Privacy Policy — IR Cars

Last updated: October 5, 2026

This Privacy Policy explains what information the IR Cars app and its backend actually collect, how it is used, who it is shared with, and how you can access, correct, or delete it. It is written to accurately describe the current IR Cars implementation. If you have questions, contact us at ircars.office@gmail.com.

1. Who is responsible

IR Cars ("IR Cars," "we," "us") operates the IR Cars mobile app and the marketplace it connects to, serving Iraq and the Kurdistan Region. For any privacy question, correction, or request, contact ircars.office@gmail.com.

2. What we collect

Category	Examples	Why
Account	Your Iraqi mobile phone number (your account identifier), a password (never stored in readable form — see Section 9), your name, chosen app language, account role and status	Create and secure your account; sign you in
Dealer / company profile (dealer accounts only)	Company name, description, logo and cover images	Show your public dealer profile and its cars to other users
Verification (sellers, optional)	Documents you upload for the "verified seller" badge	Manual review of a verification request; stored in a private file bucket, never public
Listings	Vehicle details, photos, price, location (governorate only — never precise GPS coordinates), the contact number(s) you choose to publish, rental/installment terms	Publish your listing to other users
Photos you upload	Listing photos, dealer logo/cover, your profile photo, showroom images	Displayed on your listing or profile; requested only when you choose to add a photo, never at app startup
Payment/order records (paid listing uploads only)	That a paid order exists, its package (Standard/VIP) and status	Track which listings have a paid upload slot. Payment itself happens outside the app (bank transfer / cash to the published payment number) — the app never collects card, bank account, or other payment-instrument details
Favourites and saved searches	Cars you favourite, filters you save	Show them back to you across sessions
Support / reports	Messages you send us, reports you file or that concern a listing	Handle support and moderation
Technical / security	IP address and timestamps on authentication, account-creation verification and password-reset requests, rate-limit records	Security, fraud, and abuse prevention

We do not collect email addresses from normal customer or dealer accounts (only internal admin/staff accounts use email, kept separate from customer data). We do not access precise device location, your contacts, your microphone, your SMS, or your call log. IR Cars is intended for users who are at least 18 years old, and we do not knowingly collect data from children.

3. How we use data

Create, secure, and authenticate your account (phone number + password)
Deliver a one-time verification code by WhatsApp or SMS when you create an account or use "Forgot password" — never for normal sign-in (Section 4)
Publish, review, and moderate listings
Show listings and the contact details you choose to publish to other users
Let you manage your own listings, favourites, and saved searches
Provide customer support and respond to reports
Prevent fraud, spam, and abuse of the platform
Comply with applicable law

We do not use your data for advertising, and we do not build advertising profiles.

4. Verification codes (WhatsApp / SMS)

When you create an account, and when you use "Forgot password," we send a 6-digit verification code to the phone number you entered. We use the third-party verification messaging service OTP IQ (otpiq.com) to deliver it: we ask for it to be sent by WhatsApp first and, if it cannot be delivered that way, by SMS. When you create an account, the code confirms that the phone number is yours; with "Forgot password," it confirms that it is you before you can choose a new password. Each code expires after a short time, can be used only once, and works only for the purpose it was requested for. Codes are never stored in readable form (only a cryptographic hash is kept). We do not send these codes by email, and the service is not used for anything else — no other messages, no marketing. Sending the message requires giving your phone number and the code to OTP IQ as our processor for that single purpose and, when WhatsApp is used, the message is delivered through WhatsApp; see OTP IQ's own privacy policy and WhatsApp's for how they handle that message. Signing in to an existing account with your phone number and password does not send a code.

5. What is shared, and with whom

Other users (public listing information): your listing's published contact number(s), vehicle details and photos; if you have a dealer/company account, your public company profile (name, description, logo, cover image) and the cars associated with it. Your account phone number is otherwise never shown to other users unless you choose to publish it as a listing's contact number.
Private account information (your password, your unpublished draft listings, your favourites, your saved searches, verification documents you upload) is never displayed publicly and is only accessible to you and, where necessary for moderation or support, authorised IR Cars staff.
Service providers (processors) who help us run the service: our backend/hosting provider (Supabase — authentication, database, and file storage, and the server-side functions that enforce upload limits, moderation, and password resets), and OTP IQ (delivery of verification codes by WhatsApp or SMS, Section 4, for account creation and password reset only). We do not use any advertising, analytics, or crash-reporting SDK in the app at this time — no usage data is sent to any tracking or advertising network.
Authorities: where required by valid legal process, or to protect the rights, property, or safety of IR Cars, our users, or the public.
We do not sell personal data.

Because Supabase operates internationally, your data may be processed on infrastructure located outside Iraq as part of providing the service described above.

6. Retention

Account data: kept while your account is active.
Verification code (account creation or password reset): usable for 10 minutes, then invalid and later purged.
After a code is accepted: the account-creation step or password-reset session that follows expires after 15 minutes.
Search history / analytics events used to power search: automatically deleted after 180 days.
Listing view counters: automatically deleted after 90 days.
One-time password/verification-code event logs: automatically deleted after 7 days.
Verification documents: retained for as long as needed to complete the verification review and a reasonable period afterward in case the decision is disputed; we are working toward a fixed automatic deletion schedule for these files.
Account deletion (Section 8): we remove or anonymise personal data except records we must keep for legal, security, accounting, or dispute-resolution purposes (order/payment history is kept in anonymised form rather than deleted), and except a dealer company's listing data, which is preserved and reassigned to a new responsible party rather than deleted.

7. Your choices and rights

Edit your profile in the app.
Request account deletion from the app (Profile → Settings → Delete Account). This immediately marks your account for deletion, unpublishes your own listings, and removes personally identifying profile fields; the account and remaining personal data are permanently deleted after a 30-day grace period, during which you can cancel the request from the same place. You may also request deletion from outside the app — see our Account Deletion page.
If you are a dealer/company owner, deleting your account does not delete your company's listings — they are preserved under administrator custody until a new responsible owner is assigned.
You may contact ircars.office@gmail.com to ask what data we hold about you, request a correction, or ask us to delete it outside the in-app flow.

8. Account deletion — what actually happens

You request deletion in-app (Profile → Settings → Delete Account) or via our external Account Deletion page.
Your own approved listings are immediately unpublished.
Your name, profile photo, and email (staff accounts) are removed immediately.
Your account enters a 30-day grace period during which you can cancel the request from the app and keep your account.
After the grace period, your account and everything else it owns (listings, photos, favourites, saved searches, drafts) is permanently deleted — except a dealer company you own, which is preserved and reassigned rather than deleted (Section 6), and except order/payment records, which are kept in anonymised form.
Once deleted, the account can no longer sign in or access the service.

9. Security

Data is transmitted over encrypted (HTTPS) connections. Your password is never stored by us in readable form — it is hashed by our authentication provider using industry-standard methods. Verification codes are hashed at rest, never logged, and never returned by any API response. Database access is governed by row-level security policies so an account can only read and change data it is authorised to. Access to production systems is restricted to authorised staff and logged. Verification documents are stored in a private file bucket that is never publicly accessible. No system can be guaranteed 100% secure; we use these measures as reasonable technical and organizational safeguards.

10. Children

IR Cars is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us at ircars.office@gmail.com and we will take appropriate action.

11. Changes to this policy

We may update this Privacy Policy as the app's features or data practices change. Material changes will be reflected in the app (Profile → Settings → Privacy Policy) and on this page, with an updated "Last updated" date.

12. Contact

Questions, corrections, or data requests: ircars.office@gmail.com.