Privacy policy

Cabacar operates a marketplace for importing vehicles and spare parts into Algeria, and is the controller for the data described below.

Contact: contact@cabacar.com. Full legal details (registered name, trade register, tax number, registered office) will be added here before final production launch.

We collect only what the service needs in order to work.

Account — first name, last name, email address, phone number, password (never stored in clear: it is hashed with bcrypt), and where applicable your Google identifier and profile picture if you use Google sign-in.

Sessions — at each sign-in: IP address, browser identifier (user-agent), creation and last-used dates. This lets you see and revoke your active sessions, and lets us detect fraudulent token reuse.

Buyers — delivery addresses (recipient, phone, street, city, wilaya, country, postcode), order history, favourites, basket.

Professional sellers — trading name, business address and phone, tax identification number where applicable, and the supporting documents filed, in particular the trade register, for verification (KYB).

Messages — messages, attachments, document requests and price proposals exchanged in the platform's messaging.

Reviews and reports — rating, comment, and the order that makes you eligible to rate; the reason for and details of a report.

Technical logs — an audit log records sensitive actions (a change to an order's status, a verification decision, moderation of a review) with their author and timestamp.

• Delivering the service: creating and securing your account, publishing and searching listings, placing and tracking an order, arranging delivery, enabling buyer–seller conversations.
• Professional obligations and fraud prevention: checking that a professional seller is genuinely registered before their listings go public, handling reports, keeping an audit trail.
• Service-related communications: welcome email, order confirmation, password reset code, address confirmation. These messages are necessary to the service; we do not send marketing email.
• Statistics: aggregated activity measures (delivery volumes, lead times), with no individual profiling.

Your data is not sold, rented or transferred for advertising purposes. It is disclosed only:

• to the seller concerned, when you place an order or start a conversation: your name, your contact details and the corresponding delivery address;
• to the partner carrier handling your parcel: recipient name, phone, address, city and wilaya — strictly what is needed to deliver;
• to our technical subprocessors: application and database hosting, object storage for images and documents, and a transactional email provider;
• to Google, if and only if you choose Google sign-in, to verify your identity with that provider;
• to the competent authorities, on lawful request.

Some of these subprocessors may host data outside Algeria. We select them for their security guarantees and limit the data transmitted to what is necessary.

Visible to everyone: listings published by sellers, the public profiles of garages and shops, and customer reviews. A review never shows your full identity — only your first name and the initial of your surname appear (for example "Youcef B."). Your email address, phone number and delivery addresses are never public.

• Account: for as long as it is active, then for the period needed to handle disputes and accounting obligations.
• Sign-in sessions: 30 days maximum, and revoked immediately on sign-out or password change.
• Verification and reset codes: 15 minutes (email address) to 30 minutes (password), destroyed as soon as they are used.
• Orders, deliveries and receipts: kept for commercial traceability and complaint handling.
• Audit log: kept to establish who took a decision on a file.

• Passwords are hashed with bcrypt: they are never stored or transmitted in clear, and nobody at Cabacar can read them.
• Session tokens are stored hashed. A detected token reuse immediately revokes the entire session family concerned.
• Sensitive documents (trade register, payment receipts) are not exposed at a public URL: downloading them goes through an authorisation check.
• Exchanges with the platform are encrypted in transit (HTTPS).

In accordance with law no. 18-07 on the protection of natural persons in the processing of personal data, you have rights of access, rectification, objection and erasure.

Much of this information can be viewed and changed directly from your account: profile, addresses, active sessions, favourites, reviews. For any other request, write to contact@cabacar.com from the address associated with your account.

Some data cannot be erased immediately where keeping it remains necessary — for example an order in the course of delivery, or a document tied to a legal obligation. We will tell you explicitly when that is the case.

We use only the cookies necessary for the site to work: keeping you signed in, remembering your chosen language, and protecting against request forgery. No advertising cookies, no third-party profiling trackers.

Any substantial change will be published on this page with a new update date. If the change significantly affects your rights, we will tell you by email.

This policy is published in French, Arabic and English. In the event of any discrepancy between the versions, the French version prevails.