Privacy Policy

Account data: When you register, we collect your name, email address, phone number, and (for dealers) business name and address.

Listing data: Car details, photos, videos, and pricing information submitted by dealers.

Transaction data: Payment records (processed by Paystack — we do not store card numbers), deposit amounts, and payout references.

Usage data: Pages visited, search queries, listings viewed, browser type, device type, and IP address. Collected automatically via server logs and analytics.

Communications: Messages you send us via email, WhatsApp, or our support channels.

• Create and manage your account
• Process payments and verify deposits via Paystack
• Release dealer contact details to buyers after confirmed payment
• Send transactional emails (booking confirmations, receipts) via Brevo
• Send SMS notifications via Termii
• Send WhatsApp messages (payment confirmations, contact details) via our WhatsApp partner
• Personalise search results and listings based on browsing history
• Prevent fraud and enforce our Terms of Service
• Improve our platform through aggregate analytics
• Send marketing communications (only with your consent — you can opt out at any time)

We share data with the following processors who act under data processing agreements:

• Supabase — database and authentication hosting
• Paystack — payment processing (PCI-DSS compliant)
• Brevo (Sendinblue) — transactional email
• Termii — SMS notifications
• Cloudflare R2 — video storage
• Vercel — web hosting and CDN
• Google Analytics — aggregated usage analytics (anonymised IP)
• Meta Pixel — advertising measurement (you can opt out via Meta Ad Settings)

We do not sell your personal data to third parties.

We use cookies and similar technologies for:

• Strictly necessary: Session management and authentication (cannot be disabled)
• Analytics: Google Analytics to understand site usage (anonymised)
• Advertising: Meta Pixel to measure the effectiveness of our ads
• Functional: Remembering your search preferences and saved filters

You can disable analytics and advertising cookies in your browser settings or via the opt-out links provided by Google and Meta.

We keep your data for as long as your account is active plus 12 months after deletion. Transaction records are retained for 7 years as required by Nigerian financial regulations. You may request deletion of non-financial data at any time.

Under Nigerian data protection law, you have the right to:

• Access — request a copy of your personal data
• Correction — update inaccurate data
• Deletion — request erasure of your data (subject to legal retention obligations)
• Restriction — ask us to stop processing your data in certain circumstances
• Portability — receive your data in a machine-readable format
• Objection — opt out of marketing communications

To exercise any of these rights, email support@buycar.ng. We will respond within 30 days.

We use industry-standard measures to protect your data: HTTPS everywhere, row-level security in our database, encrypted secrets, and restricted admin access. No system is 100% secure — if you suspect a breach, contact us immediately.

BuyCar is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact us and we will delete the account.

We may update this policy from time to time. We'll notify registered users of material changes by email. The "Last updated" date at the top will always reflect the most recent revision.

For privacy-related queries, contact:
BuyCar Technology Limited — Data Protection
Email: hello@buycar.ng
Lagos, Nigeria