Privacy Policy — CarSouq.BH

Effective date: 28 March 2026  ·  App version: 1.0  ·  Jurisdiction: Kingdom of Bahrain

1. Who we are

CarSouq.BH is a used car marketplace platform operated in the Kingdom of Bahrain. The app connects private sellers, registered dealers, and buyers of used vehicles. We are the data controller for all personal information collected through the app.

2. What data we collect

Account information

• Full name
• Email address (for email-registered accounts)
• Mobile phone number (required to post listings; stored at registration, verified before posting)
• Password (stored as a secure hash — we never store plaintext passwords)
• Phone verification status
• Account creation date and role (user / dealer / admin)

Listing content

• Vehicle details you submit: make, model, year, price, mileage, transmission, fuel type, location, and description
• Photos you upload (stored in Firebase Storage; watermarked with "CarSouq.BH" before storage)

Usage data

• Listing view counts
• WhatsApp and call contact counts per listing
• Dates of past posts (used to calculate free post allowance)
• Saved / bookmarked listings (stored locally on your device)

Dealer data (if applicable)

• Dealer name (English and Arabic), phone, location, description, logo image, and subscription status
• Application date, approval date, and subscription plan

Device and notification data

• Firebase Cloud Messaging (FCM) device token — used to deliver push notifications from our admin team
• We do not collect device model, OS version, IP address, or location data beyond what you voluntarily provide in a listing

3. How we use your data

• To create and manage your account
• To verify your mobile number before you post a listing (prevents fraudulent or fake listings)
• To publish your car listings and make them visible to other users
• To enforce fair posting limits (free post allowance per rolling window)
• To process dealer subscription applications and manage approvals
• To send push notifications (admin broadcasts only — we do not send marketing messages without your consent)
• To display your contact information to buyers interested in your listing
• To prevent abuse, spam, and fraudulent listings
• To improve the app based on aggregated, anonymised usage patterns

4. Phone number verification important

Your mobile number is collected at registration but is not verified immediately. Verification is required only when you attempt to post your first listing. This one-time verification uses Firebase Phone Authentication (SMS OTP). After successful verification, your number is marked as verified in our system and no further OTP is required unless you update your number.

If you registered using phone OTP login (Android / web), your number is automatically considered verified.

You may update your phone number from your profile at any time. Updating your number resets your verification status and requires re-verification before your next post.

5. Listing photos and watermarking

Photos you upload to a listing are processed before storage. We apply a small "CarSouq.BH" text watermark in the bottom-left corner of each image (70% opacity) to protect against unauthorised use of your content. Watermarked photos are stored in Firebase Storage and are publicly accessible via a unique URL for the duration your listing is active.

When your listing is deleted, we will also delete all associated photos from storage.

6. Data sharing

We do not sell your personal data. We share data only in the following limited circumstances:

• With other users: Your listing details (including your phone number and name) are visible to all app users while your listing is active. This is necessary for buyers to contact sellers.
• With Firebase / Google: We use Firebase (a Google service) for authentication, database, file storage, and push notifications. Google processes data in accordance with their privacy policies. Data may be stored on servers in the United States or other regions.
• With authorities: We may disclose data if required by Bahraini law, court order, or to protect the rights and safety of users or the public.

7. Account and data deletion feature

You may request deletion of your account and all associated personal data at any time. Upon receiving a verified deletion request:

• Your account will be scheduled for permanent deletion within 30 days
• All your active listings will be deactivated immediately
• Your listing photos will be deleted from storage
• Your personal data (name, email, phone number) will be permanently removed from our database
• Anonymised usage statistics (e.g. total listing count) may be retained for internal analytics

To request deletion, contact us using the details in section 14. You will receive a confirmation within 7 days. During the 30-day grace period you may cancel the deletion request by logging back in.

8. Report a listing feature

Users may report listings that they believe are fraudulent, misleading, illegal, or in violation of our terms. When you submit a report:

• The report (including your user ID and the reason provided) is stored in our database and reviewed by our admin team
• Your identity is not disclosed to the owner of the reported listing
• We may contact you for additional information if needed
• Reports that do not result in action are retained for up to 90 days and then deleted
• Repeated reporting of legitimate listings may result in review of your account

9. Data retention

• Active accounts: retained for as long as your account is active
• Inactive accounts: we may notify and remove accounts with no activity for 24 consecutive months
• Deleted listings: removed immediately from public view; storage files deleted within 24 hours
• Post history (rolling window): timestamps older than the configured window period (typically 90 days) are automatically purged
• Push notification tokens: retained while your account is active; removed on account deletion
• Deletion requests: completed within 30 days as described in section 7

10. Your rights

Under applicable data protection principles, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (via your profile settings or by contacting us)
• Delete your account and data (see section 7)
• Withdraw consent for push notifications (via your device notification settings)
• Update your phone number and re-verify at any time via profile settings
• Object to any use of your data not described in this policy

To exercise any of these rights, contact us using the details in section 14.

11. Security

• All data is transmitted over HTTPS/TLS
• Passwords are never stored in plaintext — Firebase Authentication uses industry-standard secure hashing
• Firestore and Storage access is protected by security rules — users can only access their own data; listings are publicly readable only when active
• Storage uploads are restricted by file type (images only) and size (5MB per image)
• Admin functions are restricted to accounts with the admin flag set in our database
• We do not store payment card numbers or bank account details

12. Children's privacy

CarSouq.BH is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us and we will delete it promptly.

13. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will notify users via a push notification or in-app announcement. The "effective date" at the top of this document will always reflect the latest version. Continued use of the app after changes are announced constitutes acceptance of the updated policy.

14. Contact us