Privacy policy
We collect as little as we can to run and improve search, and we never sell your data.
Cookie banner (English): “We use essential cookies to run the site, and optional analytics and marketing cookies only if you agree. You can change this anytime in Cookie settings.” Buttons: Accept all · Reject non-essential · Customise.
Last updated: 25 October 2026
1. Who we are and how to reach us
Controller: Car Sniper, Riyadh, Saudi Arabia.
Car Sniper (carsniper.store) is a Saudi used-car search engine: it brings public car ads from known sites into one place and lets you list your own car.
For anything about your data use the data-rights request form at carsniper.store/privacy/request (footer link «طلبات بياناتك»). Every request is logged and answered within 30 days.
The site is built and hosted on Lovable (Lovable Cloud); the database and sign-in run on Supabase. The Arabic policy is the primary version.
2. Last updated and change history
- 25 أكتوبر 2026: Policy rewritten under the PDPL: legal basis per purpose, retention periods, storage locations, AI, your rights and the request form, and category-based cookie settings. Registration images are no longer stored.
- 25 أكتوبر 2026: First-party usage measurement and the consent banner added.
Last updated: 25 October 2026.
3. Data we collect
- Mobile number
- Required to create an account and sign in with a code. Search needs an account.
- Name
- Required in the name step after the first sign-in.
- Only if email sign-in is switched on and you choose it. Optional.
- Searches and use
- Search text, filters and ads you open, linked to your account in the search log. Needed to run search.
- Usage measurement (optional)
- Random device and session ids and the device–account link, only with “Analytics” on.
- Technical data
- Device type, browser language, referring site and campaign tags; for signed-out visitors a hashed IP (the IP itself is not stored) against abuse.
- Your car ad
- Make, model, year, body, price, mileage, city, description, photos and contact number. Required to publish.
- VIN
- Optional, only if you scan the registration. Kept for admin checks, never shown in the ad.
- Registration (istimara) image
- Optional, needs your explicit consent; read once and never stored. Owner name and ID are never stored.
- Messages and suggestions
- Your message and an optional contact.
- Performance board
- Display name, video link and run details if you submit a run (optional, the name is public once approved).
- Data-rights requests
- Type, details, name and phone or email, to act on and prove the request.
- Cookie-choice record
- A random consent id, the time, your choices and the banner version — nothing that identifies you.
4. How we collect it
- From you: sign-up, search, listing a car, messages, requests.
- From your browser: the device storage in section 6, and our own first-party usage measurement (no third-party trackers).
- From the hosting platform: measurement scripts Lovable adds to every site it hosts, blocked until you agree (section 7).
- Ads from other sites are public listings; we do not buy personal data.
5. Why we use it and the legal basis
- Account and SMS sign-in
- Contract (providing the service)
- Search, results and the account search log
- Contract
- Publishing and reviewing your ad, showing your contact number
- Contract, at your request
- Automatic reading of the registration image
- Your separate explicit consent
- Usage measurement with device/session ids
- Consent (Analytics)
- Remembering recent searches, recently viewed cars and your contact number
- Consent (Functional)
- Id-free aggregate counts, speed measurement, fixing errors
- Legitimate interest
- Fraud prevention and security: rate limits, hashed IP, duplicate VIN/phone checks
- Legitimate interest
- Answering your messages and requests
- Your request; legal obligation for rights requests
- Keeping the request and consent logs
- Legal obligation, proof of compliance
No targeted ads, no selling or renting of your data. Optional consent is never a condition of using the site.
8. Where your data is stored and transfers outside the Kingdom
The database and ad photos are stored in Germany (Frankfurt, EU) on Amazon Web Services, outside the Kingdom.
Pages run on Cloudflare’s network from the data centre nearest you. AI (Google Gemini) runs on Google servers outside the Kingdom (mostly the US). Owner alerts pass through Telegram servers outside the Kingdom.
Transfer basis: providing the service you asked for (Transfer Regulation, Art. 2), with safeguards: encryption in transit, minimised data, restricted access, and processing agreements with vendors.
9. AI and automated processing
- Search parsing: only the search text (phones, emails and ID numbers removed).
- Ad text drafting, on request: car facts and your notes (phones and emails removed); never the price or your number.
- Registration reading, with consent only: the image once, asking for vehicle fields only; owner name, ID and plate are refused. The image is not stored.
- No decision with legal effect on you is made solely by automation; ads are reviewed by a person.
10. Retention and destruction
- Account (phone, name, email)
- While the account exists; deleted at once with “Delete my account”
- Search log
- 180 days; visitor IP hash 30 days
- Detailed usage events
- 180 days, then id-free daily counts
- Device–account link
- 180 days
- Published ad (data, photos, phone, VIN)
- Up to 12 months after publishing, or until you delete it or your account
- Rejected or withdrawn ad
- 90 days
- Unsent draft (VIN, any photos)
- 3 days
- Registration image
- Never stored
- Messages and suggestions
- 1 year
- Data-rights requests
- 3 years after closing
- Cookie-choice records
- 3 years
- Device-only storage
- Until you clear it or withdraw consent
Daily automatic jobs enforce these periods.
11. How we protect it
- HTTPS everywhere; server-only tables for sensitive data; per-table database permissions.
- Admin access needs a verified admin account; access kept to the fewest people.
- Minimisation: no registration image, no raw IP, no fingerprinting.
- A breach plan, including notifying SDAIA within 72 hours and you where there is harm.
12. Marketing messages
We do not send marketing. If we ever do, it will be a separate, unticked opt-in per channel, and opting out takes effect at once.
13. Minors
The service is for people aged 18 and over.
14. Your rights
- To be informed (this policy).
- Access and a copy: “My data” on your account page downloads a JSON copy at once, or use the form.
- Correction, destruction (“Delete my account” works at once), withdrawing consent (Cookie settings).
- Complaint, and compensation for harm under the law.
Free of charge. We answer within 30 days, with at most one 30-day extension notified with reasons. We may ask you to verify your identity.
15. Complaints and SDAIA
Contact us first through the form (type “Complaint”). If unsatisfied, you may complain to the Saudi Data & AI Authority (SDAIA) at sdaia.gov.sa.
16. Changes to this policy
We update the date and the change history at the top; material changes are announced on the site and consent is asked again where needed.