Privacy Policy

1. Who this policy covers

This policy applies to CarMata.com and its used-car marketplace services in India. For privacy questions or requests, email privacy@carmata.com.

2. Information we collect

• Account data, including your name, email address, profile image, authentication identifiers, sessions, and security events.
• Profile and preference data, including display name, market, location, theme, locale, and saved searches.
• Seller and dealer data, including organization membership, invitations, roles, listing ownership, and moderation history.
• Vehicle listing data, declarations, descriptions, prices, locations, photos, and associated upload metadata.
• Buyer contact requests, including the listing, consent version, request status, and the account email explicitly shared with a seller.
• Technical data needed for security and operations, such as IP address, browser details, request identifiers, and service logs.
• Website analytics data from privacy-conscious page tracking, such as page visits, referrers, browser type, device type, and approximate region.

3. Google sign-in data

If you choose Google sign-in, CarMata receives your basic Google profile information: name, email address, profile image, and a stable account identifier. We use it only to create, secure, and link your CarMata account. CarMata does not request access to Gmail, Google Drive, contacts, calendars, or passwords, and does not sell Google user data.

4. How we use information

• Provide accounts, listings, search, preferences, and dealer teams.
• Process images and prepare safe public derivatives.
• Review listings, prevent fraud or abuse, and enforce our terms.
• Deliver a buyer-initiated contact request privately to an authorized seller.
• Maintain security, diagnose faults, and improve service reliability.
• Understand aggregate marketplace usage and marketing performance without selling personal data.
• Comply with law and respond to valid legal requests.

5. What becomes public

Published listings may show vehicle details, city-level location, seller type, descriptions, declarations, and processed photos. We do not intend to publish your email address, private originals, raw storage keys, precise home address, session data, or internal moderation notes. Contact-request emails appear only in the authorized seller inbox after the buyer gives explicit consent.

6. Sharing and service providers

We share data only as needed with infrastructure, authentication, database, object-storage, security, and support providers acting for CarMata; with analytics providers; with dealer organizations you join; with authorities when legally required; or during a properly protected business transfer. A buyer's account email is shared with the relevant seller only after the buyer requests contact and consents to that disclosure. Sellers must use it only for the requested vehicle transaction. Providers may process data outside India. We do not sell personal data.

7. Storage, security, and retention

We use access controls, encrypted connections, private original-image storage, safe derivatives, audit records, and other reasonable safeguards. Before a complete listing is created, the Sell wizard stores its progress under an account-specific key in the current browser. That device copy is removed after successful draft creation. No system is perfectly secure. We retain data only as long as needed for the service, safety, disputes, legal obligations, and backup cycles. Listing and moderation records may remain after a listing is sold or archived where needed for marketplace integrity. Withdrawing a contact request or being blocked removes the stored email from that request; non-sensitive consent and abuse-prevention audit evidence may remain. Deleting an account removes authentication providers, active sessions, profile, preferences, saved searches, saved cars, contact requests, invitations, and dealer memberships. Personal listings are archived and direct identity is replaced with a pseudonymous record. Minimized listing, image, moderation, report, and audit records may remain where needed for safety, disputes, legal obligations, and backup expiry.

8. Your choices and rights

You can download a minimized copy of your account data from Account security. Subject to applicable law, you may also request correction, updating, erasure, consent withdrawal, account deletion, or grievance review. Self-service account deletion is available under Account security. Dealer owners must first transfer ownership or remove their dealer organization. You can withdraw an open contact request from its listing, which removes the stored email. You may change profile preferences and revoke CarMata access from your Google Account. Email privacy@carmata.com. We may verify your identity before acting on a request.

9. Cookies and children

CarMata uses essential cookies for authentication, security, and preferences. The service is intended for adults aged 18 or older and is not directed to children.

10. Changes and contact

We may update this policy as the service or law changes. Material changes will be communicated appropriately. Questions, privacy requests, and grievances may be sent to privacy@carmata.com.