Effective date: 21/08/2026
Last updated: 11/10/2026
1. Introduction
This Privacy Policy explains how FAFO ("FAFO", "we", "us", "our") collects, uses, shares and protects personal data when you use fafo-trust.com and related services (the "Platform").
We are committed to handling personal data lawfully, fairly and transparently. This policy is written to be understood by people who are not lawyers.
Who is responsible for your data
The data controller for the processing described here is:
FAFO
A Lebanon-based startup project.
Website: fafo-trust.com
Data protection contact: privacy@fafo-trust.com
FAFO is an early-stage startup project based in Lebanon and is not yet a registered legal entity. Where a legal obligation in this policy falls on "the controller", it is undertaken by the project now, and by the registered entity once registration is complete.
Which data protection laws apply
FAFO is aimed at the Lebanese market and intends to be established in Lebanon. The principal law governing our processing is therefore Lebanese law, including Law No. 81/2018 on Electronic Transactions and Personal Data.
We host the Platform with providers whose data centres are located in European countries (see sections 6 and 8). Hosting data in Europe does not, by itself, establish FAFO in the European Union.
We do not claim blanket compliance with the EU General Data Protection Regulation (GDPR), and we do not claim an EU establishment. The GDPR may nonetheless apply to some of our processing — for example under Article 3(2), where we offer services to, or monitor the behaviour of, people who are in the EU or EEA. Where the GDPR applies to processing concerning you, we aim to meet its requirements for that processing, and this policy identifies the relevant provisions where they are relevant. Where it does not apply, Lebanese law and any other law applicable to you governs instead.
To be accurate about what we have and have not put in place at this stage:
| Item | Status |
|---|---|
| Establishment in the EU or EEA | None. FAFO is being established in Lebanon only |
| EU lead supervisory authority | None. With no EU establishment, the GDPR "one-stop-shop" does not apply to us |
| Data Protection Officer (GDPR Art. 37) | Not appointed. We do not currently believe we meet the criteria requiring one. We will appoint one if that changes |
| EU representative (GDPR Art. 27) | Not appointed. We will appoint one if and when our processing requires it |
| Privacy contact | privacy@fafo-trust.com — monitored, and the correct address for every request under this policy |
If you believe the GDPR, or another data protection law, applies to processing concerning you and that we have not addressed it properly, please write to privacy@fafo-trust.com so that we can consider it.
An important note about other Users
When you publish a Listing or send a message, the personal data you choose to include becomes visible to other Users. In respect of what a Seller or Buyer then does with your data outside the Platform, that person acts as an independent controller and we are not responsible for their conduct. Please share only what is necessary.
2. Information We Collect
We collect only what we need to operate the Platform. The tables below describe each category.
2.1 Account Information
Provided by you when you register and maintain your profile.
| Data | Notes |
|---|---|
| Full name | First and last name |
| Email address | Used as your login identifier and for service messages |
| Password | Stored only as a salted cryptographic hash — never in readable form |
| Telephone number | Optional; shown to Buyers only if you choose to publish it |
| City or location | Optional |
| Profile photograph | Optional |
| Account type | Private Seller, Dealership or administrator |
| Verification and status flags | Whether your email is confirmed, and whether the Account is suspended |
| Dealership details | Company name, address, telephone, website, logo and description, where you register a Dealership |
2.2 Vehicle Listing Information
Provided by you when you publish or edit a Listing.
- Make, model, generation, year, mileage, price and currency;
- Body type, fuel type, transmission, drivetrain, colour, doors, seats, engine size and power;
- Equipment and features;
- Free-text description;
- Location of the vehicle;
- Photographs and video links;
- Vehicle identification number (VIN), where you choose to provide one.
Please note: a Listing is public. Photographs may contain number plates, faces, house frontages or documents. Please remove or obscure anything you do not wish to publish, including the VIN if you would rather share it privately.
2.3 Communications and Support Requests
- Enquiry messages sent to a Seller, and replies in the same conversation;
- The email address and telephone number supplied with an enquiry;
- The follow-up status a Seller assigns to an enquiry;
- Reports you submit about a Listing or a User, including your description of the problem;
- Correspondence with our support, legal or privacy contacts.
2.4 Saved Preferences
- Vehicles you save to your favourites;
- Saved searches and whether you have enabled alerts for them;
- Notifications generated for you by the Platform.
2.5 Technical and Usage Data
| Data | Purpose |
|---|---|
| IP address | Recorded with security-relevant events; used for security and fraud prevention |
| Browser and device information (user agent) | Recorded with security-relevant events; used for compatibility and fraud prevention |
| Login records, including the date and time of your last sign-in | Account security and support |
| Session and refresh tokens | Keeping you signed in |
| Audit records of significant actions | An append-only record of actions such as registration, publication, moderation decisions and account suspensions, used for security and accountability |
| Search terms entered on the Platform | Held only as aggregate counters — for example "how many searches mentioned a given make" — and not linked to you |
| Listing view counts | Held only as a daily total per Listing. We do not record which person viewed which vehicle |
2.6 Information stored on your device, not sent to us
Your recently viewed vehicles are stored locally in your browser so you can return to them. This list stays on your device and is never transmitted to our servers. Clearing your browser storage removes it.
2.7 Data we do not collect
We do not collect payment card details, because payments between Buyers and Sellers do not take place on the Platform. We do not deliberately collect special categories of data (such as data revealing health, religion, political opinions or biometric data). Please do not include such data in a Listing or a message.
2.8 Photographs submitted for a photo valuation
The Platform offers an optional way to start a vehicle valuation: instead of typing the vehicle's details, a signed-in User may submit photographs of the vehicle, and an artificial-intelligence service reads the details from them. This is never required. The same valuation is always available by filling in the form by hand, with no photographs at all.
Where you choose to use it, we process:
| Data | Notes |
|---|---|
| The photographs you submit | Between one and ten per valuation. They are stored privately, are never published, and are not visible to other Users |
| What the analysis reports | The suggested make, model, year range, body type, colour, visible condition and damage, and the mileage or vehicle identification number where one is legible in a photograph |
| A technical fingerprint of the photographs | A one-way hash used only to recognise that the same photographs have been submitted twice, so they are not analysed twice. It cannot be turned back into an image |
| A record that you agreed | The date and time, your Account, the number of photographs and the version of the wording you accepted. No photograph, and nothing the photographs showed, is kept in this record |
Please note the following.
- A photograph can contain more than the vehicle. A registration plate, a person, a house or a street may be in the frame. Please keep people, and anything you would not want analysed, out of the picture, and only submit photographs you are entitled to share.
- We do not use these photographs to identify anyone. We do not perform facial recognition, we do not look up registration plates, and we do not ask the analysis to describe people or places.
- Location and camera metadata is removed. Before a photograph is sent for analysis we reduce its size and re-encode it, which strips the embedded metadata (such as GPS coordinates and the device model) that phone cameras add.
- The photographs are analysed by an external provider located outside Europe. See sections 6.3 and 8.
3. How We Use Information
We use personal data for the following purposes:
- Providing the Platform — creating and maintaining your Account, publishing your Listings, delivering enquiries, and showing search results.
- Authentication and security — signing you in, keeping sessions valid, detecting suspicious access, and protecting Accounts.
- Moderation and trust — reviewing Listings, assessing risk signals such as duplicate advertisements or prices far below the market, investigating reports, and enforcing our Terms.
- Fraud prevention — identifying, investigating and preventing fraudulent or unlawful activity.
- Communication — sending service messages such as email confirmation, password reset, moderation outcomes, enquiry notifications, and saved-search alerts you have enabled.
- Support — answering your questions and resolving problems.
- Improving the Platform — understanding, in aggregate, which features and vehicle categories are used, so we can improve them.
- Legal compliance — meeting our legal obligations and responding to lawful requests from competent authorities.
- Photo valuation — where you ask for it, analysing photographs of your vehicle to pre-fill the valuation form. The photographs are used for that purpose only: not for advertising, not for profiling, and not to train artificial-intelligence models, whether ours or our provider's.
Automated decision-making
We use automated signals to help prioritise Listings for human review — for example flagging a duplicate advertisement or an unusually low price. These signals assist our moderators; they do not by themselves produce a legal or similarly significant effect on you, and a person decides the outcome. If a decision affects you and you disagree with it, contact privacy@fafo-trust.com.
The photo valuation described in section 2.8 uses artificial intelligence to recognise a vehicle, and a statistical model to estimate its market value. What it produces is a suggestion, not a decision. Every detail read from your photographs is shown to you first, marked as detected or missing, and you confirm or correct each one before any value is calculated. The resulting figure is an estimate for your information: it does not set the price of your Listing, does not affect whether a Listing is accepted, and has no legal or similarly significant effect on you. The analysis can be wrong, and you remain free to disregard it.
Marketing
We send marketing messages only where you have asked to receive them, or where the law otherwise permits it. You can withdraw consent at any time, and every marketing message contains an unsubscribe link. Service messages necessary to operate your Account are not marketing and cannot be switched off while your Account is open.
4. Legal Basis for Processing
Data protection laws generally require a lawful basis for each processing activity. The table below sets out the basis we rely on for each purpose.
Where the GDPR applies to processing concerning you (see section 1), the corresponding GDPR article is shown in brackets. Where it does not apply, the same grounds are relied on under Lebanese law and any other law applicable to you; the description of what we do, and why, is the same either way.
| Processing | Lawful basis |
|---|---|
| Creating and operating your Account; publishing your Listings; delivering enquiries | Performance of a contract (GDPR Art. 6(1)(b)) |
| Authentication, session management and account security | Performance of a contract and legitimate interests (GDPR Art. 6(1)(b) and (f)) |
| Moderation, risk scoring, fraud prevention, abuse investigation, audit records | Legitimate interests (GDPR Art. 6(1)(f)) — keeping the marketplace safe and trustworthy for all Users |
| Aggregate usage and search statistics | Legitimate interests (GDPR Art. 6(1)(f)) — improving the Platform |
| Saved-search alerts and optional marketing | Consent (GDPR Art. 6(1)(a)) — withdrawable at any time |
| Photo valuation: storing the photographs you submit and sending them to an external artificial-intelligence provider for analysis (section 2.8) | Consent (GDPR Art. 6(1)(a)) — asked for expressly before each submission, never assumed from an earlier one. You may withdraw it at any time by replacing or discarding your photographs, or by writing to us; the valuation form remains available without it |
| Keeping the record that you gave that consent | Legal obligation and legitimate interests (GDPR Art. 6(1)(c) and (f)) — being able to demonstrate that consent was given (GDPR Art. 7(1)) |
| Retaining records required by law, and responding to lawful requests | Legal obligation (GDPR Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (GDPR Art. 6(1)(f)) |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You may object to that processing — see section 9.
5. Data Retention
We keep personal data only for as long as it is needed, and then delete or anonymise it.
| Data | Retention |
|---|---|
| Account data | While the Account is open, and up to 30 days after a deletion request, to allow recovery from error or abuse |
| Published Listings | While published; expired or archived Listings are removed from public view and deleted after 12 months |
| Listing photographs | Deleted from object storage together with the Listing |
| Photographs submitted for a photo valuation, the analysis result and the fingerprint | Deleted as soon as the result has been passed to your valuation form, or when you replace or discard the photographs. Anything left behind — for example because you closed the page — is deleted automatically within 24 hours. If your Account is deleted first, they are deleted with it. If you go on to create a Listing with the same photographs, they then become Listing photographs and follow the rule above |
| Copies held by our artificial-intelligence provider | Our provider does not keep the photographs for its own purposes. It may retain inputs and outputs for a limited period for safety and abuse monitoring, as set out in its terms, after which they are deleted |
| Record that you consented to a photo valuation | 24 months, as part of the audit records below. It contains no photograph |
| Enquiries and messages | 24 months after the conversation ends, so both parties keep a record of what was agreed |
| Reports of fraud or abuse, and related correspondence | 24 months, or longer where an investigation or legal claim requires it |
| Audit records (including IP address and user agent) | 24 months, for security and accountability |
| Session and refresh tokens | Until expiry, sign-out, or password change |
| Aggregate statistics and view counts | Retained indefinitely in a form that does not identify any person |
| Records required by accounting, tax or other law | For the period required by the applicable law |
6. Data Sharing, Hosting and Service Providers
We do not sell personal data.
We share personal data only as follows:
6.1 With other Users
The data you choose to publish in a Listing or profile, and the content of enquiries you send, is shared with the Users concerned. This is the core purpose of the Platform.
6.2 Where the Platform is hosted
The Platform's servers, databases and file storage are provided by third-party infrastructure providers whose data centres are located in European countries. Your personal data is therefore stored and processed in Europe, even though FAFO itself is being established in Lebanon and is aimed at the Lebanese market.
We chose European hosting deliberately: those providers operate under a mature data protection regime and offer contractual data protection terms we can rely on. It does not mean FAFO is established in the EU, and it does not by itself make the GDPR applicable to all of our processing — see section 1.
The specific hosting region in use is available on request from privacy@fafo-trust.com.
6.3 With service providers (processors and subprocessors)
We use third parties to run the Platform. They act as processors on our documented instructions under a written data processing agreement, may not use the data for their own purposes, and are bound by confidentiality. Where a processor engages a subprocessor, it must impose equivalent obligations on that subprocessor and remains responsible to us for its performance.
| Category | Purpose | Typical processing location |
|---|---|---|
| Hosting and infrastructure | Running the servers and databases | European countries |
| Object storage | Storing Listing photographs | European countries |
| Email delivery | Sending service and notification emails | European countries, or another country where the provider operates |
| Error monitoring and logging | Diagnosing faults and detecting abuse | European countries, or another country where the provider operates |
| Analytics | Understanding aggregate use of the Platform | European countries, or another country where the provider operates |
| Artificial-intelligence image analysis — Anthropic, PBC | Analysing the photographs you submit for a photo valuation (section 2.8), and nothing else. Used only when you ask for a photo valuation and consent to it | United States |
| Administration and support by our own team | Operating and supporting the Platform | Lebanon |
A current list of our processors and their subprocessors, including the countries in which they process personal data, is available on request from privacy@fafo-trust.com. Where we add or replace a processor in a way that materially affects how your personal data is handled, we will update this policy and, where the law requires it, give notice.
6.4 With authorities and advisers
We may disclose data where we are required to do so by law, or where disclosure is necessary to establish, exercise or defend legal claims, to prevent fraud, or to protect the rights, safety or property of any person. We assess each request and disclose only what is necessary.
6.5 On a change of business
If the business is reorganised, merged, sold, or transferred to the Lebanese entity on completion of registration, personal data may be transferred as part of that transaction. We will inform you, and the recipient will remain bound by this policy or by a policy offering equivalent protection.
7. Security Measures
We take appropriate technical and organisational measures to protect personal data, including:
- Encryption of traffic in transit using TLS;
- Storage of passwords only as salted cryptographic hashes;
- Signed, expiring access tokens, with separate refresh tokens that can be revoked;
- Role-based access control, so staff access only what their role requires;
- An append-only audit trail of significant administrative actions;
- Rate limiting and abuse detection on sensitive endpoints;
- Isolation of internal services, which are not exposed to the public internet;
- Regular application of security updates.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent authority and affected Users to the extent, and within the timescales, required by the law applicable to that breach. Where the GDPR applies to the affected processing, that means notifying the competent supervisory authority without undue delay and, where feasible, within 72 hours, and informing affected Users without undue delay where the risk is high.
8. International Data Transfers
Because FAFO is being established in Lebanon while the Platform is hosted in European countries, personal data crosses borders in the ordinary course of running the service. We want to be precise about the direction of those flows.
8.1 What moves where
| Flow | Description |
|---|---|
| You → Europe | Data you submit is stored and processed on our providers' servers in European countries |
| Europe → Lebanon | Our own team, based in Lebanon, accesses the Platform's administrative tools to operate, moderate and support it. This is an access-based transfer of data out of Europe |
| Europe → elsewhere | A processor may process data in another country, where that is disclosed in section 6.3 or in the processor list available on request |
| Europe → United States | Only where you use the photo valuation: the photographs you submit are sent, over an encrypted connection and with their metadata removed, to our artificial-intelligence provider in the United States, and the analysis is returned to us. Your name, email address and other Account details are not sent with them |
8.2 Safeguards
Where personal data protected by the GDPR is transferred out of the EEA — including access from Lebanon — we rely on one of the following:
- An adequacy decision of the European Commission covering the destination country. Please note that, at the date of this policy, Lebanon is not the subject of an EU adequacy decision;
- The European Commission's Standard Contractual Clauses, together with any supplementary technical and organisational measures needed after assessing the destination; or
- Another lawful transfer mechanism recognised under applicable law.
For the transfer of photo-valuation photographs to the United States, we rely on the safeguards in our provider's data processing terms — the Standard Contractual Clauses or, where the provider is certified, the EU–US Data Privacy Framework — in addition to the consent you give before each submission. You are told on the page, before anything is sent, who receives the photographs and in which country.
Where Lebanese law governs a transfer of personal data out of Lebanon, we comply with the requirements applicable to such transfers under Law No. 81/2018 and any implementing regulation.
In all cases we apply the same technical safeguards described in section 7 — encryption in transit, access control and audit logging — regardless of which side of a border the data sits on.
You may request further information about the safeguards applied to a particular transfer by writing to privacy@fafo-trust.com.
9. Your Rights
Subject to the conditions and exemptions in applicable law, you have the following rights over your personal data. Where the GDPR applies to processing concerning you, these correspond to the rights in Articles 15 to 22; where Lebanese or another law applies, the rights available to you are those that law provides, and we will honour the rights below as a matter of policy wherever we reasonably can.
| Right | What it means |
|---|---|
| Access | To be told whether we process your data and to receive a copy of it |
| Rectification (correction) | To have inaccurate data corrected and incomplete data completed |
| Erasure ("right to be forgotten") | To have your data deleted where there is no overriding reason to keep it |
| Restriction of processing | To have processing paused, for example while accuracy is being checked |
| Data portability | To receive the data you provided in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible |
| Objection to processing | To object to processing based on our legitimate interests, and to object at any time — absolutely — to direct marketing |
| Withdrawal of consent | To withdraw consent at any time, where processing is based on consent. This does not affect processing carried out before withdrawal |
| Human review | To ask for human involvement in, and to contest, a decision that affects you |
How to exercise your rights
Write to privacy@fafo-trust.com. Some rights can also be exercised directly: you can edit most profile and Listing data in your Account settings, and you can request deletion of your Account as described on our Delete My Account page.
We will respond within one month. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months and will explain why within the first month.
We may ask you to verify your identity before we act, so that we do not disclose your data to someone else. Requests are free of charge, unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, explaining our reasons.
Complaints
If you believe we have not handled your personal data properly, please contact us first at privacy@fafo-trust.com so that we can investigate your concern and try to resolve it.
You may also have the right to lodge a complaint with the data protection or privacy authority competent for you, depending on your country of residence and the law that applies to the processing.
As FAFO is intended to be established in the Republic of Lebanon, complaints relating to processing carried out in Lebanon may be submitted to the competent Lebanese authority designated under Law No. 81/2018.
FAFO has no establishment in the European Union and therefore no EU lead supervisory authority. If the GDPR applies to processing concerning you, you may nonetheless complain to the supervisory authority of the EU or EEA country in which you live or work, or in which you consider the issue arose.
Nothing in this section limits your statutory rights to seek assistance or lodge a complaint with a competent supervisory or regulatory authority.
10. Cookies and Similar Technologies
We use a small number of technologies that store information on your device:
- Strictly necessary storage, such as your authentication tokens and session data, without which the Platform cannot function. These do not require consent.
- Functional storage, such as your recently viewed vehicles and your vehicle comparison list, which stay on your device.
- Analytics, where used, which we deploy only on the basis of your consent where consent is required.
You can clear this storage through your browser settings. Doing so will sign you out and clear your locally stored preferences.
11. Children's Privacy
The Platform is intended for adults. You must be at least 18 years old to create an Account.
We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@fafo-trust.com and we will delete it without undue delay.
12. Changes to this Policy
We may update this Privacy Policy to reflect changes in the Platform, in our practices, in our legal status on completion of registration, or in the law. The "Last updated" date at the top of this page shows when it was last revised.
Where a change materially affects how we use your personal data, we will give notice before it takes effect — by publishing the revised policy and, where appropriate, by contacting registered Users directly. Where the law requires your consent to a change, we will ask for it.
13. Contact Information
For any question about this policy, or to exercise any of your rights:
| Purpose | |
|---|---|
| Privacy and data protection | privacy@fafo-trust.com |
| Legal, abuse and fraud reports | legal@fafo-trust.com |
| General support | support@fafo-trust.com |
FAFO
A Lebanon-based startup project.
Website: fafo-trust.com