Privacy Policy

1. Data We Collect

We collect the following personal information when you register and use the Platform: your full name, email address, phone number, and wilaya (region). If you sign in with Google, we receive your email address and display name from your Google account. If you upload an avatar photo, we store it for your profile.

For sellers in the Inspected and auction tiers only: we collect a national ID photo for identity verification. The photo is permanently deleted after verification. Only a cryptographic hash (SHA-256) is retained for duplicate prevention. National ID photos are never stored long-term. Buyers, and sellers who only publish direct-sale listings, are not required to provide any identity document.

We store your wallet balance and transaction history (deposits, holds, releases, refunds). Wallet balances are visible only to you through row-level security policies.

We collect IP addresses in audit logs for security purposes. When a page fails, our error-monitoring provider receives technical diagnostic data (page URL, browser and operating system version). We count listing views using a short-lived random identifier that is not linked to your account. We do not build advertising profiles, do not fingerprint your browser, and do not sell or share this data with advertisers.

2. How We Use Your Data

We use your data to operate the Platform: verifying identity where required, publishing and moderating listings, processing offers, auction registrations and bids, managing your wallet and deposit holds, disclosing contact details between a buyer and seller when an offer is accepted (see section 6), facilitating the deal process, sending essential notifications, and maintaining platform security through audit logs. We also use listing activity (views, favourites and offer amounts) in aggregated, de-identified form to produce market statistics and price guidance for the Algerian used-car market. These statistics never identify you, never reveal an individual offer amount, and are never sold to third parties. If you ask us to, we also send you a monthly email repeating the confirmed sale prices published on our market prices page. You can unsubscribe from it with one click in any of those messages, and we never use that address for anything else.

3. Data Protection

All data is transmitted over TLS (HTTPS). Sensitive data at rest is protected by Supabase's database encryption.

Row-level security (RLS) policies ensure that users can only access their own data. Wallet balances, auto-bid amounts, and personal information are never exposed to other users.

National ID numbers are stored as SHA-256 hashes: the original number cannot be recovered from the hash. This is used solely for duplicate detection.

National ID photos follow a verify-then-delete pattern: the photo is used for identity verification and then permanently deleted. This complies with the data minimization principle of Law 18-07 Article 9.

4. Data Retention

We retain your data for the minimum period necessary:

• Profile data: retained for the lifetime of your account, and anonymized when your account is deleted.
• National ID photos: deleted immediately after seller verification (verify-then-delete).
• Wallet transactions and bid history: 5 years after creation, as required by financial record-keeping laws.
• Ratings: retained indefinitely for platform integrity. Anonymized upon account deletion.
• Notifications: 180 days for unread, 90 days for read notifications.
• Car photos: 1 year after the vehicle is sold or withdrawn.
• Listing views: 90 days, then purged automatically.
• Favourites: kept while the listing exists; removed when you unfavourite it or delete your account.
• Offers and their amounts: 5 years, as part of the transaction record.
• Listing reports: 2 years after the report is resolved.
• Inspection photos: 2 years (retained as evidence for legal and insurance purposes).
• IP addresses in audit logs: 6 months.
• Referral-attribution records: 13 months.
• Monthly market-prices email subscription: kept until you unsubscribe, after which only the record of the unsubscribe is retained, so we do not email you again.
• Error-diagnostic data (page URL, browser and operating system version): 90 days.
• Ban records: if an account is banned for fraud or abuse, we keep a one-way hash of the phone number indefinitely so the ban cannot be evaded. The phone number itself is not retained and cannot be recovered from the hash.

5. Your Rights

Under Algerian Law 18-07, you have the following rights:

Data export: You can request a full export of your personal data in JSON format. The export includes your profile, wallet transactions, bids and auto-bids, auction registrations, deposit requests, your listings, ratings, notifications, disputes, and your previous export requests. Exports are limited to one per 24 hours, and each download link is valid for 15 minutes from the moment it is generated. You can generate a fresh link at any time from the Security page.

Account deletion: You can request permanent deletion of your account from the Security page in your account settings. We email a one-time code to confirm the request is really coming from you. Requests are actioned manually by our team, and we confirm by email once it is done. You can also still write to support@soumni.com from your registered address. On deletion your profile is permanently anonymized: your name, email address, phone number, location and identity document are erased, and there is no recovery period. Records we are legally required to keep are retained according to the schedule above, with your identity removed. We do keep a one-way hash of your national ID number: it cannot be used to recover the number itself, and it exists only to prevent one identity being registered twice.

Deletion may be delayed while you have: active auction registrations, a won auction pending payment, pending deposit requests, live listings, accepted offers, open disputes, or a positive wallet balance. If any of these apply we will tell you what has to be resolved first.

Both data export and account deletion require a one-time code sent to your registered email address: being signed in is not enough on its own. Keep your session secure and sign out on shared devices.

6. Information Shared Between Buyers and Sellers

On direct-sale listings, the seller's name and phone number are hidden from everyone: buyers see only the wilaya. When a seller accepts a buyer's offer, the name and phone number of each party are disclosed to the other, and to no one else, so that the two of you can arrange the sale directly. This exchange is mutual and cannot be undone; it is necessary to perform the transaction you have entered into. Every view of these details is recorded in our audit log, and both parties can see that it was viewed. No contact details are disclosed for offers that are pending, rejected or withdrawn. If you do not want your phone number disclosed to a buyer, do not accept their offer.

7. Third-Party Services

We share limited data with the following service providers:

• Resend: your email address and name are shared to deliver transactional emails (account notices, auction and offer updates, data-export links). Resend does not use your address for any purpose of its own.
• Supabase: All platform data is hosted on Supabase infrastructure. Supabase acts as our data processor.
• Vercel: Request logs (IP addresses and URLs) are processed by Vercel as our hosting provider.
• Sentry: when an error occurs, technical diagnostic data (the page URL, browser and operating system version, and the sequence of actions leading to the error) is sent to Sentry so we can fix it. We have disabled the collection of personal data and of session recordings in this integration.
• Google: If you sign in or link your Google account, your email address and display name are shared with us through Google's OAuth service. Google acts as an identity provider. We do not receive or store your Google password.
• Google Analytics: usage measurement data (pages visited, approximate location derived from your IP address, device and browser type) is processed by Google on our behalf to produce aggregated visit statistics. Details are in the cookie section below.
• Meta: when our advertising campaigns run, campaign measurement data and, if you are signed in, a hashed (SHA-256) form of your account email address are shared with Meta to measure the results of our campaigns. Details are in the cookie section below.

We share measurement data with the analytics and advertising providers named in the cookie section below (Google and Meta). We do not share your data with data brokers, and we do not sell your personal data.

8. Cookie Policy

We use the following cookies set by Soumni itself. All but the last are strictly necessary for the Platform to function:

• Authentication cookie (sb-*-auth-token): Stores your session token. Duration: 1 hour, automatically refreshed.
• PKCE verifier (sb-*-auth-token-code-verifier): Used during the authentication flow. Duration: session only.
• Language preference (NEXT_LOCALE): Stores your preferred language. Duration: 1 year.
• Listing-view counter (smn_vw): a random identifier used only to avoid counting the same visitor twice on the same listing in the same day. It is not linked to your account and is not used anywhere else. Duration: 7 days.
• Referral attribution (smn_sess): records which shared link or QR code brought you to Soumni, so we can attribute sign-ups to the person who referred you. Duration: 180 days.

We also use the following third-party measurement and advertising cookies. None of them is necessary for the Platform to function:

• Google Analytics 4 (_ga, _ga_*): statistics and measurement cookies operated by Google, used to understand how visitors use the site so that we can improve it. Data on our analytics property is retained for 14 months. Location derived from your IP address is used in aggregate only, never to identify you.
• Google advertising features (Google Signals): when these features are enabled, Google associates visit data with signed-in Google accounts in order to give us aggregated demographic reporting and, at a later stage, advertising measurement for our own campaigns. We receive aggregated reports only, never a list of individual accounts.
• Meta Pixel (_fbp): an advertising and measurement cookie operated by Meta, used to measure the results of our advertising campaigns. If you are signed in, a hashed (SHA-256) form of your account email address may be shared with Meta so that a campaign result can be matched to a visit. Meta cannot recover the original address from that hash.

Visitors from the European Economic Area, the United Kingdom and Switzerland have these measurement and advertising features disabled by default: in those regions our consent-mode defaults deny cookie storage unless you give consent.

The Platform uses the third-party measurement and advertising cookies listed above. We do not sell your personal data, and the data these cookies produce is used only to improve the Platform and to measure our own advertising campaigns. None of them is strictly necessary for the Platform to function, and neither is the referral-attribution cookie: you can refuse or delete any of them in your browser without losing access to any feature.

You can also limit this tracking through your browser settings (blocking third-party cookies, or turning on its tracking-protection features) or with a content-blocking extension.

9. Legal Basis

Our data processing is governed by Algerian Law 18-07 on Personal Data Protection (amended by Law 25-11, July 2025). We process data on the basis of: your explicit consent given during registration, contractual necessity for providing the Platform's listing, offer and auction services, and legal obligations for financial record-keeping.

The enforcement authority is ANPDP (Autorité Nationale de Protection des Données à Caractère Personnel). We are committed to phased compliance with all ANPDP requirements, including formal declaration filing and cross-border data transfer authorization for our cloud infrastructure.

10. Children's Privacy

The Platform is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We will notify registered users of material changes through in-app notifications. Your continued use of the Platform after changes are posted constitutes acceptance of the revised Privacy Policy.

12. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us at support@soumni.com.