the amount, the reference we gave you, the transaction ID you type, a note if you add one, and a screenshot if you attach one. The screenshot has no web address. It is kept outside the website, and only the staff who confirm payments can open it.

Paying cash at one of our offices: the amount, the office, and the member of staff who took it.

Card payments are not switched on. Where they are, your card is typed into the card company's own page, never into ours: we never see or keep a card number. We send it our reference, the amount, and your email address for its receipt, and we keep the payment ID, the amount charged, the fee and the outcome it reports back.

Payment records are financial records. They are kept, and an account that has them can be anonymised but not erased.

Your location

If you let your browser share your location, we keep it in a cookie on your device (p360geo) for up to 365 days, so the site can show the city you are in without asking every time.

It is rounded to about 110 metres before it is stored — This is deliberate: the cookie exists to decide which city you are in, and a city is not a hundred metres wide. We do not want your street address and have made sure we cannot have it.

Being exact about a thing it would be easy to be vague about: a cookie is sent to our server with every request you make, so those rounded coordinates do reach us. We use them to choose which city to show you and we do not write them into any table. Clearing your cookies removes it.

When you ask for places near you or for directions, your browser sends your position with that request, more precisely. It is used to answer that request and is not stored — not in our database, and not in our server logs, which leave out everything after the "?" in an address.

Internet addresses

When somebody does something consequential here — posts a review, edits a listing, approves a claim, files a money entry — we record what was done, by whom, when, and the internet address it came from. That record is how a wrong decision can be traced back a year later by somebody who was not there.

The address itself is deleted after 90 days. What remains is a one-way hash of it, which cannot be turned back into an address and is used for exactly one question: whether two accounts have been seen at the same address, so that somebody cannot quietly approve their own claim. Counting advertising views and clicks only ever stores the hash, never the address.

To stop people hammering the sign-in form and similar pages, we count attempts per address, and sometimes per email address. Those counters are deleted within 3 days of the last attempt.

An address that sends far more requests than a person could is shown to our staff, with the pages it asked for and its browser's description of itself, for 24 hours.

Like every website, ours keeps a technical log of requests: the time, the page asked for without anything after the "?", your browser's description of itself, and only the first half of your internet address. It is used to keep the site running, is kept to a fixed size, and is overwritten as new requests arrive.

Email and notifications

We email you to confirm your address, to reset a password, and about things that concern you: a reply to your review, a decision on your claim, your adverts, and your payments. You choose which of those you want, by email and in the browser, on the notifications page — except payment receipts, which are your record that money arrived and are always sent. Business owners get a weekly summary with a one-click way to stop it.

If you allow notifications in your browser, we keep the address your browser gives us for them. Your browser's maker runs the service that carries them; it cannot read what we send. Notifications you have read are deleted after 120 days.

Cookies

A session cookie (p360sid) so the site knows you are signed in, which ends when you close your browser; a keep me signed in cookie (p360remember) if you ask for one, which lasts 30 days; and the location cookie above. The site also keeps two small preferences in your browser for the length of a visit, and stores its own files for use when you are offline. Advertising on this site is sold and served by us, so there are no third-party advertising or tracking cookies to consent to.

Who else sees any of this

• Our own staff, each only for the work they do: moderators see what they moderate, city staff see their city, and the people who confirm payments see payments. Their decisions are written to a change log with their name on them.
• Our hosting company, whose servers in France hold the site and its database, and our mail server, which sends the emails above.
• The map, the search and directions all run on our own servers. Your browser loads nothing from any other company when you use this site, except when you follow a link or a share button to another site.
• Anybody with a lawful order: we hand over data when a court or another authority in Pakistan lawfully requires it, and not otherwise.

How long

• Internet addresses in our records: 90 days, then only the one-way hash.
• Attempt counters: up to 3 days after the last attempt.
• Notifications you have read: 120 days.
• Backups of the database and of uploaded files: 14 days.
• Identity documents: we do not collect any. If we ever do, this page will say so first; the system is built to destroy them 180 days after upload.
• Your account and what you post: until you ask us to remove them. Payment records and the change log: kept.

Your data, your requests

You can ask us for a copy of what we hold about you, to correct it, or to delete your account. There is no button for these yet; write to us and we will do it.

Deleting an account removes it with its reviews, comments, saved places, lists and routes, and every device signed into it. Photographs it added to a listing stay on that listing, and a service provider profile stays too; we remove either if you ask. If it has payment records or an advertising balance, owns a listing, or holds a staff post, we anonymise it instead: your name, email address and picture are removed, it can no longer be signed into on any device, and your reviews stay on the site with no name on them. Either way, our change log keeps a record of the deletion, including the name and email address the account had, so that what happened can be explained later.

This site is not meant for children. If you believe a child has made an account, tell us and we will remove it.

What we do not do

• We do not sell personal information.
• We do not use third-party advertising or tracking networks.
• We do not keep an internet address in our records beyond the window above.
• We do not see or store card numbers.

Changes to this page

Pakistan has no comprehensive data protection law in force yet — the bill has been a draft for years — so this page describes what we do rather than reciting a statute. When a law is enacted, this page will change to meet it.

Last updated 16 September 2026.