Privacy Policy

Template — needs legal review before launch. Replace every [bracketed] item. This text is a starting point, not legal advice.

This policy explains what Xora Cars ("we") collects when you use the Xora Cars website, why, who sees it, and the choices you have. It describes how the website actually works today. Xora Cars is a marketplace: we connect buyers with verified used-car dealers and brokers ("dealers"). We do not sell cars.

1. Information collected when you register or sign in

• Mobile number or email address, used to send you a one-time code (OTP) to sign in. We don't use passwords.
• Name, if you add it in My Account.
• Sign-in records: when and from which IP address and device you signed in, to keep accounts secure.

You can browse cars, use search and chat with dealers on WhatsApp without an account.

2. Dealer account information

Dealers and brokers who register give us:

• business name, address and city, and the owner's name, mobile number and email (both verified by OTP);
• business, identity and authorization documents for verification (for example registration, PAN or authorization letters);
• a private business phone number used by our team.

Documents are stored privately and seen only by our verification team. A dealer's business name, city, verified date and sales history on Xora Cars are shown publicly. Their phone number, email address and documents are not.

3. Vehicle details and registration information

For each car, the dealer gives us details such as make, model, variant, year, kilometres, price, condition notes, the registration month and year, the registration state and the full registration number.

• The full registration number is kept privately so we can detect duplicate or misleading listings. Only the dealer who listed the car and authorised Xora Cars staff can see it.
• Buyers see only a shortened form: the state code, the RTO code and the last two digits (for example RJ12DL1234 is shown as RJ1234). This shortened form is created on our servers, and the full number is never sent to public pages.
• Condition notes marked "for our review team" are not shown publicly.

4. Mandatory vehicle photographs

Dealers must upload photos of the front, rear, left side, right side, interior, dashboard and engine (and the odometer) before a listing can be reviewed. We require them so buyers can see the actual car and so our moderators can check the listing.

• Photos become public once the listing is approved.
• When a photo is uploaded we re-save it, which removes hidden data such as GPS location. We also refuse the same photo twice on one listing.
• Dealers are asked not to include people, other vehicles' number plates or personal documents in listing photos. Tell us if you see one and we will remove it.

5. Dealer WhatsApp contact information

Every dealer must verify a WhatsApp number (by a code sent by SMS, unless it is the mobile number they already verified when signing in). We use it only for the Chat on WhatsApp button on that dealer's approved listings.

• The number is not printed on the page. Tapping the button opens WhatsApp with a ready-made message naming the car and its listing reference.
• Conversations then happen in WhatsApp, a service of WhatsApp LLC / Meta, under their own privacy policy. We don't see or store your WhatsApp messages, and opening the chat doesn't confirm the dealer has read it.
• The button works only while the dealer's account is approved and active.

6. Dealer sales and delivery photographs

Dealers can mark their own listings as sold and add photos of the delivery to a public "Previously sold through Xora Cars" gallery, shown on that dealer's car pages and on their deliveries page.

• Photos may show the delivered car, the key handover and, only with permission, the customer or other people. Photos with people are optional.
• For every photo, the dealer must declare that they may publish it. For any photo showing a recognisable person, the dealer must also declare that each person agreed to it being shown publicly. We do not accept such photos without that declaration. We rely on the dealer's declaration and do not verify consent ourselves.
• Only sales of cars that were live on Xora Cars count, and only those are shown. Sales counts are worked out from listings marked sold, not typed in by dealers. Our team can leave out sales it can't confirm, hide or remove photos, and pause a dealer's gallery.
• If you appear in a delivery photo, or it shows your car, and you want it removed, use "Report photo" on the gallery. A privacy request hides the photo immediately while we review it. When we remove a photo, its image file is deleted. A record that it existed is kept for our audit trail.

7. Enquiries and communication

When you send a dealer a question or test-drive request through Xora Cars, we store your message and, only with your consent for that dealer, share your name and mobile number with them. You can withdraw that consent in My Account. Withdrawing stops future sharing; it can't recall details already shared. Dealers record the progress of enquiries (for example "contacted" or "converted").

We also keep support requests and listing or photo reports you send us. We send service messages by SMS, email or in-app notification (for example sign-in codes and replies to your enquiries).

8. Search and browsing information

• What you type in the search box is sent to our servers to suggest matching brands, models and cars. We don't keep a history of your searches against your account.
• Cars you open are remembered on your device in a first-party cookie (up to 12 car IDs, for 60 days). We use it to show "Recently viewed" and "Cars you may like". Clearing your cookies removes it.
• Cars you save are stored in your account.
• We keep standard server and security logs (IP address, pages requested, time) and short-lived rate-limit counters by IP address to stop abuse.

We don't use advertising trackers or sell your data.

9. Data storage and security

Data is stored with our hosting and database providers [name the provider and region, e.g. in India]. Uploaded files are stored privately and served only through checks of who may see them. We use HTTPS, one-time sign-in codes, role-based access for staff, an audit log of staff actions, re-saving of uploaded images, and optional virus scanning of uploads.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

10. Sharing with authorised parties

We share personal data only:

• with a dealer, as described in sections 6 and 7;
• with service providers who process it for us under contract: hosting and storage, SMS (for example MSG91), email delivery and, if enabled, virus scanning;
• with authorised Xora Cars staff who need it for verification, moderation or support;
• with government or law-enforcement authorities when the law requires it, or to protect users against fraud.

We don't sell personal data.

11. Dealer verification and listing approval

Our team reviews dealers' documents before approval and reviews every listing before it goes live. This uses the information in sections 2–4. Verification is about the dealer's identity and authorization. We do not physically inspect cars, so always see the car and its papers yourself.

12. Data retention and deletion

• Accounts: kept while active. If you ask us to delete your account, we delete or anonymise your personal data except what we must keep by law. [State the period.]
• Enquiries and consent records: [N years], so we can deal with disputes.
• Dealer verification documents: for the dealer relationship plus [N years].
• Listings, moderation and audit records: kept as business records, never edited after the event. Removed listing and delivery photos have their image files deleted.
• Past payment and referral records from features we no longer offer: as required by tax and accounting law.
• Recently-viewed cookie: 60 days on your device.

13. Your rights (users and dealers)

Under the Digital Personal Data Protection Act, 2023 and other applicable Indian law, you can:

• ask what personal data we hold about you;
• correct or update it;
• ask us to erase it (where we don't need to keep it by law);
• withdraw consent you gave, for example to share your details with a dealer;
• nominate someone to exercise these rights for you;
• raise a grievance with us, and then with the Data Protection Board of India.

Dealers can correct listing details from their dashboard and business details through support.

Make a request through My Account → Support → Privacy request, the Report photo link on a delivery photo, or the contact details below. We reply within [30] days.

Xora Cars is not meant for children. Please don't create an account if you are under 18.

14. Contact for privacy questions

Grievance Officer: [name]

Email: [privacy email]

Address: [registered address, Jaipur, Rajasthan]

We acknowledge privacy requests within 48 hours.

*Changes:* when we change this policy we update the version shown on this page. Material changes are announced on the website.