Privacy Policy

1. Data We Collect

We collect the following personal information when you register and use the Platform: your full name, email address, phone number, and wilaya (region). If you sign in with Google, we receive your email address and display name from your Google account. If you upload an avatar photo, we store it for your profile.

For sellers in the Inspected and auction tiers only: we collect a national ID photo for identity verification. The photo is permanently deleted after verification — only a cryptographic hash (SHA-256) is retained for duplicate prevention. National ID photos are never stored long-term. Buyers, and sellers who only publish direct-sale listings, are not required to provide any identity document.

We store your wallet balance and transaction history (deposits, holds, releases, refunds). Wallet balances are visible only to you through row-level security policies.

We collect IP addresses in audit logs for security purposes. When a page fails, our error-monitoring provider receives technical diagnostic data (page URL, browser and operating system version). We count listing views using a short-lived random identifier that is not linked to your account. We do not build advertising profiles, do not fingerprint your browser, and do not sell or share this data with advertisers.

2. How We Use Your Data

We use your data to operate the Platform: verifying identity where required, publishing and moderating listings, processing offers, auction registrations and bids, managing your wallet and deposit holds, disclosing contact details between a buyer and seller when an offer is accepted (see section 6), facilitating the deal process, sending essential notifications, and maintaining platform security through audit logs. We also use listing activity — views, favourites and offer amounts — in aggregated, de-identified form to produce market statistics and price guidance for the Algerian used-car market. These statistics never identify you, never reveal an individual offer amount, and are never sold to third parties.

3. Data Protection

All data is transmitted over TLS (HTTPS). Sensitive data at rest is protected by Supabase's database encryption.

Row-level security (RLS) policies ensure that users can only access their own data. Wallet balances, auto-bid amounts, and personal information are never exposed to other users.

National ID numbers are stored as SHA-256 hashes — the original number cannot be recovered from the hash. This is used solely for duplicate detection.

National ID photos follow a verify-then-delete pattern: the photo is used for identity verification and then permanently deleted. This complies with the data minimization principle of Law 18-07 Article 9.

4. Data Retention

We retain your data for the minimum period necessary:

• Profile data: retained for the lifetime of your account, and anonymized when your account is deleted.
• National ID photos: deleted immediately after seller verification (verify-then-delete).
• Wallet transactions and bid history: 5 years after creation, as required by financial record-keeping laws.
• Ratings: retained indefinitely for platform integrity. Anonymized upon account deletion.
• Notifications: 180 days for unread, 90 days for read notifications.
• Car photos: 1 year after the vehicle is sold or withdrawn.
• Listing views: 90 days, then purged automatically.
• Favourites: kept while the listing exists; removed when you unfavourite it or delete your account.
• Offers and their amounts: 5 years, as part of the transaction record.
• Listing reports: 2 years after the report is resolved.
• Inspection photos: 2 years (retained as evidence for legal and insurance purposes).
• IP addresses in audit logs: 6 months.
• Referral-attribution records: 13 months.
• Error-diagnostic data (page URL, browser and operating system version): 90 days.
• Ban records: if an account is banned for fraud or abuse, we keep a one-way hash of the phone number indefinitely so the ban cannot be evaded. The phone number itself is not retained and cannot be recovered from the hash.

5. Your Rights

Under Algerian Law 18-07, you have the following rights:

Data export: You can request a full export of your personal data in JSON format. The export includes your profile, wallet transactions, bids and auto-bids, auction registrations, deposit requests, your listings, ratings, notifications, disputes, and your previous export requests. Exports are limited to one per 24 hours, and each download link is valid for 15 minutes from the moment it is generated — you can generate a fresh link at any time from the Security page.

Account deletion: You can request permanent deletion of your account by writing to support@soumni.com from your registered email address. Deletion is handled manually by our team — we action verified requests as quickly as we can, and we will confirm by email once it is done. On deletion your profile is anonymized; records we are legally required to keep are retained according to the schedule above.

Deletion may be delayed while you have: active auction registrations, a won auction pending payment, pending deposit requests, live listings, accepted offers, open disputes, or a positive wallet balance. If any of these apply we will tell you what has to be resolved first.

Data export requests are made from your signed-in account. Keep your session secure and sign out on shared devices — anyone with access to your signed-in session can request an export.

6. Information Shared Between Buyers and Sellers

On direct-sale listings, the seller's name and phone number are hidden from everyone — buyers see only the wilaya. When a seller accepts a buyer's offer, the name and phone number of each party are disclosed to the other, and to no one else, so that the two of you can arrange the sale directly. This exchange is mutual and cannot be undone; it is necessary to perform the transaction you have entered into. Every view of these details is recorded in our audit log, and both parties can see that it was viewed. No contact details are disclosed for offers that are pending, rejected or withdrawn. If you do not want your phone number disclosed to a buyer, do not accept their offer.

7. Third-Party Services

We share limited data with the following service providers:

• Resend: your email address and name are shared to deliver transactional emails (account notices, auction and offer updates, data-export links). Resend does not use your address for any purpose of its own.
• Supabase: All platform data is hosted on Supabase infrastructure. Supabase acts as our data processor.
• Vercel: Request logs (IP addresses and URLs) are processed by Vercel as our hosting provider.
• Sentry: when an error occurs, technical diagnostic data — the page URL, browser and operating system version, and the sequence of actions leading to the error — is sent to Sentry so we can fix it. We have disabled the collection of personal data and of session recordings in this integration.
• Google: If you sign in or link your Google account, your email address and display name are shared with us through Google's OAuth service. Google acts as an identity provider — we do not receive or store your Google password.

We do not share data with advertising networks, analytics third parties, or data brokers. We do not sell your personal data.

8. Cookie Policy

We use the following cookies. All but the last are strictly necessary for the Platform to function:

• Authentication cookie (sb-*-auth-token): Stores your session token. Duration: 1 hour, automatically refreshed.
• PKCE verifier (sb-*-auth-token-code-verifier): Used during the authentication flow. Duration: session only.
• Language preference (NEXT_LOCALE): Stores your preferred language. Duration: 1 year.
• Listing-view counter (smn_vw): a random identifier used only to avoid counting the same visitor twice on the same listing in the same day. It is not linked to your account and is not used anywhere else. Duration: 7 days.
• Referral attribution (smn_sess): records which shared link or QR code brought you to Soumni, so we can attribute sign-ups to the person who referred you. Duration: 180 days.

We do not use advertising or marketing cookies, and we do not share cookie data with third parties. The referral-attribution cookie above is the only cookie that is not strictly necessary for the Platform to function; you can refuse or delete it in your browser without losing access to any feature.

9. Legal Basis

Our data processing is governed by Algerian Law 18-07 on Personal Data Protection (amended by Law 25-11, July 2025). We process data on the basis of: your explicit consent given during registration, contractual necessity for providing the Platform's listing, offer and auction services, and legal obligations for financial record-keeping.

The enforcement authority is ANPDP (Autorité Nationale de Protection des Données à Caractère Personnel). We are committed to phased compliance with all ANPDP requirements, including formal declaration filing and cross-border data transfer authorization for our cloud infrastructure.

10. Children's Privacy

The Platform is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We will notify registered users of material changes through in-app notifications. Your continued use of the Platform after changes are posted constitutes acceptance of the revised Privacy Policy.

12. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us at support@soumni.com.