Privacy Policy

1. Information We Collect

We collect the following categories of information when you use the Platform:

Account Information. When you register as a User, we collect your name, phone number (used as your primary identifier), and optional profile photo. When you register as a Dealer, we additionally collect your CNIC (Computerized National Identity Card) number, business name, NTN (National Tax Number) where applicable, showroom address, city of operation, and business registration documents. Dealer accounts require identity verification for the trust scoring system.

Listing & Transaction Data. All information you provide when creating car listings, including vehicle specifications, pricing, photographs, condition scores, inspection data, and vehicle history details. We also record inquiry activity, offer and counter-offer communications, and listing status changes.

Device & Browser Information. We automatically collect your device type, operating system, browser type and version, screen resolution, and language preference to optimize the Platform experience and diagnose technical issues.

Usage Analytics. We track pages visited, search queries, filter selections, time spent on listings, click patterns, and navigation flow. This data is used in aggregate to improve the user experience.

Cookies & Similar Technologies. We use cookies and local storage to maintain your session, remember your preferences (such as dark mode and saved filters), and collect analytics data. See Section 5 for full details.

Location Data. We collect city-level location information derived from your IP address or the city you select in your profile. We do not collect precise GPS coordinates unless you explicitly grant location permission for specific features (such as finding nearby dealers).

2. How We Use Your Information

We use the information we collect for the following purposes:

• Account Management — Creating and maintaining your account, authenticating your identity via OTP or password, managing sessions, and processing account recovery requests.
• Trust Score Computation — Computing and maintaining dealer trust scores based on verification documents, profile completeness, and business maturity. See Section 3 for full details.
• Analytics & Improvement — Understanding usage patterns, measuring feature adoption, identifying performance bottlenecks, and making data-driven decisions to improve the Platform.
• Fraud Prevention — Detecting and preventing fraudulent accounts, fake listings, review manipulation, report abuse, and other activities that undermine marketplace integrity.
• Communication — Sending OTP codes for authentication, push notifications for price drops and new messages, listing status updates, and critical platform announcements.
• Personalization — Displaying relevant search results, recommending cars based on your browsing history, and remembering your filter settings across sessions.

We process your data on the legal basis of contractual necessity, legitimate interest (to operate and improve the Platform, and to prevent fraud), and consent (where you have explicitly opted in, such as for marketing communications).

3. Trust Score Data

The Trust Score algorithm currently uses the following categories of dealer data:

• Document Verification (up to 2.5 points) — Phone verification, CNIC, NTN, business registration, and physical premises verification status. Each verification adds 0.5 points, confirming the dealer is a real, identifiable business.
• Profile Completeness (up to 2.0 points) — Completion of basic information, showroom photos, description, social media links, services, specialties, and return/warranty policies.
• Business Maturity (up to 2.0 points) — Years since establishment — from 0.5 points (1+ year) up to 2.0 points (10+ years of verified operation).
• Performance (up to 3.5 points) — Reserved for future implementation. Will incorporate customer reviews, response rates, and operational metrics as the platform grows.

For a complete explanation of how the Trust Score is calculated, including the scoring formula, tier breakdown, and report penalty system, visit our Trust Score page.

4. Sharing Your Information

We may share your information with the following third parties, strictly for the purposes described:

• OTP Delivery — Your phone number is used to deliver one-time verification codes via WhatsApp for account registration, login, and password reset.
• Avatar Generation — We use DiceBear (api.dicebear.com) to generate default profile avatars. Only a random seed string is sent — no personal data is shared with this service.
• Law Enforcement & Legal Obligations — We may disclose your information if required by applicable Pakistani law, regulation, legal process, or enforceable governmental request, or where we believe disclosure is necessary to protect safety, address fraud, or protect our legal rights.

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via a prominent notice on our Platform before your information becomes subject to a different privacy policy.

5. Cookies & Tracking Technologies

We primarily use browser localStorage (not traditional cookies) to operate the Platform:

• Authentication — JWT access and refresh tokens stored in localStorage for session management. Access tokens expire after 15 minutes; refresh tokens after 7 days.
• User Preferences — Dark mode setting, saved favorites (cars and dealers), recent search queries, and cookie consent status.
• Interaction Deduplication — Short-lived localStorage keys to prevent counting repeated views or clicks on the same listing within 24 hours.

We do not use advertising cookies or cross-site tracking pixels. We do not participate in advertising networks or serve targeted ads. For a comprehensive breakdown of every cookie and local storage key, visit our Cookie Policy.

6. Data Retention

We retain your data only as long as necessary to fulfil the purposes described in this policy, comply with legal obligations, and resolve disputes. Specific retention periods:

Dealer trust score history, confirmed report outcomes, and enforcement actions are retained indefinitely for public accountability. Dealers consent to indefinite retention of trust-related data upon registration. Users may request deletion of their personal data by contacting us at hello@showrooms.pk.

7. Your Rights

You have the following rights regarding your personal information. To exercise any of these rights, contact us at hello@showrooms.pk.

• Right of Access — Request a copy of all personal information we hold about you, provided in a commonly used electronic format within 30 days.
• Right of Correction — Request correction of inaccurate or incomplete information. Most account details can be updated directly through your profile settings; other corrections are processed within 14 days.
• Right of Deletion — Request deletion of your account and associated data per the retention periods in Section 6. Note: published trust score data and confirmed report outcomes for dealer accounts are exempt, as they are essential for marketplace integrity.
• Right of Data Export — Request an export of your data in a structured, machine-readable format (JSON), including profile information, listing data, reviews, and message history. Processed within 30 days.

We may request identity verification before processing any rights request. If you are dissatisfied with our response, you have the right to escalate to the relevant data protection authority in Pakistan.

8. Children's Privacy

Showrooms.pk is not designed for, intended for, or directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at hello@showrooms.pk. We will take immediate steps to delete such information.

Given the nature of the Platform (a car marketplace involving financial transactions), all users must be at least 18 years of age. Dealer accounts require CNIC verification, which inherently confirms the account holder is 18 or older.

9. Security

We take the security of your personal information seriously and implement industry-standard measures to protect it:

• Encryption in Transit — All data transmitted between your device and our servers is encrypted using SSL/TLS (HTTPS), including credentials, messages, and API communications.
• Encrypted Passwords — Passwords are hashed using industry-standard one-way algorithms. We never store plaintext passwords.
• Access Controls — Access to personal data is restricted to authorized personnel who require it for their role, following the principle of least privilege.
• Monitoring & Response — We monitor for security incidents and have procedures for breach detection, containment, and notification. In the event of a breach affecting your rights, we will notify affected users promptly.

No method of transmission over the Internet is completely secure. We cannot guarantee absolute security, but we continuously review and update our security practices to address emerging threats.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will:

1. Update the “Effective Date” at the top of this page.
2. Post a notice on the Platform for material changes that significantly affect how your data is collected or used.
3. Send notification to registered users via the Platform's notification system for significant policy changes.

Your continued use of the Platform after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Email: hello@showrooms.pk
• Company: Showrooms.pk
• Location: Lahore, Pakistan

We aim to respond to all privacy-related inquiries within 14 business days. For urgent matters related to data security or suspected breaches, please include “URGENT” in the subject line.

Related Policies