Privacy Policy

D T M Holdings (Pvt) Ltd (“CarHound”, “we”, “us”) runs the CarHound vehicle marketplace at carhoundlk.com and is the controller of the personal data described here, under the Personal Data Protection Act, No. 9 of 2022 (“PDPA”). For any privacy question or request, contact our data protection contact at privacy@carhoundlk.com.

2.1Account details: Your name, email address, password (stored only in scrambled, hashed form), phone number, district and whether you are buying, selling or a dealer.

2.2Phone verification: The mobile numbers you confirm. One-time codes are stored only in scrambled form, expire after 10 minutes and are deleted once used.

2.3Listings: Vehicle details, price, location (district and town), photos and the contact numbers you choose to show buyers. Photos are resized before upload, which also removes hidden location (GPS) data from the file.

2.4Messages: Chats with other users, including photos and voice messages you send. These are private to the two people in the chat.

2.5Activity you choose to save: Saved vehicles, search alerts, reviews you write, ads you report and your notification settings.

2.6Ad statistics: When someone views an ad, reveals a phone number, taps WhatsApp or shares it, we count it once per visitor per day using a random ID stored in that visitor’s browser. The random IDs are deleted after about a day; only the daily totals are kept and shown to the seller.

2.7Technical data: Login session cookies, your language choice, and settings kept in your own browser (such as your compare list, leasing calculator settings and unfinished ad drafts). If you turn on notifications, your browser gives us a notification address for your device. We do not use advertising or tracking cookies.

• To run your account and the marketplace — showing your ads, delivering messages, alerts and notifications (performance of our contract with you).
• To keep the Platform safe — phone verification, reviewing ads before they go live, investigating reports and preventing fraud (our legitimate interests and legal obligations).
• To send service messages — approvals, expiry reminders, unread-message emails and verification codes.
• With your consent — phone and computer notifications, and any marketing we may send in future. You can withdraw consent at any time in your settings.
• To improve CarHound — using totals such as how many people view ads (never sold to anyone).

Automatic features such as the fair price meter and market estimate use listing data only; they do not make decisions about you as a person.

4.1Public: Your listings, the seller name on them, and your phone numbers after a buyer taps “Show phone number”. Reviews you write show your name.

4.2Service providers: We use trusted companies to run the site: Supabase (database, login and file storage), Vercel (web hosting), Brevo (email), FITSMS (SMS codes) and the notification services built into browsers (for example Google, Apple and Mozilla). They may only use your data to provide their service to us.

4.3Outside Sri Lanka: Some of these providers store or process data on servers outside Sri Lanka. We only use providers that protect personal data to a standard consistent with the PDPA.

4.4Legal reasons: We may share information with the Sri Lanka Police, courts or regulators where the law requires it, or to protect users from fraud.

4.5Other apps: When you tap WhatsApp, Viber, Facebook or another share or contact button, that app’s own privacy policy applies.

We never sell your personal data.

• Your account, until you delete it.
• Listings are shown for 30 days; after that they stay in your account (so you can renew them) until you delete them or your account.
• Chats, until you or the other person delete them, or either account is deleted.
• Verification codes: up to 10 minutes. Daily visitor IDs for ad statistics: about a day.
• Deleted data may remain in secure backups for a short period before being overwritten.
• We may keep limited records longer if the law requires it or to deal with fraud reports.

Under the PDPA you have the right to:

• ask for a copy of the personal data we hold about you;
• correct inaccurate details — most can be changed directly in My account;
• have your data erased — use My account → Delete my account, which deletes your account and data straight away;
• withdraw your consent, for example by turning off notifications;
• object to how we use your data, and ask for a review of any decision made only by automated means.

Email privacy@carhoundlk.com for any request. We may need to confirm it’s you, and we will reply within the time required by law. If you are not happy with our answer, you can complain to the Data Protection Authority of Sri Lanka.

When you delete your account we permanently delete your profile, ads and their photos, saved vehicles, alerts, reviews, notification settings, verified numbers, and your chats (including their photos and voice messages — the other person also loses those chats). This cannot be undone. Administrator accounts must be removed by another administrator.

Data is sent over encrypted connections (HTTPS). Chat photos and voice messages are kept in private storage that only the two people in the chat can open. Access to admin tools is limited to authorised staff. No system is perfectly secure — please use a strong password that you do not use elsewhere.

CarHound is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

We may update this policy. We will change the “Last updated” date, and for important changes we will tell registered users before they apply. See also our Terms and Conditions.

• Privacy requests: privacy@carhoundlk.com
• General support: support@carhoundlk.com
• Website: carhoundlk.com/contact