Privacy Policy

1. Who we are

CarNearU (the “Platform”) is operated by Ishtiyaque Ansari, an individual, of Mumbai, Maharashtra, India (“we”, “us”). We are the data fiduciary for the personal data described in this policy under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This policy also serves as the privacy policy required by the Information Technology Act, 2000 and the rules made under it. It should be read with our Terms of Use.

2. Personal data we collect

Data you give us

• Account details: your name and email address from Google Sign-In, or your name and mobile number if you register as a dealer with a phone number and password (we store only a secure hash of your password).
• Mobile number and its verification status, including the WhatsApp messages you send to verify it.
• Dealer information: dealership name, owner name, contact numbers, store addresses, business hours, photos and any business documents you provide.
• Listings: vehicle details, registration number, price, photos and descriptions.
• WhatsApp conversations with our bot, including text, photos and videos you send to create or manage a listing.
• Inquiries: the listings you ask about, the notes you add, and how you chose to contact the dealer.
• Messages you send us, including complaints.

Data collected automatically

• IP address, device and browser type, pages viewed and actions taken, collected through cookies and Google Analytics.
• Login session cookies needed to keep you signed in.
• Records of your acceptance of our terms (which version, when, and the IP address and browser used).

3. Why we use it

We process your personal data, based on your consent or for the legitimate uses allowed by the DPDP Act, to:

• create and secure your account, log you in, and verify your phone number;
• publish and display listings, and let Buyers find and contact Dealers and Sellers;
• share a Buyer’s inquiry and contact details with the Dealer or Seller they chose to contact;
• review and approve dealer accounts, prevent fraud, spam and misuse, and enforce our terms;
• read the messages and photos you send our WhatsApp bot (including with automated AI tools) to fill in a draft listing for you to confirm;
• send you service messages about your account, listings and inquiries;
• understand how the Platform is used and improve it; and
• comply with law, respond to lawful requests from authorities, and handle complaints and disputes.

We do not sell your personal data, and we do not use it for any purpose not described here without asking you.

4. Who we share it with

• Dealers and Sellers: when you send an inquiry, the Dealer or Seller of that listing receives your name and mobile number. Their use of it is their own responsibility under our Dealer Terms and the law.
• The public: listings, and dealer and store details (such as business name, address, phone numbers and hours), are publicly visible on the Platform.
• Service providers who process data for us, only as needed to run the Platform:
  • Google — Sign-In (Firebase Authentication), website analytics (Google Analytics) and AI processing of WhatsApp listing messages (Gemini);
  • Meta — WhatsApp Business messaging, used for phone verification and our listing bot;
  • MongoDB — our database;
  • Upstash — temporary storage for sessions, verification codes and rate limits;
  • Nestor — hosting of vehicle photos and media; and
  • Vercel Inc. — website hosting.
• Authorities: law enforcement, courts or government agencies when required by law, or to protect the rights, safety or property of users or the public.
• A successor: if the Platform is transferred to a company or another operator, your data may be transferred to them under this policy.

Some of these providers may store or process data outside India. Where they do, we rely on transfers permitted under the DPDP Act and require them to protect your data.

5. How long we keep it

• Account and dealer data: while your account is active, and for a reasonable period afterwards to resolve disputes, prevent fraud and meet legal obligations.
• Phone verification codes and pending requests: a few minutes. Login attempt and rate-limit counters: up to an hour.
• Inquiries and WhatsApp conversations: as long as needed to provide the service and handle related complaints.
• Records we must keep by law (for example, information required by the IT Rules or tax law): for the period the law requires.

6. Your rights

Under the DPDP Act you have the right to:

• obtain a summary of the personal data we hold about you and how we use it;
• have inaccurate or incomplete data corrected and updated;
• have your data erased when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• withdraw your consent at any time (this does not affect processing already done, and may mean we can no longer provide some services);
• nominate another person to exercise your rights in the event of your death or incapacity; and
• have your grievances addressed by us.

To exercise these rights, contact our Grievance Officer (below). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

7. Security

We use reasonable security practices to protect your data, including encrypted connections (HTTPS), hashed passwords, hashed verification codes, access controls and rate limiting. No system is completely secure, so please keep your login details private and tell us immediately if you suspect misuse of your account. If a personal data breach occurs, we will notify affected users and the authorities as the law requires.

8. Cookies

We use essential cookies to keep you signed in and secure the Platform, and analytics cookies (Google Analytics) to understand usage. You can block or delete cookies in your browser settings; if you block essential cookies, you will not be able to sign in.

9. Children

The Platform is meant for people aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The version and effective date at the top show when it last changed. If a change is significant, we will notify you on the Platform or by message, and ask for your consent again where the law requires.

11. Contact and Grievance Officer

For any question, request or complaint about your personal data, contact our Grievance Officer. We will acknowledge your request within 24 hours and respond within the time required by law (and in any case within 15 days for complaints).