Privacy Policy — Vendors
Last updated: June 10, 2026
This Privacy Policy describes how Kood Khafeef For Information Technology Establishment ("CarRoots," "we," "us," or "our"), established in the Kingdom of Saudi Arabia, collects, uses, stores, and shares information when you use the CarRoots Vendor mobile application and related services (the "Services") as an automotive service provider ("Vendor"), owner, or authorized employee.
We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.
Questions or concerns? Contact us at basel.khamis@gmail.com.
1. Information We Collect
1.1 Company and account information
- Vendor account: company name, logo, business contact details, city or cities of operation, and account credentials;
- Business profile: service catalog, prices, add-ons, schedules, working hours, holidays and vacation dates, and promotional offers;
- Employee accounts: names, phone numbers, login credentials, and roles/permissions of employees you register. You are responsible for informing your employees that their data is processed on the Platform and for having a lawful basis to register them.
1.2 Operational and financial information
- Booking and fulfillment records: appointments, statuses, reschedules, cancellations, and archives;
- Revenue and wallet data: earnings, service revenue breakdowns, and transaction records;
- Invoicing data processed for ZATCA (Zakat, Tax and Customs Authority) compliance through our accounting integration;
- Customer satisfaction metrics and ratings received from customers.
1.3 Information collected automatically
- Location data (with permission), used for address and city features;
- Device and usage data: device model, operating system, identifiers, IP address, app version, crash reports, and diagnostic logs;
- Push notification tokens, used to deliver booking and chat notifications.
2. How We Use Your Information
We use this information to:
- Create and manage your Vendor account and employee sub-accounts;
- Display your company profile, services, prices, and availability to customers in your cities of operation;
- Route bookings to you and support fulfillment, scheduling, rescheduling, and cancellation flows;
- Process and record payments collected from customers on your behalf, and maintain revenue and wallet records;
- Issue and synchronize tax-compliant electronic invoices in accordance with ZATCA requirements;
- Enable appointment-scoped chat between you and your customers;
- Send operational notifications;
- Monitor, secure, and debug the Services;
- Comply with our legal obligations under the laws of Saudi Arabia.
3. How Your Information Is Stored
Our backend is built on Google Firebase (a service of Google LLC). Company profiles, services, schedules, bookings, chat messages, and revenue records are stored in Cloud Firestore; images such as logos are stored in Firebase Cloud Storage; server-side processing runs on Google Cloud Functions.
Access is restricted by server-enforced security rules: your company data is accessible only to your authorized accounts, and employee accounts are limited by their assigned roles.
Your data may be stored and processed on Google servers located outside the Kingdom of Saudi Arabia, in accordance with the PDPL's requirements on cross-border data transfers.
4. What Is Shared with Customers
The following information is visible to customers on the Platform:
- Your company name, logo, profile, cities of operation, service catalog, prices, and available time slots;
- Ratings and reviews received from customers;
- Booking status updates and chat messages you send for a customer's appointment.
Your revenue data, wallet records, employee details, and internal schedules are not visible to customers.
5. Other Third Parties
| Recipient | Purpose | Data involved |
|---|---|---|
| Moyasar | Payment collection from customers | Transaction amounts and references |
| Google (Firebase, Maps, Places) | Hosting, database, notifications, crash reporting, address lookup | Account, booking, device, and location data |
| Qoyod | Accounting and ZATCA-compliant e-invoicing | Company, invoice, and transaction details |
We do not sell your information. We may disclose information where required by law, court order, or a competent governmental authority in Saudi Arabia.
6. Your Obligations Regarding Customer Data
Through the Platform you receive customer personal data (names, phone numbers, service locations, vehicle details, chat messages) solely to fulfill booked services. With respect to that data, you act as an independent data controller and you must:
- Use it only to perform the booked service;
- Not use it for unsolicited marketing or share it with third parties;
- Protect it against unauthorized access and delete it when no longer needed;
- Comply with the PDPL and other applicable data protection laws.
Breach of these obligations may result in suspension or termination of your Vendor account.
7. Security
We use industry-standard safeguards, including encrypted connections (TLS), server-enforced access rules, and role-based employee permissions. No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. Your Rights
Subject to the PDPL, you and your registered employees have the right to access, correct, and request deletion of personal information we hold, and to withdraw consent for optional processing. Contact us at basel.khamis@gmail.com. We may retain records (including financial, tax, and invoicing records) where the law requires.
9. Data Retention
We retain Vendor information for as long as your account is active and as long as needed for the purposes above, including legal, tax, and accounting retention obligations.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the app. Continued use of the Services after an update constitutes acceptance.
11. Contact Us
Kood Khafeef For Information Technology Establishment Kingdom of Saudi Arabia Email: basel.khamis@gmail.com