PRIVACY POLICY
01 — DATA WE COLLECT
We collect only what is necessary to deliver our service:
- +Phone number — for authentication and Mpesa payment processing
- +Email address — for report delivery and account notifications
- +VIN / Chassis numbers — the vehicles you search for
- +Session data — anonymised usage analytics to improve our service
Payment data is processed directly by Safaricom Mpesa — we never store your M-Pesa PIN or financial details.
02 — HOW WE USE IT
Your data is used to:
- +Generate and deliver vehicle history reports
- +Process payments via Mpesa STK push
- +Send report delivery confirmations and account notifications
- +Improve service reliability and user experience
We never sell, rent, or share your personal information with third parties for marketing purposes.
03 — DATA SHARING
We share data only with service providers essential to delivering your report: Safaricom (payment processing), and third-party auction databases (vehicle history). These providers are contractually bound to protect your data and use it only for the stated purpose.
04 — DATA RETENTION
Your account data is retained for as long as your account is active. Vehicle search history is retained for 12 months to allow you to re-access purchased reports. You may request deletion of your data at any time by contacting us.
05 — SECURITY
All data is encrypted in transit (TLS 1.3) and at rest. Access to personal data is restricted to authorised personnel on a need-to-know basis. We conduct regular security reviews and follow industry best practices for data protection.
06 — YOUR RIGHTS
You have the right to access, correct, or delete your personal data. You may also withdraw consent for non-essential communications at any time. To exercise these rights, contact us at privacy@cartrust.co.ke.
07 — COOKIES
We use essential cookies for authentication and session management. Analytical cookies are used only with your consent to understand aggregate usage patterns. See our Cookie Policy for details.
Last updated: March 2026