Legal
Privacy Policy
01
Who we are
This policy explains how Cardiagnos ("Cardiagnos", "we", "us"), handles personal data. We are the data controller for the services below. Cardiagnos operates under the brands SightCore, Klarsikt and عين الخلل.
Privacy contact: ahmad@cardiagons.com.
02
What this policy covers
- the website cardiagons.com, including inspection bookings and the online shop;
- the free car-value tool;
- online inspection reports (report links sent to customers);
- the partner program and the Cardiagnos Inspector app (iOS and Android).
03
The data we collect
| Who | Data |
|---|---|
| Customers who book an inspection | Name, email, phone, city, car details (make, model, year), notes, order and payment status. Card payments are handled by Shopify and its payment providers; we never see full card numbers. |
| Vehicle owners in inspection reports | Name, email, phone, car details (VIN/chassis, plate, mileage, colour), photos, videos, condition findings and inspector notes. The photos, videos and written parts of a report are also processed by an AI provider (see “Artificial intelligence”). |
| Car-value tool users | Car details, email or phone, city, whether you plan to sell, a one-way hash of your IP address (to stop abuse), and whether you agreed to a follow-up email. |
| Partners (inspection workshops) | Business name, contact name, email, phone, city, login details (password stored only as a secure hash), logo, plan and billing status, commissions and payouts, shared content, device push token. |
| Website visitors | Technical data needed to run the site (cart, session, language, consent choice) and, only if you accept, analytics or marketing cookies. |
| Anyone who contacts us | Your messages and contact details. |
04
Why we use it and our legal basis
| Purpose | Legal basis (GDPR art. 6 / Saudi PDPL) |
|---|---|
| Taking your booking, sending it to a partner in your city, carrying out the inspection and delivering the report | Performance of a contract |
| Showing and saving your car-value estimate | Steps you asked us to take (contract) |
| Sending one follow-up email after a car valuation and adding you to our mailing list | Your consent (you can withdraw it at any time) |
| Letting subscribed car dealers contact you about buying your car, if you ticked the separate box | Your consent (you can withdraw it at any time) |
| Running partner accounts, the app, dispatching customers and paying commissions | Performance of a contract |
| Accounting, tax and legal record-keeping | Legal obligation |
| Security, fraud and abuse prevention (for example rate limits on the car-value tool) | Legitimate interests |
| Quality review and marketing using inspection photos/videos a partner chose to share with us | Legitimate interests, and the partner's choice to share |
| Checking report photos, detecting licence plates and translating reports with AI | Performance of a contract and legitimate interests (quality of the report and privacy of plates) |
| Push notifications in the app | Your consent through your phone's settings |
05
Artificial intelligence
We use an AI model (Google Gemini) for three things:
- Car-value estimate. It uses only the car details you enter. Your email, phone and IP address are never sent to the model. The estimate is indicative only.
- Report quality check and plate detection. Before a customer can open an inspection report, an AI checks that each photo shows the part of the car it was taken for, and it detects licence plates in the photos and videos so that a plate can be hidden in the online report when the customer chooses. For this, small copies of the report's photos and video frames are sent to Google for processing.
- Translation. The written parts of a report, including names, business names and the inspector's notes, can be translated by AI into English, Swedish or Arabic. For this, those texts are sent to Google.
We do not send your email address or phone number to the model, and we do not use it to advertise to you. When the AI is unsure, a person decides. None of these uses is a decision that has legal or similarly significant effects on you.
06
Who we share data with
We do not sell personal data, except as described in the next point, which happens only with your clear consent. We share it only with:
- The partner workshop that takes your booking, so they can contact you and inspect the car.
- Car dealers who subscribe to Cardiagnos, but only if you asked for a car valuation, said you want to sell your car and ticked the separate box that allows dealers to contact you. They then see your car's details, your estimate and your email or phone number, for 60 days, to offer to buy your car. You can withdraw this at any time by writing to us.
- Service providers that process data for us under contract: Shopify (store, checkout, report records), Cloudflare (hosting, database, photo, file and video storage), Resend (email), Google (AI estimates, report photo checks, plate detection and translation, Google Play billing), Apple (App Store billing, notifications), Expo (push notification delivery).
- Authorities when the law requires it.
07
International transfers
Some providers process data outside Saudi Arabia and the EU/EEA (for example in the United States). Where this happens we rely on the safeguards the law requires, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, and the transfer rules of the Saudi Personal Data Protection Law.
08
How long we keep data
| Data | Kept for |
|---|---|
| Orders, invoices, payouts | 7 years (bookkeeping and tax law) |
| Customer contact details in our booking system | Removed 24 months after the booking is completed or cancelled |
| Inspection reports | As long as needed to serve the customer and the partner, or until a valid deletion request |
| Car-value contact details | 90 days, or until you unsubscribe if you agreed to emails; the whole record is deleted after 24 months |
| Partner accounts | Until the account is deleted; then personal details are erased and only anonymous financial records are kept |
| Login sessions | Up to 30 days |
09
Your rights
You can ask us to: access your data and get a copy; correct it; delete it; restrict or object to its use; receive it in a portable format; and withdraw consent at any time (this does not affect earlier use). Every follow-up email has an unsubscribe link.
Partners can delete their account and download their data in the app under Account.
Email ahmad@cardiagons.com. We reply within 30 days. You can also complain to a data protection authority: in Sweden, Integritetsskyddsmyndigheten (IMY, imy.se); in Saudi Arabia, the Saudi Data & AI Authority (SDAIA, sdaia.gov.sa); or the authority where you live.
10
Security
Data is encrypted in transit (HTTPS). Passwords are stored only as salted hashes, access to admin tools needs a second password, and access is limited to people who need it. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.
11
Cookies
We use cookies and similar storage that the site needs to work (cart, checkout, language, your cookie choice, and staying signed in on partner pages). Analytics or marketing cookies are only used if you accept them in the cookie banner; you can change your choice at any time from the banner or your browser settings.
12
Children
Our services are for adults. We do not knowingly collect data from children under 18.
13
Changes
We may update this policy. The effective date at the top shows the latest version. We will tell partners and, where required, customers about important changes.
Questions or requests
Write to ahmad@cardiagons.com or message us on WhatsApp +966 53 921 7400.
Cardiagnos