Privacy Policy

App services, reading records and optional analytics

2026-10-16

• Google sign-in on iOS may process name, email, phone, user and device identifiers, approximate location and other usage or technical data for authentication, security and some service analytics. Approximate location may be estimated from IP for fraud prevention; precise location permission is not required. This SDK processing is separate from optional JCHCAR website analytics and is not cross-app advertising tracking. Apple sign-in provides the authorized identifier and, when shared, name and email, including a private relay address.
• Photos and files you submit for profiles, conversations, CarParts, recipients and repair cases are stored in Tencent COS. Profile avatars may be publicly accessible; business attachments require authorization. We store file references and related business records. Chat images are available for seven days; other files follow their service and legal retention requirements.
• Where AI support is available, we identify the configured provider, DeepSeek or Kimi/Moonshot, and ask for consent before sending the necessary conversation text and public business context to that provider. Private attachments are not sent to the text model. You can decline or withdraw consent and use human contact options. Withdrawal stops future AI processing; it does not erase existing conversation records. Provider processing may occur outside Saudi Arabia.
• Opening WhatsApp passes the contact and message draft shown to you to WhatsApp. JCHCAR records the assigned partner, related vehicle or order reference and the link-opening attempt for follow-up. Opening a link does not confirm that a message was sent or answered. Do not include passwords, identity documents or bank credentials in the message draft.
• Optional native activity and article/topic analytics (v2) are off by default. Earlier consent for activity statistics does not automatically enable reading analytics. Only after you explicitly enable this purpose does the app use a local random installation identifier and send it for server-side hashing. Heartbeats include platform and app version; reading events include the public article ID and an event identifier, with the server recording receipt time. These analytics records do not contain your account ID, IP address, article text, customer messages or private attachments.
• Turning optional analytics off stops and cancels further analytics requests and removes the local installation identifier. This does not turn off account-based saved articles or recent reading history. The installation hash is a de-identified device key, not proof of complete anonymity; these measurements cover only participating devices and are not official installation or deletion figures.
• For signed-in users, saved article IDs and saved/viewed times are linked to the account so the feature works across devices. Up to 100 saved articles remain until you remove them or the account is deleted. Recent history displays up to 100 articles within 30 days; clearing history preserves saved articles. Old history is trimmed on authorized access, so physical removal may occur later when there is no access.
• Reading reports cover at most the latest 90 days. Older analytics events are cleaned during event writes or operational report access; this is access-triggered cleanup, not a guaranteed physical deletion at a fixed deadline. Withdrawing consent stops future optional collection without automatically erasing existing records. Functional account records remain subject to account-deletion handling.

1. Controller & Contact

We are the data controller for the headquarters website and related B2B services.

• Controller: China Jingchehui Automobile Manufacturing Import and Export Co., Limited (中國京車會汽車製造進出口有限公司)
• Company Registration No. (CRN): 76395738-000-04-26-6
• Registered address: 807A 8/F TWO HARBOURFRONT, 22 TAK FUNG STREET, HUNG HOM, KL
• Privacy / data protection contact: china@jchcar.com
• Russia consumer site (rus.jchcar.com / /rus) is operated independently by a Russian franchisee for B2C; where technology is shared, this policy describes HQ processing and links to local notices where applicable.

Depending on how you interact with us, we may process:

• Identity & contact: name, email, phone, WhatsApp, company role.
• Business & trade: company name, dealer/account details, RFQs, orders, shipping and export documentation data.
• Account & authentication: login credentials or session identifiers, access logs.
• Technical & usage: IP address, device/browser type, pages viewed, approximate location derived from IP, referrer.
• Preferences: language (e.g. NEXT_LOCALE), currency, cookie consent choices.
• Communications: messages you send via forms, chat, or support channels.

We process personal data only for defined purposes and under appropriate legal bases.

• Contract: create accounts, respond to RFQs, fulfill orders, issue commercial documents, and provide support you request.
• Legitimate interests: secure the platform, prevent fraud/abuse, improve reliability of B2B services, and maintain business records—balanced against your rights.
• Consent: optional analytics cookies/SDKs and any future marketing tags; you may withdraw anytime via Cookie Settings or by contacting us.
• Legal obligation: tax, customs, export-control, and accounting requirements where applicable.

We use cookies and similar storage as described in our Cookie Policy.

• Necessary cookies enable security, locale/currency, authentication, and core site functions.
• Optional categories (functional, analytics, marketing) run only with your consent where required.
• Cookie Policy.

First-party visit analytics and Google Analytics load only after you opt in to Analytics.

• Without analytics consent we do not set analytics cookies (including GA) or first-party visit keys used solely for measurement.
• You can change or withdraw consent at any time using Cookie Settings in the footer/UI.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

• We do not sell or share personal information as those terms are used under the CCPA/CPRA for cross-context behavioral advertising.
• California residents may still use our Do Not Sell or Share page to record an opt-out preference; we honor Global Privacy Control (GPC) signals.

7. International Transfers & Data Residency

Primary hosting and object storage (including Tencent COS) are located in the Kingdom of Saudi Arabia.

• Personal data processed via our platform is stored and processed primarily in the Kingdom of Saudi Arabia (servers and COS).
• Where data is accessed from outside Saudi Arabia (e.g. by authorized staff for support or trade operations), we apply contractual and technical safeguards appropriate to the transfer.
• By using our services you acknowledge that data may be transferred to and processed in Saudi Arabia and other jurisdictions necessary to operate international vehicle trade.

8. Retention

We keep personal data only as long as needed for the purposes above.

• Account and transaction records: for the life of the business relationship plus periods required by trade, tax, or legal retention rules.
• Support and inquiry records: typically up to 24 months after last contact unless a longer period is required.
• Consent and security logs: retained for auditability and dispute resolution, then deleted or anonymized.
• Analytics identifiers: retained according to tool settings and deleted when you withdraw analytics consent where feasible.

We implement technical and organizational measures appropriate to the risk.

• TLS encryption in transit; access controls and least-privilege administration.
• Session security for authenticated areas; monitoring for abuse.
• No method of transmission or storage is 100% secure; please protect your credentials and notify us of suspected misuse.

Depending on your location, you may have rights to access, correct, delete, restrict, object, port data, withdraw consent, or lodge a complaint.

• EU/UK GDPR: rights of access, rectification, erasure, restriction, objection, portability; complaints to your supervisory authority.
• US CCPA/CPRA (California and similar US state laws): know, delete, correct, and opt out of sale/share; we do not sell/share for cross-context ads; non-discrimination for exercising rights.
• Middle East PDPL-oriented: rights consistent with applicable PDPL regimes regarding access, correction, and deletion; contact us to exercise them.
• To submit a request, email china@jchcar.com with enough detail to verify your identity and locate your data.

Our services are directed to businesses and adults engaged in vehicle trade.

• We do not knowingly collect personal information from children under 16 (or the higher age required in your jurisdiction).
• If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy to reflect legal, technical, or business changes.

• The effective date and version at the top of this page will be updated when material changes occur.
• Where required, we will re-prompt for cookie consent when the policy version changes.

13. Contact

For privacy questions or requests:

• Email: china@jchcar.com
• Postal: China Jingchehui Automobile Manufacturing Import and Export Co., Limited (中國京車會汽車製造進出口有限公司), 807A 8/F TWO HARBOURFRONT, 22 TAK FUNG STREET, HUNG HOM, KL
• CRN: 76395738-000-04-26-6