What we collect, and the shorter list of what we do with it.

When a showroom signs up and uses the service, we collect:

We ingest the vehicle records your feed sends: VIN, stock number, specification, mileage, price, description, and photographs, which we re-host so they load quickly and stay available. We store a snapshot of each feed payload so we can tell what changed and avoid reprocessing what did not.

This is business data about vehicles, not personal information about people. If your feed contains personal information, for example a salesperson's name in a free-text description, it is published as part of that listing, so do not put anything in a feed you would not want on a public page.

A lead form on a showroom's listing page collects the name, email, phone or WhatsApp number, and message the shopper enters, along with the vehicle they were looking at and how they arrived.

We store that inquiry and deliver it to the showroom, by email, WhatsApp or to their CRM. The showroom decides how it is then used and how long they keep it. We keep our copy so the showroom has a record and so delivery failures can be retried and audited.

We do not sell inquiries, broker them, share them with any other showroom, or use them to market anything of our own. This is not only a policy: charging for or reselling leads would break the model the whole product is built on.

The point of this product is telling a showroom that AI systems are reading and citing their inventory. That takes measurement, so it is worth stating exactly how much.

When a page on a showroom surface is requested, we may write one row recording: which showroom, which vehicle, what kind of visitor it was (a crawler, a verified agent, a person arriving from an AI answer, or an agent tool call), which AI platform it is attributable to, the referring URL, the path, the browser or bot user agent string, and the time.

We do not log IP addresses. There is no column for one. We do not build a profile of a visitor, we do not track anyone across sites, we do not run advertising or analytics tags from third parties on showroom surfaces, and on those surfaces we do not use cookies to recognize a returning person.

On showroom surfaces one first-party cookie is used, and only for attribution. When an AI crawler or a verified agent fetches a vehicle page, we set a cookie named __ai_ref that holds the name of that platform and nothing else. It lives for five minutes, it is read once and then cleared, and its only job is to connect the AI system that looked at a page to the person who arrives moments later with no referring URL. It carries no identifier and cannot be read by JavaScript or by another site.

Our own marketing site at rallypoint.ae runs no third-party analytics or advertising tags either. The one form on it, the waitlist, sends what you type to us by email and stores nothing in a database.

Some pages let a shopper pick a finance profile, such as the down payment and term they have in mind, to see a realistic estimated monthly instalment. That selection is something the shopper tells us in order to get useful arithmetic back. It is not a credit check or a finance application.

We do not pull your credit. We do not obtain, request, or receive a consumer report or a credit score about you from anyone, we are not a credit bureau, and choosing a profile has no effect of any kind on your credit. Nothing on this platform submits a finance application to a bank.

A self-selected profile is never attached to your identity in anything we publish or analyse. Where we report on shopping patterns, it appears only as an aggregate dimension across many people and is never joined to a name, an email, or an inquiry.

We use the information above to do the things the service exists to do, and not for other purposes:

Some of these are commercially tempting, which is why they are written down.

We use a small set of service providers, each for a stated purpose and under an agreement that limits them to it. None of them is permitted to use the information for their own purposes.

Our service providers operate data centres outside the UAE, principally in the European Union and the United States, and information may be processed there. While it is in another country it is subject to the laws of that country, including lawful access by its courts and authorities.

Where personal data leaves the UAE, we transfer it only under the conditions the UAE data-protection law allows, including contractual safeguards with those providers, and it remains subject to this policy. We remain accountable for it.

We keep information only as long as it serves the purpose it was collected for, or as long as the law requires. In practice that means:

Write to hello@rallypoint.ae and mark it for the Data Protection Officer. That address reaches the person accountable for privacy here, and it is the route for every request described in this section and the next. A postal address is available on request.

You can ask us for access to the personal data we hold about you, ask us to correct anything inaccurate, ask us to delete it, ask us to restrict or stop processing it, object to processing, ask for a portable copy, and withdraw a consent you previously gave, subject to the limits the law puts on each of those. Withdrawing consent may mean we can no longer provide part of the service, and we will tell you plainly if that is the case rather than letting it fail quietly.

We acknowledge requests within 10 business days and respond substantively within 30 days, with one further extension where the law allows it and we tell you why. We do not charge for this.

We need to be able to tell it is you. We verify a request against information we already hold rather than asking you for new identity documents, and if we genuinely cannot verify you we will say so rather than handing your information to someone else.

If you think we have got something wrong, tell us and we will look at it again. You can also complain to the UAE Data Office, the federal data-protection authority, and you do not have to come to us first.

For a showroom's account, profile, feed and billing data, we process it because it is necessary to perform our agreement with the showroom, and to meet our own legal and tax obligations.

For a buyer inquiry, the buyer asked to be contacted by the showroom and we deliver that request. The showroom is the controller for what happens next; we process on their instructions.

For visit logging on showroom surfaces, we rely on our legitimate interest in showing a showroom that AI systems read and cited their inventory, which we have balanced against the visitor by collecting no IP address, no identifier and no profile.

For the waitlist form on this site, we process what you type because you asked us to contact you.

We do not use personal data to make automated decisions that produce legal or similarly significant effects about anyone, and we do not process the personal data of children knowingly.

Access to the database is denied by default and granted per row, so one showroom's data is not reachable from another showroom's session. Administrative credentials are used only on the server and are never sent to a browser. Traffic is encrypted in transit. Passwords are stored hashed. Webhooks we send are signed so the receiver can verify them.

No system is perfectly secure, and we will not claim otherwise.

If a breach of our safeguards creates a risk to you, we will notify you and report it to the UAE Data Office as soon as feasible, and within the period the law sets. We keep a record of every breach of security safeguards for at least 24 months, whether or not it was reportable, and we will give that record to the authority on request.

This service is for showrooms and for adults shopping for a vehicle. It is not directed to children, and we do not knowingly collect information from them. If you believe a child has given us information, tell us and we will delete it.

This policy carries a version. When we make a substantive change we publish a new version and ask showrooms to accept it. The version a showroom accepted, and when, is recorded on their account.

We review this page at least once every 12 months and update the version stamp when we do, so the date at the top is a date someone actually looked, not the date the file was created.