CARTRUST
CHECK VIN

PRIVACY POLICY

How we collect, use, and protect your data.

01. DATA WE COLLECT

We collect only what is necessary to deliver our service:

  • +Phone number: for M-Pesa payments and, if you ask for one, M-Pesa refunds
  • +Email address, to sign you in (we email a one-time code), deliver receipts and reports, and send account notifications
  • +VIN / Chassis numbers, the vehicles you search for
  • +Visit and checkout data, the pages you view and the steps you take towards a purchase, with your approximate location (country and city, from your IP address), to run checkout, prevent fraud and improve the service
  • +Payments, wallet and refunds: what you paid, how (M-Pesa receipt number, card payment reference or crypto payment ID), your CarTrust wallet balance and history, and the refund details you give us (M-Pesa number, bank details or crypto wallet address)
  • +Vehicle financing applications (only if you apply): your name, contact details, national ID or passport number, employment and monthly income, the vehicle, its price, your deposit and term, and the documents you upload (ID copy, payslips, bank or M-Pesa statements)

Card details are entered on Paystack's secure page and never reach us; M-Pesa payments are handled by Safaricom and crypto payments by NOWPayments. We never see or store your M-Pesa PIN, card number or crypto wallet keys.

02. HOW WE USE IT

Your data is used to:

  • +Generate and deliver vehicle history reports
  • +Process payments (M-Pesa, card and crypto), handle part payments and overpayments, keep your wallet, and send refunds
  • +Send report delivery confirmations and account notifications
  • +Improve service reliability and user experience
  • +Review your financing application and pass it to a financing partner who can assess it, only with the consent you give when you apply

We never sell, rent, or share your personal information with third parties for marketing purposes.

03. DATA SHARING

We share data only with service providers essential to delivering our service: Safaricom (M-Pesa), Paystack (cards) and NOWPayments (crypto) for payments; third-party vehicle history and auction databases for reports; Cloudflare for site security and the anti-bot check on our forms; our email provider for sign-in codes, receipts and notices; and, only if you allow analytics cookies, Google Analytics. These providers use your data only to provide their service to us.

Financing: if you apply for vehicle financing, your application, documents and the CarTrust report you link to it are shared with the financing partner (lender) our team forwards it to, so they can make a lending decision. The partner sees only applications forwarded to them, through a secure partner portal. They use your data under their own obligations as a lender. We don't share financing applications with anyone else.

04. DATA RETENTION

Your account data is retained for as long as your account is active. Vehicle search history is retained for 12 months to allow you to re-access purchased reports. Payment, wallet and refund records are kept for as long as Kenyan tax and accounting law requires (currently five years). You may request deletion of other data at any time by contacting us.

Financing applications and their documents are kept while the application is open and for up to 24 months after it is closed (approved, declined or withdrawn), unless the law requires us to keep them longer. You can ask us to delete them sooner, except while a partner is still assessing the application.

05. SECURITY

Data sent between your browser and CarTrust is encrypted (HTTPS). Access to personal data is restricted to authorised staff on a need-to-know basis, and staff tools are permission-controlled.

ID and passport numbers on financing applications are additionally encrypted by CarTrust, and financing documents are kept in private storage that is never publicly accessible. Only CarTrust staff who handle financing, and the partner your application is forwarded to, can open them.

06. YOUR RIGHTS

Under the Kenya Data Protection Act, 2019, you have the right to access, correct, or delete your personal data, and to object to its processing. You may also withdraw consent for non-essential communications at any time. To exercise these rights, contact us at [email protected].

07. COOKIES

We use essential cookies for authentication and session management. Analytical cookies are used only with your consent to understand aggregate usage patterns. See our Cookie Policy for details.

Last updated: 21 October 2026