Sanad Auto — Privacy Policy

Effective date: 2026-05-17 Operator: Sanad Auto, United Arab Emirates App package ID: com.quantabyte.sanadauto Contact: support@sanad.ae

Sanad Auto ("Sanad", "we", "us", "our") provides a digital platform that lets vehicle owners book maintenance services, track their vehicle's location while it is at one of our partner workshops, watch live in-workshop camera feeds, review and approve repair quotations, pay for work, and manage digital service warranties. This policy explains what personal data we collect, why we collect it, who we share it with, and what choices you have. It is written to comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

1. Who controls your data

The data controller is Sanad Auto, United Arab Emirates. You can contact us at support@sanad.ae for any privacy-related request.

2. The data we collect

2.1 Account data — you give us

Full name
Email address
Phone number (optional)
Password (stored only as a salted bcrypt hash; we never see the

plaintext)

Profile photo (optional)

2.2 Vehicle data — you give us

Make, model, year, license plate, colour
Photos of your vehicle
Vehicle ownership details

2.3 Service activity — generated through use

Service requests you submit (description, photos)
Quotations and orders linked to your account
Payments and warranty records

2.4 Vehicle telematics — generated by hardware we install

If you have a Sanad-installed GPS tracker and/or in-vehicle cameras:

Vehicle location data (latitude, longitude, timestamps) reported by

the GPS device, while the device is powered.

Live and recorded video footage from the in-vehicle cameras, **only

while the vehicle is inside a Sanad partner workshop geofence**. We do not stream or record vehicle camera footage outside an active workshop session.

The Sanad app does not access your phone's GPS or microphone. Vehicle location data is reported by the dedicated tracker hardware, not by your phone.

2.5 Device data — collected automatically

Firebase Cloud Messaging (FCM) push token, so we can send you

notifications.

Platform (Android / iOS) and rough device information attached to push

tokens.

Crash reports and performance telemetry (via Sentry), sampled and with

IP / cookies disabled by default for UAE PDPA compliance.

2.6 Photos & media — when you choose to upload

Photos and short videos you attach to a service request or an

inspection.

We request READ_MEDIA_IMAGES and READ_MEDIA_VIDEO permissions only

for this purpose.

2.7 Camera permission

We request CAMERA permission so the supervisor app can scan the QR

code printed on a GPS device when linking it to a vehicle. The camera is not used while the app is in the background.

3. How we use your data

We use the data above to:

Create and secure your account, including password reset and optional

Google / Apple sign-in.

Connect you to a supervisor and workshop, route your service request,

and let them act on it.

Show you the live location of your vehicle while it is at a Sanad

workshop, and stream the in-workshop camera feed to you.

Generate quotations, take payment, and issue digital warranties.
Send you transactional notifications (request updates, vehicle arrival

at workshop, warranty expiry reminders).

Detect and fix crashes, abuse, and security incidents.

We do not use your data for advertising, profiling, or sale to third parties.

4. Legal basis

Under the UAE PDPL we process your data on the basis of:

Performance of a contract — you signed up to use Sanad to manage

your vehicle servicing.

Your consent — for optional features such as push notifications,

social sign-in, and the in-vehicle camera stream.

Legitimate interest — for fraud prevention, security, and platform

reliability.

5. Who we share data with

We share the minimum necessary data with the following processors. Each operates under a data-processing agreement.

Service	Purpose	Data shared
Cloudinary	Hosts the photos & videos you upload	Uploaded media
Google Firebase (FCM)	Delivers push notifications	FCM token, message payload
Google / Apple	Optional social sign-in	The OAuth ID token you send us
Tap Payments (once enabled)	Processes card payments	Order amount, payment method, billing email
MediaMTX (self-hosted)	Routes live camera streams	Live video frames
Sentry	Crash reporting	Error stack traces, app version, anonymised device data
Sanad partner workshops & supervisors	Carry out the repair you booked	Your name, phone, vehicle details, service request, live stream while at the workshop

We do not sell your personal data. We do not share data with advertising networks.

6. International transfers

Some of the processors above (Cloudinary, Firebase, Sentry, Tap) operate infrastructure outside the UAE. Where personal data leaves the UAE, we rely on the processor's standard data-protection commitments and encryption in transit.

7. How long we keep data

Account & vehicle data — for as long as your account exists, plus

90 days after account closure for dispute resolution.

Vehicle location history — 12 months rolling.
In-workshop camera footage — live only; we do not record or

store camera footage in this release.

Service requests, quotations, orders, warranties — for 7 years (UAE

commercial bookkeeping requirement).

Push tokens — until you uninstall the app or sign out.
Crash reports — 90 days.

8. Your rights

Under the UAE PDPL you have the right to:

Access the personal data we hold about you.
Rectify inaccurate data.
Delete your account and personal data (subject to legal retention

requirements in §7).

Object to or restrict specific processing.
Port your data in a machine-readable format.
Withdraw consent for optional features at any time (e.g. disable

push notifications, unlink social login).

To exercise any of these, email support@sanad.ae. We will respond within 30 days.

9. Security

Passwords are stored as bcrypt hashes.
All API traffic is TLS-encrypted.
Live video streams and camera publish endpoints are authenticated.
Access to workshop streams is limited per §2.4 and §5.
We perform routine security reviews and run automated crash and

intrusion monitoring.

No system is perfectly secure, but we apply industry-standard safeguards. If we ever experience a personal-data breach affecting you, we will notify you and the UAE Data Office in line with PDPL timelines.

10. Children

Sanad Auto is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us and we will remove it.

11. Changes to this policy

We may update this policy. Material changes will be announced in-app and via email at least 14 days before they take effect. The latest version is always available at this URL.

12. Contact

For privacy questions or to exercise your rights, contact:

Sanad Auto Email: support@sanad.ae United Arab Emirates