Privacy Policy

XportACar is a brand operated by Global Business Consultancy L.L.C-FZ, registered in the Meydan Free Zone, Dubai, UAE (trade licence 2534919.01), at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE. 'We', 'us' and 'our' refer to this entity as the controller of personal data processed through the platform.

We collect personal data when you create an account, complete KYC, place bids, win and pay for vehicles, or contact support. We also receive limited technical data from your device.

• Account: name, email, phone, company details (if applicable), country, preferred language.
• KYC: passport or driving licence and, for business buyers, company registration documents.
• Transaction: bids, watchlist entries, invoices, payment proofs.
• Inspector-uploaded content: vehicle photos and supporting documents.
• Technical: device identifiers, push tokens, app/browser version, session logs.
• Communications: messages and attachments you send to support.

We use this data to operate the platform, verify your identity, process bids and payment proofs, arrange shipping and customs, send service messages, prevent fraud, and comply with applicable laws.

For users in the EU/EEA we rely on GDPR Article 6 bases:

• Contract — to register your account, run the auction, take payment proofs and arrange shipping.
• Legal obligation — records required by tax, anti-money-laundering and other laws.
• Legitimate interest — fraud prevention, security and service improvement (you may object — see 'Your rights').
• Consent — for optional marketing emails. You can withdraw consent at any time.

We do not sell personal data. We share it with the service providers that run the platform:

• Supabase — authentication, database and storage hosting.
• Vercel — website hosting.
• Apple — distribution of our mobile apps (App Store / TestFlight).
• Expo — push notifications and over-the-air JS updates for the mobile apps.
• auto.dev — vehicle reference data and market valuations.

Planned but not yet integrated: Stripe (payments) and Resend (email). We will update this policy before introducing them. We may also share data where required by law or to protect users.

XportACar operates between the UAE and the EU, so personal data is necessarily transferred between these regions. Where transfers leave the EEA, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) where required by the GDPR. The UAE Federal Personal Data Protection Law (PDPL) applies in parallel for UAE-based users.

We keep data only as long as needed:

• Account: while active, plus up to 24 months after closure (unless longer is required by law).
• KYC: typically 5 years after the last transaction, per anti-money-laundering rules.
• Transactions and invoices: 7 years for tax/accounting.
• Support communications: 24 months after the last contact.
• Technical logs: up to 12 months.

After these periods, data is deleted or anonymised.

If you are in the EU/EEA you may:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion (subject to legal retention);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent.

Email support@xportacar.com to exercise any of these. We respond within the GDPR's one-month window, extendable by two months for complex requests.

Our website uses cookies that are strictly necessary to keep you signed in and to remember language and currency. We do not use third-party analytics or advertising trackers, and our mobile apps do not perform cross-app tracking.

The platform is for adult business and consumer buyers. We do not knowingly collect data from anyone under 18. If you believe a minor has used the platform, contact us so we can delete the account and related data.

We protect personal data with HTTPS encryption in transit, role-based database access, row-level security policies, signed URLs for sensitive uploads and a human KYC review. No system is perfectly secure, but we follow industry-standard measures and review them regularly.

If we discover a personal-data breach likely to result in a high risk to your rights, we will notify the relevant supervisory authority within 72 hours and tell you without undue delay, in line with GDPR Article 34.

Email our data team at support@xportacar.com. We have not yet appointed a Data Protection Officer; once required by law or scale, we will publish DPO contact details here.

Where the GDPR requires an EU representative under Article 27, we will publish their name and contact details here. This appointment is pending and will be in place before we actively market the service to consumers in the EU.

You have the right to lodge a complaint with a supervisory authority. For EU users, this is the data-protection authority in your country of residence.

For any privacy question, email support@xportacar.com or write to Global Business Consultancy L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE.

We may update this policy as the platform evolves or as required by law. Material changes will be announced in the apps and on the website. The current version date is shown at the top of this page.