Last updated: 14 July 2026
This policy explains what personal data Owna collects, why, where it is processed, how long we keep it, and the rights you have over it. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Owna is built to collect as little about you as we reasonably can.
The data controller is Owna, the used-car marketplace at owna.ae, currently operated by its founding owner in the United Arab Emirates, pending incorporation of a company. If the service is transferred to a company, that company becomes the controller and this policy will be updated to name it. For anything related to your personal data, contact hello@owna.ae.
Account data: your email address, password (stored only as a secure hash), first and last name, phone number, and the emirate you select. Profile data you choose to add: a profile photo (avatar) and your language preference. Listing data: the details, photos, and price of the car you list, and any optional documents you upload, such as an inspection report or RTA test certificate. Location data: if you set a location for a listing, we store and show only an approximate area rounded to a grid of about 2 kilometres, never your exact position. Messages: conversations you have with other users through the service, including any photos you attach. Before a message is delivered, its text is checked automatically against a short, fixed list of known scam indicators (such as requests for one-time codes or off-platform money-transfer services); we do not otherwise read, scan, or analyse your conversations. Verification data: whether your email is confirmed and, if you complete WhatsApp verification, your verified phone number. Activity records: a log of when a signed-in user reveals a seller's contact details (kept for fraud prevention), reports you submit, and the date and time you accepted the Terms and, separately, whether you opted in to marketing. We never ask for and never store your Emirates ID, passport, or any government identity document.
Before a listing photo leaves your device, our upload code removes embedded EXIF metadata, including GPS coordinates, the capture time, and camera details. This means the photo file that reaches our servers, and the public, does not reveal where or when it was taken.
Under the PDPL we rely on: performance of a contract, for creating and securing your account, publishing your listings, delivering messages, and showing your name, emirate, and photo on your listings so buyers know who they are dealing with; your consent, recorded with a timestamp at signup, for the processing described in this policy and, separately and optionally, for marketing emails; and legitimate and legal interests, for fraud prevention, moderation, contact-reveal logging, securing the platform, and cooperating with UAE authorities where the law requires. We do not use your data for automated decisions that produce legal effects on you without human review being available.
When you create a listing, its photos and text are sent to Anthropic's Claude API, a third-party artificial intelligence service processed in the United States, for two purposes: helping you draft the listing (for example, suggesting the make, model, and description from your photos) and verifying the listing before publication (checking that the photos show the declared car and screening for fraud and prohibited content). Only listing content is sent, together with the minimum context needed for the check. We do not send your email, phone number, messages, or documents to the AI service. Under our API terms, Anthropic does not use this data to train its models.
Our database, authentication, and file storage run on Supabase, hosted on Amazon Web Services in the ap-south-1 region (Mumbai, India). The website is served by Vercel and our DNS is managed by Cloudflare, both global providers whose infrastructure may process technical request data outside the UAE. Listing photos and text are processed by Anthropic in the United States as described above. This means your personal data is transferred to and processed in countries outside the UAE. We make these transfers in accordance with Articles 22 and 23 of the PDPL: each provider is bound by contractual data-processing terms that require an adequate level of protection, confidentiality, and security for your data, and we transfer only what each provider needs to perform its service. By accepting this policy at signup you also expressly consent to these transfers.
We never sell personal data and never share it with advertisers or data brokers. Data is shared only with: the service providers named above (Supabase/AWS, Vercel, Cloudflare, Anthropic), acting on our instructions as processors; other users, limited to what the product shows (your name, emirate, avatar, listing content, approximate area, and, to signed-in users, your contact details when you list a car); and UAE public authorities, if we are legally required to disclose data or to report unlawful activity.
Optional documents attached to a listing, such as inspection reports or RTA certificates, are stored in a private storage bucket. They are not publicly accessible and are shown only to signed-in users viewing your listing. You can delete them by deleting the listing or your account.
We keep your data while your account exists. When you delete your account, your name, photo, phone number, emirate, and other profile data are purged immediately and your listings are removed from public view. We may retain limited records where the law requires or to protect against fraud and abuse, for example report records or evidence of a violation, for as long as strictly necessary for that purpose. Chat messages are retained for 24 months from the date they are sent and are then deleted automatically; the same automatic deletion for attached photos is being rolled out. Server logs and backups age out on the schedules of our infrastructure providers.
All traffic to the service is encrypted in transit (HTTPS). Passwords are stored only as secure hashes. Database access is governed by row-level security rules so that each user can read only what the product intends them to see; sensitive fields such as VIN, exact area, and seller names are blocked at the database level for visitors who are not signed in. Administrative operations run through restricted server-side functions, and secrets are stored outside the codebase. No system is perfectly secure, but we design so that a single failure does not expose your data.
You have the right to: request access to the personal data we hold about you and receive a copy; ask us to correct inaccurate data (most of it you can edit yourself on your profile page); ask us to delete your data (or do it yourself, see the next section); withdraw any consent you have given, including marketing consent, at any time without affecting prior processing; object to or ask us to restrict certain processing, including direct marketing; and request your data in a portable format. To exercise any of these rights, email hello@owna.ae. We respond within a reasonable period and never charge for a first request. If you are unsatisfied, you may complain to the UAE Data Office as the competent authority.
The "Delete account" button on your profile page immediately and permanently removes your personal data from our records and takes your listings out of public view. It is fully self-serve: no email, no waiting period, no approval needed.
We use only what the service needs to function: a session cookie that keeps you signed in, and local storage in your browser for preferences such as your theme and language. We do not use advertising cookies, third-party analytics trackers, or cross-site tracking of any kind.
At signup you can optionally opt in to product updates by email. We record that choice with a timestamp. Marketing is sent only if you opted in, always includes a working unsubscribe, and stops immediately when you withdraw consent from your profile or via the unsubscribe link. Phone numbers are never used for marketing.
The service is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact hello@owna.ae and we will delete it.
If we change what we collect, why, or where it is processed, we will update this page and its date, and for material changes we will give notice on the service or by email before the change takes effect. If a change requires fresh consent under the PDPL, we will ask for it.
Questions or requests about your data: hello@owna.ae.