Privacy policy

This policy covers Sawa Cars — this website, the Android and iOS apps, and the records our team keeps at the inspection centers. All three share one account and one database, so information you give in one place is available to you in the others.

When you create an account

• Your name, email address and phone number.
• Your password, stored only as a cryptographic hash. Nobody at Sawa can read it, including us.

When you verify your identity as a seller

• Photographs of the front and back of your national ID, and a selfie.

When you use the marketplace

• Cars you save, searches you save, and the alerts you switch on.
• Purchase requests, handover bookings and their outcomes.
• Messages you exchange with sellers, buyers or our team.
• Vehicle details you submit, and the inspection results our mechanics record.

Automatically

• Basic technical logs needed to run and secure the service.
• In the app only: camera access when you choose to take a photograph, and a push notification token if you allow notifications. Neither is used for anything else.

• To verify that a seller is a real, identifiable person — the basis of the whole marketplace.
• To publish accurate listings and inspection reports.
• To arrange handovers, and to contact you about a car you requested.
• To send the alerts you asked for: price drops, saved-search matches, messages.
• To investigate disputes and prevent fraud.
• To meet record-keeping obligations on completed vehicle transfers.

We do not build advertising profiles, and we do not sell personal information to anyone.

ID photographs and selfies are the most sensitive thing we hold, and they are treated accordingly.

• They are never shown on a listing, and never shared with buyers or other sellers.
• Access is restricted to the Sawa team members who review verifications. The documents sit behind an administrator-only route; an ordinary account cannot reach them even with a direct link.
• What other users see is the outcome only: a “Verified seller” marker, and the trust score that flows from it.
• We keep them while your account is open and for as long afterwards as record-keeping on completed sales requires, then delete them.

• Buyers see a seller’s display name, verification status, trust score, completed sales and reviews. A phone number is exchanged when a handover is being arranged.
• Sellers see the name of a buyer who has requested their car, and the contact number needed for the handover.
• Our team sees what is required to run the pipeline: submissions, inspections, bookings, and — where safety or a dispute requires it — conversations.
• Nobody sees your password, your ID documents or your saved searches except you and the reviewers named above.

We use a small number of service providers to run the platform — hosting, message delivery and image storage. They process data on our instructions only, and they are not permitted to use it for their own purposes.

We share information with authorities only where the law requires it, and with the Rwanda Revenue Authority to the extent an ownership transfer requires.

This website sets one cookie: a session cookie that keeps you signed in. It is httpOnly, which means no script running in your browser can read it — including a malicious one. It is removed when you sign out.

There are no advertising cookies and no third-party trackers on this site.

• Passwords are hashed, never stored in a readable form.
• Sessions on the web are held in an httpOnly cookie rather than in browser storage.
• Every request to our API is authorised on the server, and administrator functions are gated by role rather than by hiding a link.
• Identity documents are served only to reviewers, never publicly.

No system is perfect. If you believe an account has been compromised, contact support@sawacars.com and we will act the same day.

• You can view and correct your profile at any time from your account.
• You can switch any alert off without losing the saved car or search behind it.
• You can delete your account yourself, at any time — on this website under Profile → Delete account, or in the app under Settings → Danger zone. Full details are on the account deletion page.
• Deletion removes your profile, your contact details, your identity documents, your saved cars and searches, and any listing of yours still on the marketplace. Records of vehicle transfers that already completed are retained where the law requires, with your name and contact details removed from them.
• You can ask for a copy of what we hold about you by writing to support@sawacars.com.

Sawa accounts are for adults. We do not knowingly collect information from anyone under 18, and we delete it if we discover we have.

We will update this page whenever the platform changes what it collects, and account holders will be notified of material changes.

Questions about privacy go to support@sawacars.com, or to hello@sawacars.com for anything else.