Privacy Policy

1. Scope and responsibility

This policy explains how information is handled when you browse rakacars, create or manage an account, advertise or enquire about a vehicle, use available assistance or reminder features, or authorize a business social account connection. The legal identity and registered address of the operator responsible for these purposes will be added before final publication.

A seller, broker, dealership, payment provider or social platform may independently decide how to handle information it receives. We explain sharing below; their own notices also apply to their separate activities.

2. Information we process

• Account and contact information: name, email, phone number, account or seller type, verification status, business profile and contact preferences. Google sign-in provides the identity information needed for the sign-in flow.
• Listings and submitted material: vehicle details, asking price, location, seller contact information, photos, descriptions, and any registration details or other information you include. Photos and documents may contain faces, number plates or other identifying details.
• Enquiries and preferences: buying requirements, saved or compared vehicles, requests for follow-up, messages, support correspondence and available notification preferences.
• Assistance and reminders: text, voice messages, photos, contact consent, photoshoot requests, reminder dates, notes and supporting photos that you choose to submit.
• Payment and service records: the package or service selected, amount, reference, payment status, receipts or proof uploaded for review, and relevant support or review records. Payment providers handle information entered into their own payment interfaces.
• Technical and usage information: IP address, browser or device information, sessions, cookies, browser storage, page interactions, security events and error information, depending on the page and enabled services.
• Connected social account information: the authorized profile, channel, post, reporting and connection information described in the Socials section.

Please provide only information needed for the service. Avoid including passwords, full financial account details or unnecessary identity documents in adverts, photos, messages or support requests.

3. Where information comes from

Information may come from you, a representative such as a broker or dealership, a buyer or seller communicating with us, a sign-in or connected platform, service providers, or technical use of the website. Listings and related contact details may also be imported from external vehicle listing sources or public social channels.

Public availability does not remove privacy rights. You may contact us to correct, challenge or request removal of information supplied by someone else, including an imported advert, even if you never created a rakacars account. Include a listing or source link where possible so that we can assess the information and its source.

4. Purposes and legal grounds

We use information to provide accounts, publish and manage listings, support vehicle searches and enquiries, prepare requested adverts, operate reminders, verify payments, deliver authorized reports, prevent misuse, resolve support issues and comply with law.

Depending on the activity and applicable law, the grounds may be your consent, steps requested before or during an agreement, performance of an agreement, a legal obligation, or permitted legitimate interests in operating and protecting the service after considering individual rights. The purpose and ground for each production activity must be confirmed before final publication. Permission to connect an account or publish an advert does not authorize unrelated uses.

Account codes, service updates and requested follow-up serve different purposes from promotional messages. Where consent is required for marketing or another optional purpose, it must be separate and may be withdrawn. Contact us to stop optional contact or raise an objection; essential security or service notices may still be needed on another lawful ground.

5. Public adverts, private submissions and enquiries

Published adverts and public seller or dealership profiles may expose the contact details, location, photos and other information displayed with them to anyone browsing the website, search engines and other recipients of public content. Review that information before publication. Available contact preferences can limit certain displayed social contact details; they do not make an otherwise public advert private.

Raw assisted-selling material, private reminder photos and payment proof are intended for the relevant user and authorized staff, rather than publication as part of an advert. Photos or text selected and approved for a public listing become public when published. Keep private return links confidential: anyone holding an unexpired bearer link may be able to access the request it identifies.

If you ask us to respond to a seller, find a vehicle or arrange a service, we may share the information necessary for that request with the relevant seller, broker, dealership or provider. Ask us which recipient is involved if that is unclear. Those recipients may have their own responsibilities for the information they receive.

6. Service providers and other disclosures

Depending on the services enabled, providers may assist with hosting and storage, payments, SMS, email, Telegram or WhatsApp communications, analytics, monitoring, translation, image processing and AI-assisted features. Configured integrations include Chapa, SMS Ethiopia, Resend, DigitalOcean storage and Google services. The final list of production providers, their purposes and relevant locations is pending confirmation; configuration alone does not mean every provider receives every category of data.

Providers acting on our behalf must have access limited to the services and purposes required. Platforms and payment providers may also process information for their own purposes under their notices. We may disclose information where required by law, to address a specific legal claim or protect rights on a lawful basis. Any change of operator or business transfer must respect applicable data protection duties and notice requirements.

When an AI-assisted, translation or image-processing feature is used, the necessary submitted content may be sent to the relevant provider. The production provider and permitted purposes must be disclosed before such processing. Connected Google or YouTube API data is not authorized for unrelated AI training, advertising or profiling.

7. Cookies, browser storage and analytics

Sessions and security cookies support sign-in and protection against misuse. Browser storage may retain preferences, comparisons or unfinished listing drafts. Clearing storage can remove an unsent draft or sign you out; it does not delete records already held on our servers.

When enabled in production, Google Analytics measures eligible public pages for guests and ordinary signed-in customers, without an account identity in the page-view payload. Admin accounts and private workflows such as account settings, payments and assisted submissions are excluded. FullStory may record eligible guest browsing interactions; signed-in users and the designated private pages are excluded.

The site currently uses page and account exclusions; a visitor analytics preference panel is not yet available. Consent and withdrawal controls, provider retention settings and any required prior consent must be settled before final publication. Browser tools may restrict cookies or tracking; contact us to raise a concern about processing.

These standalone legal pages do not load Google Analytics or FullStory. A separate platform may use its own cookies when you follow its link or authorize an account.

8. Socials: authorized business account reporting

Where enabled, rakacars Socials uses TikTok, Meta, YouTube and Telegram API Services to collect reports for accounts or channels an authorized manager connects. This is separate from advertising a car, supplying a public social contact link or signing in to a marketplace account.

• Information includes platform identifiers, usernames or channel details, approved permissions, available post or video identifiers, titles, captions, public links, media types, publication times and available account, audience or engagement totals.
• Connection information includes access and refresh tokens, expiry times, collection and authorization-check times, connection status and technical errors. Tokens and app secrets saved in the application database are encrypted and excluded from normal browser responses.
• We use this information to maintain authorized access, collect and show reports, compare permitted reporting history and diagnose failures. Access requires authorized admin permissions and, for authorized platform data, the account owner's authorization for the staff involved.
• The current reporting connections read data; they do not publish posts or retrieve private messages. Meta, TikTok and Google passwords are entered on the provider's own sign-in pages. Telegram's separate account sign-in is described below. These connections do not supply a data resale, advertising-targeting or AI-training feature.

Statistics depend on provider permissions, reporting delays and available API fields. An engagement count is not the content of every comment or a list of every viewer. Source platform posts remain subject to the source platform's own visibility settings.

Disconnecting TikTok, Facebook or Instagram clears locally saved connection tokens and stops collection; saved reporting history needs a separate deletion request. Using Disconnect for YouTube also removes saved YouTube statistics and video reporting data. Pausing updates or archiving an account is not a general deletion request; some authorized token renewals and separately requested updates may still occur.

You may revoke a connection in the provider's app-access settings. For Google and YouTube, use Google Account permissions; you may also request deletion from us. A failed remote revocation must be completed in the source platform. Removing Socials copies does not delete the original posts or the social account.

See the TikTok Privacy Policy, Meta Privacy Policy and Google Privacy Policy. Google and YouTube API information is used only for the authorized reporting purposes described here and is subject to applicable Google and YouTube API data-use restrictions.

rakacars Socials' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Owner-authorized YouTube reporting can include non-public videos; access to those reports remains restricted to authorized staff.

Telegram channel statistics use a separate Telegram user-account session with broader account capabilities than a bot token. This integration requests only the selected channel's messages and counters, channel analytics where available, and the signed-in account's identity needed to authorize it. It does not retrieve private conversations, contact lists or subscriber identities. During sign-in, the authorized admin enters a phone number, a Telegram-delivered code and, if required, a Telegram two-step verification password. Codes and passwords are passed to Telegram for authentication and are not saved in the connection. The phone number and pending authorization material are encrypted while the sign-in is pending.

Pending Telegram sign-ins expire after ten minutes. The collector logs out expired or cancelled statistics sign-ins. Completed sessions and app credentials are encrypted at rest. Disconnect ends this statistics connection and attempts Telegram logout; if logout fails, encrypted revocation material is retained for retries. You can also end the session in Telegram → Settings → Devices. Saved Telegram reporting history remains until separately removed. See the Telegram Privacy Policy.

9. Retention criteria and current maintenance rules

We retain information only while necessary for its identified purpose or a specific lawful retention need. Account, listing, enquiry, reminder and support records need separate retention criteria; an account's existence is not a reason to keep every record forever. Production periods for these categories, payment or accounting records, logs and backups must be confirmed before final publication.

Current assisted-listing maintenance is configured to remove abandoned staged requests or uploads after 24 hours. Raw attachments become eligible for cleanup once both the attachment and the request's closed or published state are older than the configured 90-day period. Reopened requests are preserved. These rules depend on scheduled maintenance running and do not automatically delete published copies or audit records, or postpone a qualifying privacy request.

TikTok, Facebook, Instagram and Telegram reporting history currently has no automatic age-based deletion; removal is a separate manual process. YouTube data has separate provider-specific refresh, authorization and removal rules, and its Disconnect action removes saved reporting data. A lawful deletion request applies independently of routine maintenance.

We may retain limited records for a specific legal obligation or to establish, exercise or defend a legal claim, with restricted use and a review or end point. Backups are not erased instantly. Actual retention periods and deletion or restore safeguards must be established before final publication.

10. Storage, transfers and security

The website, its infrastructure and connected providers may process information in the countries where the relevant systems operate. The production provider list and storage countries are pending confirmation. Before processing or transferring personal information, the required legal grounds, local storage arrangements, safeguards and any approvals must be established under applicable law. General account authorization is not a substitute for those duties.

Access controls, private storage for designated submissions and encrypted saved social credentials help protect information. Security measures reduce risk but cannot guarantee prevention of every incident. We will handle incidents and provide notices as required by applicable law.

11. Your rights and requests

Subject to applicable law, you may request access and a copy, correction, deletion, restriction of processing, objection to processing, withdrawal of consent, and portability where it applies. Contact us if you want to challenge a decision affecting your account; ask for a human review rather than relying on an automated label or report.

Email rakacars@gmail.com with the request and a relevant account, listing, enquiry or connected platform reference. You do not need to create an account. People represented in a photo, imported advert or submission by someone else may also contact us. We will verify identity or authority proportionately and protect other people's information.

We will acknowledge the request, explain any information needed to locate or verify it, and handle it without excessive delay within applicable legal periods. We will communicate the outcome, any lawful restriction or refusal, and complaint options. Qualifying requests are handled free of charge. See the Data Deletion instructions for the deletion process and its effects.

Withdrawal of consent does not affect earlier lawful processing or a separate lawful retention obligation. You may complain directly to the Ethiopian Communications Authority or another competent authority, or seek a remedy available under law. Contacting us first is not a condition of those rights.

12. Children and changes in purpose

Account, advertising and connected business account features are intended for adults with legal capacity or appropriately authorized business representatives. Contact us if you believe information concerning a child has been submitted so that we can assess and address it. A public photo or third-party submission is not an exception to applicable privacy protections.

Information collected for one purpose is not automatically available for an incompatible purpose. New optional purposes, sensitive processing or materially different data use require the notice and legal grounds applicable to that activity.

13. Changes and contact

The version and revision date appear above. Before material changes to final policies take effect, we will provide affected users appropriate notice through the service or available contact details and seek fresh consent or acceptance where required. An update does not authorize incompatible new uses of previously collected information.

For questions or requests about this document, contact rakacars@gmail.com.