Privacy & Data Protection Policy

Last updated: July 25, 2026

SiraCar is committed to protecting your personal data and respecting your privacy in accordance with Algerian Law n° 18-07 of June 10, 2018 on the protection of individuals in the processing of personal data, as amended and supplemented by Law n° 25-11 of July 24, 2025.

1. Data Controller Identification (Who We Are)

The data controller ("responsable du traitement") for personal data processed on SiraCar is: [Legal entity name — to be added upon business registration], located at: [Registered address — to be added]. For any privacy-related inquiries or to exercise your legal rights, contact our Privacy Officer at [email protected], customer support at [email protected], or call +213 123 456 789.

2. Personal Data We Collect

We collect personal and technical data categorized as follows based on your use of the website and mobile app:

• Identity & Account Data: Full name, email address, phone number, username, and hashed password.
• Vehicle & Maintenance Data: Vehicle Identification Number (VIN), make, model, year, service records, mileage logs, and damage/repair photos.
• Location Data: Exact GPS coordinates collected only when driving mode or automatic mileage tracking is explicitly enabled in the app.
• Diagnostic Data (OBD2): Vehicle telemetry and fault codes when an OBD2 scanner is connected to the app.
• Financial & Transactional Data: Wallet balance, transaction history, subscriptions, and voucher redemptions. (Note: Payment card details for CIB/Edahabia cards are processed directly by SATIM; we do not store credit or debit card numbers).
• Technical & Usage Data: Website session cookies and mobile device push notification tokens.

3. Purposes of Data Processing

Your data is processed strictly for the following purposes:

• Creating, managing, and securing your user account.
• Decoding VINs and generating vehicle history reports.
• Providing vehicle maintenance tracking, oil change reminders, and inspection alerts.
• Enabling insurance comparison features, automotive forums, and marketplace posts.
• Managing wallet balances, subscriptions, and dispatching push notifications.
• Complying with applicable Algerian legal and regulatory requirements.

4. Data Sharing & Recipients

We do not sell your personal data. We share minimal necessary data with trusted service providers strictly as detailed below:

• Vincario / NHTSA: Receive only the first 11 characters of the VIN (WMI+VDS) for technical specification decoding — no vehicle serial number and no personal identifiers are shared.
• OpenRouter (AI Photo Analysis): Receives damage assessment photos and component coordinates only — no user names, VINs, or location data attached.
• Google / Firebase: Google Sign-In operates as an authentication provider. Firebase is used solely for delivering push notifications via an anonymous device token.
• SATIM / CIB / Edahabia: Direct processing of electronic card payments.
• Ooredoo: Delivery of SMS One-Time Passwords (OTP) for account verification.
• Resend: Delivery of transactional emails and verification links.
• Brandfetch: Fetching public vehicle manufacturer logos (no personal data involved).
• Legal Authorities: Disclosure to law enforcement or judicial bodies strictly when required by law or official court order.

5. International Data Transfers

No personal data of users is transferred abroad. International data exchanges are strictly limited to non-identifying technical vehicle specifications (e.g. general VIN decoding via Vincario/NHTSA) or anonymous notification tokens (Firebase), in full compliance with Law n° 18-07 / 25-11.

6. Data Retention & Account Deletion

Your personal data is retained for the duration of your account's lifecycle. Upon submitting an account deletion request, your personal data is permanently purged within a reasonable timeframe, except for records retained under statutory requirements or legitimate fraud prevention rules (such as temporary phone block lists to prevent system abuse).

7. Your Rights & Complaints (Law 18-07 / Law 25-11)

Under Algerian data protection laws, you possess the following rights regarding your personal data:

• The right to access and obtain a copy of your personal data.
• The right to rectify, update, or correct inaccurate or incomplete data.
• The right to erase (delete) your data or object to its processing on legitimate grounds.

To exercise any of these rights, email us at [email protected]. You also have the legal right to lodge a formal complaint with the National Data Protection Authority (ANPDP - Autorité Nationale de Protection des Données à Caractère Personnel) if you believe your data protection rights have been infringed.

8. Data Security

We implement robust technical and organizational security measures, including encryption in transit and at rest, to safeguard your data against unauthorized access, modification, disclosure, or destruction.

9. Cookies

We use essential cookies to maintain system sessions and store user language preferences. You may manage or disable cookie settings directly in your web browser.

10. Policy Modifications

We may update this Privacy Policy to reflect legislative amendments or platform enhancements. Material updates will be communicated through the platform.