CARVAN lets you book car services at service centers, and lets those centers take the bookings. This policy covers the CARVAN iPhone app, the website carvan.me and the center app. The short version: we never sell your data, we do not track you across other apps or websites, and phone numbers are never shared between customers and centers. Last updated 7 October 2026.
Who we are
CARVAN is run by Mohamad Ali Haji Shihade, an individual developer based in Dubai, United Arab Emirates, who decides how your data is used (the data controller). For anything about your data or this policy, write to support@carvan.me.Your account
Your mobile number, which is how you log in: we send it a one-time code by text message (or WhatsApp outside Syria). The name you add. The language you use, so that notifications reach you in it. Your log-ins on each device (web, iPhone or Android) and when each was last used. If you allow notifications, your phone's push token, or the installed web app's push subscription. As a guest, your cart is kept under a guest account in your browser and moves to your account when you log in.Your vehicles and places
Your vehicles: make, model, colour and plate. The places you save: governorate, area, the details you type and the map point. Your device's location is read only with your permission and only while you use the app: to show centers near you, sort them by distance and fill in an address. We keep a point only when you save a place. To turn a map point into an address, our server sends the point (never who you are) to our map provider.Bookings, chats and reviews
Your bookings and their history: the service, center, time, price, the item you chose, the start code, each step and who took it. Your cart. Your chats with centers: the messages you send (text only), and any report you make about a chat. The reviews you leave (stars and text). The centers you keep as favourites. Your service reminders, which we set from your finished bookings (for example an oil change due in six months).Service centers
A shop that asks to join through Become a provider gives us its name, the contact person's name and phone number, its place, its services and any notes. A center's account holds its phone number, profile, opening hours, offerings and prices, photos, bookings, chats and payouts. Customers see a center's name, place, hours, prices, approved photos and reviews, never its phone number.On your device
We use no advertising network, no analytics tools and no tracking. On the web we set a log-in cookie and a language cookie (and, for CARVAN's team only, a preview cookie). The browser also keeps the country you last picked for your number, whether you saw the welcome and the install prompt, and which Home cards you closed. The iPhone app keeps the same kind of things, and the app's latest texts, in the phone's secure storage. None of this leaves your device except the log-in, which proves it is you. We count how many times each screen of the app is opened, as a number per day, without recording who opened it.Why we use it
To provide the service you ask for: log you in, take and show your bookings, show centers near you, let you chat with the center you booked and send you notifications about them. With your permission: your location, notifications, and the camera or photos when you attach one; you can withdraw it at any time in your phone's settings. For our legitimate interests: keeping a record of each booking for support and disputes, keeping CARVAN safe (reviewing reported chats, hiding reviews that break the rules, limiting or blocking accounts that misuse it), service reminders, and choosing which of CARVAN's own banners you see. And where a law requires us to keep or share something.Banners and sponsored centers
CARVAN shows its own banners on Home and may place a center first on the list; both are marked Sponsored. We pick a banner from your app language and whether you have booked with CARVAN before, on our own servers. Advertisers receive nothing about you. We count the taps on a banner per day without recording who tapped.Who sees it
The center you book sees your name, the vehicle you chose (with its plate), the place on the booking, the booking itself and your chat with it, and may keep the booking in its own records. Other customers see your reviews with your first name and your vehicle's make. Phone numbers are never shared between customers and centers: you talk through the in-app chat only. CARVAN's team sees what it needs to run the service and help you: accounts, bookings, center requests and reported chats. To fix a problem, the team can open the app as your account for up to an hour; every change made then is logged. The team can export bookings and customer lists, with phone numbers, for CARVAN's own operations; only staff can, and every export is logged.Our service providers
They handle data only on our behalf and under our instructions: Vercel hosts the apps and stores our private files (center photos, banner and map pictures), which are served only through CARVAN after checking who may see them. Neon runs our database. MapTiler draws the maps and turns map points into addresses; on the iPhone app the map loads straight from MapTiler, which then sees your IP address and the area you look at. Our text-message or WhatsApp provider receives your number and the one-time code. Expo, Apple and Google (or your browser's push service) deliver notifications, which can show a sender's name and the start of a message. Resend delivers email to CARVAN's team: center requests and chat reports. We share data with authorities only when a law requires it.Where it is kept
Our servers and providers are outside Syria, mainly in the European Union, Switzerland and the United States. We choose providers that commit by contract to protect your data and to use it only for us.How long we keep it
Your account data stays while your account exists. A log-in ends 90 days after it was last used, or when you log out. A one-time code expires after 10 minutes and is stored only in a scrambled form (a hash). CARVAN's team keeps a log of every action it takes on an account; it is kept for 12 months, also after an account is deleted, for disputes and fraud — except the records of money (wallet credit and refunds, top-ups, payments marked as paid and their approvals), which are financial records and are kept for at least 7 years. When the team deletes an account for you or changes its number, that log keeps the number and name the account had, and they are removed when the 12 months are over.Deleting your account
In the app: Menu → Account → Delete account. A service center: Settings → Delete account. It takes effect at once. We remove your number, name, saved places, the vehicles not named in a booking, your chats (for the center too), your cart, favourites, reminders, reports, log-ins and push devices; bookings not yet started are cancelled. Your past bookings stay, with the vehicles they name, under an anonymous "Deleted customer" with no name or number, because they are the centers' business records. Your reviews stay with their stars and text, signed "A customer". A guest who never booked is removed entirely. A deleted center is closed and its log-in removed; its records stay without the account. So that a promo code meant once per customer is used once, we keep which codes your number used, as a one-way coded form of the number (never the number itself).Your rights
You can see and correct your name, vehicles and places in the app, and delete your account there. Write to support@carvan.me to get a copy of your data in a portable format, to correct anything else, to object to or restrict a use of it, or with any question. We answer within one month and may first check that the request comes from your number. Exercising a right never costs you anything or changes how we treat you. You may also complain to the data protection authority where you live or work.Security
Everything travels over encrypted connections. One-time codes are kept only as a hash and private files are served only after checking who may see them. Only CARVAN's team can open the admin app, and every action it takes is logged. No system is perfectly safe; if a breach puts your data at risk, we will tell you and the authorities where the law requires.Children
CARVAN is for adults (18 and over). We do not knowingly keep data about children; if we learn that we do, we delete it.Changes to this policy
When we change this policy, we update the date at the top and the app shows the new version. If a change matters for how we use your data, we tell you in the app before it applies.