Privacy Policy

1Who we are, and what this policy covers

This policy explains how B CARS collects, uses, stores and protects your personal data, and what rights you have over it. The operator’s details are shown at the bottom of this page.

It covers the B CARS mobile app and website together. They share one system and one database, run on servers that we operate.

The platform currently serves Bahrain. UAE rules are described for accounts and markets where those features are available; this does not mean the UAE market is currently open.

2One principle governs everything below

We do not collect data we do not need to run the service.

There is no advertising tracking, no sale of data, and no sharing with advertisers or data brokers. We use no session recording or replay and no third-party error-monitoring service. Website statistics through Google Analytics are used only where section 8 says they are switched on. The providers that process data for us are named in section 9.

3Account data — and it differs by market

Accounts are created and managed by our own system on our own servers. We store:

• Your email address and whether it has been confirmed. You sign in with this email and a password.
• Your password, stored only as a one-way hash. We cannot read it, and nobody at B CARS can tell you what it is.
• A phone number on your profile, which is required to publish listings so buyers can reach you. It is not verified: we send no message to it, and we do not claim anywhere that it is verified.
• Your display name, the contact email you enter on your profile — not shown publicly or to other users, and not used to sign in — and your showroom name if you have an approved showroom.
• When you change your sign-in email, we send a six-digit code to the new address and record when you confirm it. A pending check stores a keyed hash of the address and of the code, not the code itself.
• Your account market (Bahrain or UAE) and the moment it was fixed. It is fixed when registration completes and does not change afterwards except by administrative action.
• Account status (active, suspended, banned), creation date, language preference and the time of your last sign-in.
• Security records: sign-ins, failed sign-in and deletion attempts, password resets and account deletion, each with the time, IP address and browser type.

4Signing in with email

Sign-in is by email address and password only. When you register, we send a six-digit code to your email, and your email counts as verified only once that code is entered. Codes are stored as keyed hashes, expire after 10 minutes, can be used once, and are limited in how often they can be requested and tried.

If you forget your password, we email a single-use link to set a new one. The link expires after 60 minutes and stops working once used. Setting a new password signs out the mobile app on your other devices.

Deleting your account requires your current password. An account that has no password yet must first set one through the emailed link.

We do not offer sign-in by phone number or SMS code, and we do not offer sign-in through third-party accounts such as Google or Apple.

5Listings and what comes with them

• Vehicle or plate details: make, model, year, mileage, price, specification, the description you write, and any optional history details you add (previous owners, accidents, chassis number).
• The photos you upload. Our servers re-encode every photo to WebP, which removes embedded metadata such as EXIF data and any GPS coordinates. Photos stay in private storage while the listing is under review and become public only after our staff approve the listing.
• An optional inspection report (PDF) for a car. It is kept in private storage; other users can open it only if you choose to share it and the listing is approved, and then only through a link that expires after a few minutes.
• The market and region the listing is published in.
• The listing’s status and its history: under review, published, rejected, paused, sold, expired.
• View and contact counters. A view is counted at most once per viewer per listing per hour. For signed-in users we keep one record per listing with the time of the latest view; for visitors who are not signed in we keep only a temporary keyed hash of the IP address and browser type, which is discarded after one hour.

6Activity inside the platform

• Favourites: the listings you save, linked to your account.
• Contact requests: when you tap Call or WhatsApp on a listing, we record that you requested contact for it, the seller, the market and region, and when. A daily record also counts how many sellers you contacted, so that contact limits can be applied. The seller’s phone number is returned to you only at that moment.
• In-app notifications we send you, and whether you have read them. We do not send push notifications.
• Reports you submit about a listing or a user, with their text, and the users you block.
• Search terms and filters you submit are processed by our servers to return results; we do not keep a search history in your account. The list of listings you recently viewed is stored only in your browser.
• Contact Us messages: we store the subject, the message, your account market and the reply email so we can answer. Staff whose permission and market cover your account can read them, and each message is also emailed to our support mailbox through our email provider (section 9).
• Emails to you: verification codes, password-reset links, one welcome email after your email is verified, and one email when your showroom is approved. For the welcome and showroom emails we keep a record of the event, language, delivery status and time.

7Showrooms and verification documents

If you apply for a showroom, we additionally collect:

• Showroom name, description, founding year, published phone number, contact name and contact email, commercial registration number, market, region and map link.
• Showroom logo and cover image.
• The verification documents you upload (commercial registration and similar).

Documents are held in private storage that visitors and other users cannot read. They never appear on the public showroom page, and only a staff member holding the showroom-verification permission can open them, through links that expire after a few minutes.

"Verified showroom" means our team reviewed and approved the application. It does not guarantee any vehicle, any transaction, or any financial standing, and it does not mean phone numbers have been verified.

8Technical data, cookies, and what we do not take

We receive what any browser or app sends by its nature: IP address, device and browser type, and the time of the request. Our servers, and Cloudflare in front of them, use these to deliver and protect the service. Server logs are kept for [log retention period].

• The website uses only cookies that are strictly necessary for it to work: a session cookie that keeps you signed in during a visit, a security (CSRF) token cookie that protects forms, a "remember me" cookie that keeps you signed in on that browser until you sign out, and preference cookies for your language, your chosen market and your choice to browse as a guest.
• In your browser’s local storage we keep your theme choice and your recently viewed listings. They stay in your browser and are not sent to us.
• Cloudflare may set its own strictly necessary cookies to protect the site against abuse and automated attacks.
• We use no advertising cookies and no device fingerprinting.
• We do not request location permission or read device location. You choose the market and listing region yourself.

9Who else processes your data

We run the application, its database, search index and cache on our own servers. We rely on a small set of providers, each with a single role:

• [VPS provider, country] — provides the virtual private server (VPS) on which our servers run. The data is stored there, under our control.
• Cloudflare — DNS, HTTPS and protection against attacks. All traffic to the website and app passes through Cloudflare, so it processes request details such as your IP address and browser type.
• Amazon Web Services (AWS S3, [AWS region]) — storage of listing photos, showroom logos and covers, inspection reports and showroom documents. Public photos are served from there; private files are reachable only through short-lived links we issue.
• [email provider] — sending email: verification codes, password-reset links, account emails, and Contact Us messages forwarded to our support mailbox. It receives each email’s recipient address and content.
• Google — only for website statistics, and only where section 8 says Google Analytics is switched on.

When you tap WhatsApp on a listing, you leave B CARS for WhatsApp, which applies its own privacy policy.

We do not use Supabase, Vercel, Sentry, any SMS provider or any push-notification service. We do not sell your data and we do not share it with anyone for marketing purposes.

10Transfers outside the country

Our servers are located in [country of VPS], files are stored in AWS region [AWS region], Cloudflare processes traffic through its global network, and our email provider processes email in [email provider’s processing country]. Your data may therefore be processed outside the Kingdom of Bahrain.

We engage these providers under their data-processing terms, which oblige them to protect what we entrust to them and to use it only to provide the service to us. [Transfer safeguards to be confirmed by the owner/lawyer.]

11Who sees what

Not all of your data is visible to everyone, and the limits are enforced by our servers, not only by the interface:

• Public to everyone: your approved listings, their photos, and the display name or showroom name shown on them.
• To a buyer who taps Call or WhatsApp: your phone number — the purpose it was collected for. It is never shown on the listing page itself.
• To platform staff: according to each person’s role and assigned market, not to all of them. Reading a user’s phone number is a permission of its own, and every reveal is written to the audit log with who revealed it and when.
• No other user reads your profile, your number, or your email.

12Automated and human review

Every listing passes automated checks — for example prohibited words, phone numbers written in the text, unusual prices and duplicates — and a listing may be held or rejected automatically as a result.

Every car listing is reviewed by our staff before it is published. Plate listings are also reviewed by staff, unless we switch on automatic publishing, in which case plate listings that pass every automated check may be published without manual review. Staff can review any decision, and you may contest a decision by contacting us.

13How long we keep things

• Your account and listing data: for as long as your account exists.
• Expired or sold listings: they remain in your account for your reference and do not appear in the marketplace.
• Showroom documents: for as long as the showroom exists, and are deleted with the showroom or the account.
• The administrative audit log survives account deletion for accountability and security. Deletion clears the actor reference when it points to the deleted account, but does not erase the rest of the record, which may contain account or listing identifiers, before-and-after data, reasons and network addresses. Phone numbers and emails are masked in these records. No automatic expiry is currently configured; [audit log retention period to be decided].
• Security records (section 3) survive account deletion with the link to your account cleared; the record of the deletion itself keeps the former account number, IP address and browser type. No automatic expiry is currently configured; [security record retention period to be decided].
• Contact-request records and daily contact counts remain after account deletion with your user reference cleared. Reports you submitted remain with your reference cleared; reports about your account are deleted with it.
• Contact Us messages and the records of emails we sent you are kept in our database while your account exists and are deleted with it. Messages already forwarded to our support mailbox, and records held by [email provider], are not deleted by account deletion; they follow that mailbox’s and that provider’s retention settings.
• Backups of our database and files are kept for [backup retention period] and then overwritten.

14Deleting your account

You can delete your account at any time from the Account page, after re-entering your current password and confirming. Deletion takes effect immediately; there is no waiting period and it cannot be undone.

Deletion covers your sign-in identity (email and password), profile (including your phone number and contact email), listings, photos, inspection reports, favourites, notifications, blocks, showroom and its documents, the Contact Us messages stored in our database, and the records of emails we sent you. You are signed out and the mobile app sessions are revoked. Stored files are removed afterwards through a cleanup queue; a failed removal stays queued for retry.

The records described in section 13 as surviving deletion — the audit log, security records, contact-request records, reports you submitted, messages already in our support mailbox, records held by our email provider, and backups until they are overwritten — may remain and can still contain identifying data. You may ask us about deleting them.

15Your rights

Under Bahrain’s Personal Data Protection Law No. 30 of 2018, and under this policy, you have the right:

• To know what we hold about you.
• To obtain a copy of it.
• To correct what is wrong — most of it you can correct yourself from your account page.
• To delete your account. Records that account deletion does not remove are described in sections 13 and 14, and you may ask us about deleting them.
• To object to a particular processing or ask that it be restricted.
• To complain to the competent data protection authority.

To exercise any of these, contact us through the channel published in the app.

16Data security

• All communication with the platform is encrypted (HTTPS), with Cloudflare in front of our servers.
• Access rules are enforced on our servers, so modifying the app on a user’s device does not open data.
• Private files (documents, unshared inspection reports, photos awaiting review) are kept in private storage and opened only through short-lived links.
• Passwords are stored as one-way hashes, verification codes as keyed hashes, and sign-in, code and deletion attempts are rate-limited.
• Staff permissions are divided by role and market, and sensitive actions are logged.
• No system is perfectly secure. We commit to reasonable measures, and to informing you if a breach affects your data.

17Eligibility

The platform is intended for people aged 18 and over. We do not knowingly collect data about children, and if we learn of a child’s account we delete it.

18Changes to this policy

We update this policy whenever what the platform actually does changes. The last-updated date appears at the top of the page, and we notify you inside the app of any material change.

19How to reach us

For any question or request about your data, contact us through the channel published in the app or at the email shown below. We accept privacy requests and respond within a reasonable time.