1. Who we are
Karaj (“Karaj”, “we”) is operated by 59 LABS L.L.C-FZ (trade licence 2654068.01), a limited liability company registered in the Meydan Free Zone, Dubai, United Arab Emirates, at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. It is the data controller. Karaj is a vehicle-repair marketplace in Dubai, UAE that connects vehicle owners (“customers”) with repair workshops. This policy explains what personal data we collect and how we use it, in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
2. Data we collect
- Account: name, email, phone number, role (customer or workshop), preferred language, city, and an optional profile photo (or workshop logo). A name and a mobile number are required: a workshop that wins your job has to be able to reach you, and that handover happens directly between the two of you.
- Sign in with Apple: if you use it, Apple sends us your Apple account identifier and an email address - which may be a private relay address that forwards to you without revealing your real one - and, on first sign-in only, your name. We never receive your Apple password.
- Vehicle: make, model, year, fuel, plate, VIN/chassis number, and-if you choose to scan them-your vehicle registration card (“Mulkiya”) and VIN images.
- Requests: the problem description, photos you upload, and the emirate you select, used to match workshops that cover your area. We do not collect GPS or any precise device location.
- Workshop data: business name, address, coverage area, opening hours, specialties, logo, quotes, and trade-licence/verification documents you upload.
- Technical: basic device/usage and diagnostic data, and push-notification tokens (if you enable notifications).
3. How we use your data
To create and run your account; to match repair requests with relevant workshops; to let you compare quotes and, after you accept one, to share the necessary contact details between you and that workshop; to send you notifications you opt into; to produce aggregated market statistics - typical price ranges by service and emirate, shown to workshops on paid plans - which are computed across many requests, never identify you or your vehicle, and are only shown once enough quotes exist for a range to be anonymous; and to provide support, security, and abuse prevention.
4. Legal basis
We process your personal data on the basis of your consent, given when you create an account, and to perform the service you ask us for. You may withdraw consent at any time by deleting your account (see Section 8).
Before you create an account we record only anonymous usage counts — which steps of the site were reached, against a random identifier that is held for the browser tab and discarded when you close it. It carries no name, no account, no IP address and no device identifier, and there is no key by which it could later be matched to you. We keep it that way deliberately: it tells us where people stop, and nothing about who they are.
Before you create an account we record only anonymous usage counts — which steps of the site were reached, against a random identifier that is held for the browser tab and discarded when you close it. It carries no name, no account, no IP address and no device identifier, and there is no key by which it could later be matched to you. We keep it that way deliberately: it tells us where people stop, and nothing about who they are.
5. Who we share it with
- Workshops you transact with: your name and phone are revealed to a workshop only after you accept its quote.
- Service providers (processors): Supabase (database, authentication & file storage), Anthropic (AI analysis of your text and images), Meta Platforms / WhatsApp (workshop notification delivery), Vercel (application hosting & basic analytics), Sentry (error & performance monitoring - captures diagnostic data such as error reports when the app misbehaves), Cloudflare (Turnstile anti-abuse on sign-in), Upstash (rate-limiting), Expo / 650 Industries (push delivery to the iOS app - the notification title and body, which name the service category and vehicle, pass through their service), and the web-push services of Apple, Google and Mozilla (to deliver notifications you enable).
6. International data transfers
Karaj is operated for the UAE, but several of our processors store or process data outside the UAE (for example in the United States and the European Union). Where your data is transferred internationally we rely on the safeguards permitted under PDPL Articles 22-23 - transfers to jurisdictions recognised as providing adequate protection, or appropriate contractual protections with each processor. By using Karaj and accepting this policy you consent to these transfers for the purposes described here.
7. AI processing
Some features send your input to Anthropic to generate a result: the symptom analyser (your description), the Mulkiya and VIN scans (the document image, to extract vehicle details), the quote scannerfor workshops (a photo of a printed/handwritten quote), and the workshop AI business briefing (your own aggregated performance figures). These inputs are processed to return a result. Our AI provider does not use API inputs or outputs to train its models; it retains them only transiently for trust-and-safety purposes (generally up to about 30 days, and longer only where required to investigate misuse or by law). Don’t upload images containing data you don’t want processed for this purpose, and avoid documents that show another person’s details. AI output is guidance only, not a professional diagnosis.
8. Retention
We keep your account data while your account is active. When you delete your account we remove your profile, vehicles, requests and notification tokens, and the files you uploaded (request photos, profile/logo images and verification documents).
Two things do not simply disappear, and it is fairer to say so than to imply otherwise. A quote a workshop sent you is that workshop’s business record as well as yours: it survives, detached from your account, with your name and contact details gone from it. A review you left is anonymised rather than deleted - the written comment is removed and the rating stays on the workshop’s profile, because a workshop’s reputation is built from many customers and removing one person’s rating silently rewrites it for everyone else. Neither keeps anything that identifies you.
Technical, usage and diagnostic data - including the basic, privacy-preserving analytics collected by our hosting provider (Vercel) - is retained only in aggregate or short-lived form to keep the service secure and to understand how it is used. Operational records such as rate-limit counters and AI abuse-monitoring logs expire automatically (typically within ~30 days). Our own record of AI usage - which feature was used and how much it cost us, carrying an account identifier and no content - is kept for up to 90 days to control costs and detect abuse, as are the anonymous product-funnel counts described above. Some records may be retained briefly where required by law.
Two things do not simply disappear, and it is fairer to say so than to imply otherwise. A quote a workshop sent you is that workshop’s business record as well as yours: it survives, detached from your account, with your name and contact details gone from it. A review you left is anonymised rather than deleted - the written comment is removed and the rating stays on the workshop’s profile, because a workshop’s reputation is built from many customers and removing one person’s rating silently rewrites it for everyone else. Neither keeps anything that identifies you.
Technical, usage and diagnostic data - including the basic, privacy-preserving analytics collected by our hosting provider (Vercel) - is retained only in aggregate or short-lived form to keep the service secure and to understand how it is used. Operational records such as rate-limit counters and AI abuse-monitoring logs expire automatically (typically within ~30 days). Our own record of AI usage - which feature was used and how much it cost us, carrying an account identifier and no content - is kept for up to 90 days to control costs and detect abuse, as are the anonymous product-funnel counts described above. Some records may be retained briefly where required by law.
9. Your rights
Under the PDPL you may access, correct, or delete your data, and withdraw consent. Several uses are optional and controlled by you without deleting your account: AI features run only when you choose to use them, and push notifications can be turned off in Profile. You can edit your details in the app and delete your account at any time from Profile → Delete account, which erases your data as described above. To exercise other rights or raise a concern, contact us at support@app-karaj.com.
10. Security
Access to personal data is restricted by row-level security and least-privilege rules; sensitive contact details are exposed only at the point a transaction requires them. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a qualifying breach as required by law.
11. Children
Karaj is intended for users aged 18 and over. We do not knowingly collect data from minors.
12. Changes & contact
We may update this policy; the “last updated” date will change accordingly. Questions or requests: support@app-karaj.com.