Legal
Privacy Policy
Last updated 21 October 2026 · version 2.0
This policy explains what personal data Investline collects, why, where it is kept and for how long, and the rights you have over it. It is part of our Terms and Conditions. To close your account, see Deleting your account.
In short
- We collect what we need to open your account, verify who you are, take your payments, pay your rent and keep the records Iraqi law requires. We never sell your data.
- Your identity check includes photos of your ID and a selfie. An automated face match helps our team review it, and a person always makes the decision.
- Your data is stored with Amazon Web Services and MongoDB Atlas outside Iraq, under contracts that require them to protect it, and is encrypted in transit and at rest.
- Identity and transaction records are kept for seven years after your account closes, because anti-money-laundering law requires it. Everything else is deleted or anonymised when it is no longer needed.
- You can see, correct and download your data, object to marketing, and close your account from Settings. Write to privacy@investline.io for anything else.
This summary is for convenience; the full text below is what binds us both.
1. Who is responsible for your data
Investline, a limited liability company registered in the Republic of Iraq and the Kurdistan Region of Iraq with its head office at Zin Street KRO, Duhok, is the controller of the personal data described in this policy. You can reach our privacy team at privacy@investline.io and our support team at support@investline.io.
This policy applies to the Investline website at investline.io, the Investline mobile applications, the investor dashboard, the secondary market, our branches and our customer support (together, the "Platform"). It is part of our Terms and Conditions. It does not cover other companies' websites or apps that we link to, such as the payment apps of First Iraqi Bank and FastPay, which have their own policies.
We process personal data in accordance with the laws of the Republic of Iraq and the Kurdistan Region of Iraq, including the Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015, the Electronic Signature and Electronic Transactions Law No. 78 of 2012 and the Consumer Protection Law No. 1 of 2010, and we follow the internationally recognised principles of lawfulness, transparency, data minimisation, accuracy, storage limitation, security and accountability.
2. The data we collect
Account data. Your name, e-mail address, phone number, preferred language, password (stored only as a one-way hash), two-factor authentication settings and recovery codes (hashed), the emergency contact you may choose to add, and the date and IP address of sign-up.
Identity (KYC) data. Your full name as on your document, date of birth, nationality, address, document type and number, photos of the front and back of your national ID or passport, a selfie, the result and score of the automated face comparison, our reviewer's decision and notes, and, where the law requires it, information about your occupation and the source of your funds. For accounts migrated from the previous Investline platform, the identity records that platform held.
Verification selfies. Before certain actions (buying or selling shares, withdrawing money, paying online) we may ask for a new selfie, which is compared with your identity photos. We keep the time, the score and the outcome of each check; the fresh selfie itself is not retained after the comparison.
Financial and investment data. Your Wallet balance and every transaction (deposits, purchases, fees, rent payouts, withdrawals, referral rewards, sales), your share reservations and holdings, the payments you start through FIB or FastPay and their status, cash deposits and withdrawals recorded at a branch, the signed withdrawal receipts we scan, your share purchase agreements and their annexes, and your referral codes and the purchases made with them (buyers are shown to referrers anonymised).
Communications. Messages you exchange with our staff through the inbox and support tickets, including images you attach, website enquiries, notifications we send you, and e-mails and SMS we send through our providers.
Technical data. IP address, device and browser type, pages visited, time stamps, the cookies listed in our Cookie Policy, the signed-in session, and server logs. We keep an audit log of actions taken on your account by our staff and by you.
Sign-in with Google, Facebook or Apple. If you choose it, the provider sends us your name, e-mail address and a provider identifier; we do not receive your password or your contacts.
We do not knowingly collect data from anyone under 18, and the Platform may not be used by minors. If you believe a minor has registered, tell us and we will delete the account.
3. Where the data comes from
Most of the data comes from you, when you register, complete the identity check, invest, communicate with us or visit a branch. Some comes automatically from your device and browser. Some comes from third parties: payment confirmations from FIB and FastPay, the face-comparison score from our verification service, sanctions and politically-exposed-persons lists, the social sign-in provider you chose, and the records migrated from the previous Investline platform.
4. Why we use your data and on what legal basis
| Purpose | Examples | Legal basis |
|---|---|---|
| Running your account and your investments | Creating the account, reserving and confirming shares, issuing contracts, paying rent, processing withdrawals, the secondary market, referral rewards | Performance of our contract with you |
| Identity verification and financial-crime prevention | KYC review, face comparison, sanctions screening, source-of-funds questions, reports to the authorities | Legal obligation under the AML/CFT Law No. 39 of 2015 and Central Bank of Iraq instructions |
| Record keeping | Keeping identity, contract and transaction records for seven years | Legal obligation |
| Security | Login protection, two-factor authentication, blocking repeated failed payments, audit logs, fraud investigation | Legitimate interest in protecting members and the Platform |
| Communication about your account | Confirmations, payout notices, contract documents, replies to your messages, service announcements | Performance of our contract |
| Customer support and complaints | Tickets, inbox, website enquiries, complaint handling | Performance of our contract and legal obligation |
| Improving the Platform | Aggregate statistics, error logs, testing | Legitimate interest |
| Marketing | News about new properties and features by e-mail or in the app | Your consent, which you can withdraw at any time |
| Optional features | The map and the 3D tour on property pages | Your consent, given through the cookie banner |
We do not make decisions with legal or similarly significant effects about you by automated means alone. The face comparison and sanctions screening produce signals that a member of our team reviews before any decision on your identity check or your account.
5. Who we share your data with
We share personal data only as far as needed for the purposes above, with:
- Payment providers: First Iraqi Bank (FIB) and FastPay, which process the payments you start and send us their status. They are licensed by the Central Bank of Iraq and apply their own policies.
- Hosting and infrastructure: Amazon Web Services (application servers, file storage for identity photos, documents and receipts, e-mail delivery, SMS delivery and the face-comparison service) and MongoDB Atlas (database), under data-processing terms that require confidentiality and security measures.
- Communication providers: our e-mail and SMS providers receive your address or number and the message we send you.
- Independent professionals: valuers, auditors, lawyers and accountants, where needed for a property, an audit or a dispute, bound by confidentiality.
- Property partners: a developer that sponsors a property receives aggregate information about the raise; it does not receive your identity data.
- Authorities: the Central Bank of Iraq, the Anti-Money Laundering Office, courts, tax authorities and law-enforcement bodies in Iraq and the Kurdistan Region when the law requires it or a lawful order is served on us.
- A successor business: if Investline merges with or is acquired by another company, your data may be transferred to it under the same commitments, with notice to you.
Our staff see your data on a need-to-know basis, according to their role on the Platform. Every staff action on your account is recorded in an audit log. We never sell personal data and we do not share it with advertisers.
Other members never see your identity. On the secondary market and in the referral programme, buyers and sellers are shown anonymised.
6. Where your data is stored and international transfers
The Platform runs on Amazon Web Services and MongoDB Atlas data centres located outside Iraq, currently in the United States. Identity photos migrated from the previous platform remain in the storage that platform used, also operated by Amazon Web Services. Our providers are bound by contracts that require them to protect your data to a standard at least equal to this policy, and data is encrypted in transit and at rest. By using the Platform you acknowledge that your data is processed in those locations.
7. How we protect your data
- Encryption in transit (TLS) on every connection, and encryption at rest for databases, files and backups.
- Passwords stored as salted one-way hashes; two-factor authentication required for every staff account and available to every member.
- Session cookies that scripts cannot read; automatic sign-out of staff sessions; recovery codes stored hashed.
- Identity photos, documents, receipts and contracts stored in private storage and served only to you and to authorised staff, never from a public link.
- Role-based access for staff, with the permissions of each role reviewed by our high administrators, and an audit log of every change.
- Automatic limits on repeated failed logins and payments, and a block on withdrawing to anyone other than the verified account holder in person.
- Regular backups and a tested restore procedure.
No system is completely secure. If a breach affects your data we will tell you and the competent authority without undue delay, as the law requires.
8. How long we keep your data
| Data | Retention |
|---|---|
| Identity (KYC) documents, selfies, face-check results, sanctions screening | Seven years after the account is closed or the last transaction, whichever is later (AML/CFT Law No. 39 of 2015) |
| Contracts, transactions, Wallet history, receipts, payout records | Seven years after the account is closed or the last transaction |
| Audit log of actions on your account | Seven years |
| Account profile (name, e-mail, phone, settings) | While the account is open; anonymised when it is closed, once nothing is owed either way |
| Messages, tickets and attachments | While the account is open and for the retention period of the related transaction, then deleted |
| Verification selfies taken before an action | Not retained; only the time, score and outcome are kept |
| Server logs and security logs | Up to twelve months |
| Marketing preferences | Until you withdraw consent, then a record that you did |
When the retention period ends the data is securely deleted or, where it is needed for statistics, anonymised so that it no longer identifies you.
9. Your rights
Subject to the limits that Iraqi law places on them (in particular the duty to keep identity and transaction records), you have the right to:
- Access the personal data we hold about you and receive a copy. Your dashboard already shows your profile, transactions, contracts and documents.
- Correct data that is inaccurate or incomplete. You can change your name, phone number, language, emergency contact and password from Settings; identity data is corrected by our KYC team on request.
- Delete your account. You can close it from Settings once you hold no shares and no money; otherwise the request opens a ticket and our staff settle the account with you first. Closure anonymises your profile; the records in clause 8 are kept for the legal period. See Deleting your account.
- Object to processing based on our legitimate interests, and withdraw consent to marketing or to optional cookies at any time, without affecting the lawfulness of what was done before.
- Portability: receive the data you gave us in a structured, machine-readable format.
- Complain to us at privacy@investline.io, and to the competent authority in Iraq or the Kurdistan Region.
Write to privacy@investline.io from your registered e-mail address. We may ask you to confirm your identity. We answer within thirty days; if a request is complex we tell you why and when to expect the answer.
10. Cookies and similar technologies
The website uses a small number of cookies. Strictly necessary cookies keep you signed in, remember your language and your cookie choices, and apply a referral link you opened; they need no consent. The map (OpenStreetMap) and the 3D tour (Matterport) on property pages load only if you allow them in the cookie banner, because those companies receive your IP address when they load. We do not use advertising cookies. The full list, with providers and durations, is in the Cookie Policy, where you can also change your choice.
11. Marketing and notifications
Notifications about your account (confirmations, payouts, withdrawals, contract documents, security alerts, replies to your messages) are part of the service and are sent to your dashboard, your e-mail address and, for payouts and withdrawals, by SMS. We send news about new properties and features only with your consent, and every such e-mail has an unsubscribe link. You can also change your preferences in Settings or by writing to support@investline.io.
12. Social media and external links
Our pages on Instagram, LinkedIn and other networks, and the WhatsApp number we publish, are run on those companies' platforms under their own privacy policies. Anything you post there publicly is visible to others; for anything about your account, use the Platform's inbox or e-mail instead.
13. Our mobile applications
The Investline apps for Android and iOS use the same accounts, data and rules as the website. They may ask for permission to use the camera (for the identity check and verification selfies) and to show notifications. You can withdraw those permissions in your phone's settings; the identity check cannot be completed without the camera. The apps do not access your contacts, location or other files.
14. Changes to this policy
We may update this policy when the Platform, the law or our providers change. Material changes are announced in your dashboard and by e-mail at least thirty days before they take effect; the date at the top shows the current version. Earlier versions are available from privacy@investline.io.
15. Contact
Investline, Zin Street KRO, Duhok, Kurdistan Region, Republic of Iraq Privacy: privacy@investline.io · Support: support@investline.io · Phone: +964 780 488 7887