Privacy Policy

We collect only the data necessary to run a curated marketplace for luxury and performance cars listed by verified UAE showrooms:

Account information. Your name, email address and phone number, provided when you create a buyer account. Your phone number is verified with a one-time passcode (OTP).

Enquiry data. When you tap Call or WhatsApp on a listing, we record that the enquiry happened - the listing involved and your city (via a local IP lookup) - so dealers and our reporting can see interest in a car. You reach the dealer directly through your own phone or WhatsApp; Carzle does not relay your message or sit in the middle of the conversation. If you are signed in to a Carzle account, your account name and phone number are shown to that dealer alongside the enquiry so they can follow up. If you are browsing without an account, none of your contact details are captured or shared.

Technical data. IP addresses are processed temporarily for security (for example, preventing brute-force attacks). We do not store your IP address or device details against an anonymous enquiry unless you have explicitly consented.

We process your data on the following bases:

Consent. Explicit permission you give via the cookie-consent banner, including your choice about whether we may store technical identifiers such as your IP address with an enquiry.

Contractual necessity. Fulfilling your requests to contact a dealer or manage your account.

Legal obligation. Complying with UAE regulatory requirements.

We do not sell your personal data. Limited data is shared only with the partners that run the platform:

Dealers. If you are signed in and contact a dealer, your account name and phone number are shared with that specific dealer so they can respond to your enquiry. Anonymous enquiries share none of your contact details.

Twilio. For delivering transactional SMS, including OTP verification codes.

SendGrid. For delivering transactional email.

Stripe. For securely processing showroom subscription payments. Carzle does not facilitate or process any payment for a vehicle purchase, and we do not store raw payment credentials.

Cloudflare. For content delivery, platform security, encrypted storage of vehicle media, and cookieless Web Analytics.

In line with the UAE PDPL, we keep personal data only as long as it serves a clear purpose, then remove it automatically:

Enquiry records. Anonymised 24 months after the event. We strip the IP address, user agent, phone number and any account link, keeping only aggregate counts and the event type for business reporting.

Browsing history. Your saved view history is purged 6 months after each view.

Operational logs. Security and activity logs are deleted after 90 days.

Location. Enquiry logging uses a local IP lookup to identify your city only; no precise GPS location is stored.

We protect your data with appropriate technical and organisational measures, including:

Encryption. Sensitive credentials and secrets are encrypted at rest using AES-256, and all traffic is served over HTTPS.

Pseudonymisation of historical logs.

Access controls and regular reviews to maintain platform integrity.

Under the UAE PDPL, you have the right to:

• Access. Request a copy of the data we hold about you. Access requests are handled manually by email ([email protected]) and completed within 30 days.
• Rectification. Correct any inaccurate or incomplete information.
• Erasure.Request a full purge of your profile ("right to be forgotten").
• Withdraw consent. Opt out of non-essential processing at any time.

To exercise any of these rights, contact [email protected]. We execute erasure requests within 30 days.