PREVAYL CARRIER
MOBILE APP — PRIVACY POLICY

This Privacy Policy describes how Prevayl ("we", "us", "our") collects, uses, and shares information when you use the Prevayl Carrier Android mobile application (the "App"). The App is a tool for licensed motor carriers and their drivers to manage auto-transport loads, communicate with brokers, document pickups and deliveries, and track earnings.

By installing or using the App, you agree to this Privacy Policy. If you do not agree, do not install or use the App.

1. Who this policy applies to

This policy applies to drivers employed by, contracted to, or operating as carriers (sole proprietors, owner-operators) who use the App to perform load assignments, and to carrier owners and dispatchers who manage carrier organizations on the platform and access the App in administrative capacities.

The App does not target consumers or persons under 18 years of age. The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

2. What information we collect

2.1 Information you provide directly

• Account identifiers — email address, name, phone number
• Carrier company affiliation — Motor Carrier (MC) number, USDOT number, company name and address
• Driver profile data — driver's license details (where required for compliance), home base location, equipment type, preferred lanes
• Authentication credentials — passwords are handled by our authentication provider (Supabase) and never stored in plaintext

2.2 Information collected automatically while you use the App

• Precise location (GPS) — collected continuously while you have an active assigned load and have granted location permission. Used for live trip tracking visible to dispatch, geofence detection at pickup and delivery, ETA calculation, nearby truck-stop suggestions, and PIN-protocol context binding for high-value loads. We collect both foreground location (while the App is open) and background location (while the App is closed but a load is active). You can revoke this permission in your device settings at any time.
• Device identifiers — Android Advertising ID, device model, OS version, App version, manufacturer, build identifier. Used for analytics, crash reports, push notification routing, and PIN-protocol device fingerprint.
• Usage data — pages viewed, actions taken (load accepted, photo uploaded, signature captured), feature interactions, errors and crash logs.
• App-generated data — load history, status transitions, GPS tracks, ETAs, mileage logs, fuel events.

2.3 Information you create or upload through the App

• Photos — vehicle inspection photos at pickup and delivery, receipts (fuel, tolls, repairs), profile photo, document uploads (CDL, medical card, insurance certificates). Photos may include capture timestamp and GPS coordinates as metadata.
• Microphone audio — only when you explicitly initiate voice features (voice notes attached to a load, hands-free dictation). We do not record or stream audio in the background.
• Signatures — digital signatures captured on the device for Bill of Lading sign-off, both your driver signature and shipper/receiver signatures.
• Messages — text and media you send to dispatchers via in-App chat.

2.4 Information from third parties

• Map and location services — Google Maps Platform and Mapbox render maps and compute routes. These providers may receive your IP address, device coordinates, and search queries per their own privacy policies.
• Push notification service — Expo Push receives anonymized device tokens to deliver notifications to your device.
• Authentication and data storage — Supabase (our backend platform) processes the data you submit through the App on our behalf.

3. How we use information

• Operate the App — match you to your assigned loads, render maps, deliver messages, calculate earnings, generate digital Bill of Lading documents.
• Track and verify deliveries — show your live position to your dispatcher, detect arrival via geofence, validate PIN-protocol handoffs at high-value loads.
• Communicate with you — push notifications about load assignments, dispatcher messages, payment events, handoff approvals, account or system alerts.
• Compliance and safety — DOT and FMCSA documentation, IFTA reporting support, dispute resolution, fraud detection, theft prevention through our handoff verification protocol.
• Improve the App — debug crashes, analyze feature usage, prioritize improvements, train internal models for in-App AI assistance.
• Legal obligations — comply with applicable laws, respond to lawful requests from authorities, enforce our Terms of Service.

We do not use your information for advertising or sell it to third parties.

4. Background location — explicit disclosure

Background location is collected only while you have an active assigned load. When you have no active load, the App stops requesting background location updates. You may revoke background location permission at any time via your device's permission settings, but the App's load tracking features will not function correctly without it.

We do not share your location with advertisers, data brokers, or any party other than:

• The carrier organization you work for (your dispatcher, fleet manager, or owner-operator account)
• The broker who tendered the load (only for the duration of that load and only the location data relevant to that shipment)
• Map service providers (Google Maps, Mapbox) for the purpose of rendering your position
• Our backend platform (Supabase) for storage and replication

5. How we share information

• With your carrier organization — your dispatcher and carrier admin can see your assigned loads, status updates, GPS tracks during active loads, photos, signatures, messages tied to those loads, your earnings and pay history.
• With brokers tendering loads to your carrier — when your carrier accepts a load, the broker can see status updates, GPS tracks during active load, photos, signatures, and Bill of Lading documents for that specific load. They cannot see your personal earnings, expenses unrelated to their loads, or messages with other parties.
• With shippers and receivers at pickup/delivery — they see your name, the PIN you display (for protected high-value loads), and the digital Bill of Lading at the time of handoff.
• With service providers — Supabase (backend and auth), Google Maps Platform (map rendering), Mapbox (map rendering and navigation), Expo (push notifications, over-the-air updates), Stripe (payment processing for carrier earnings disbursement, where applicable). Each provider operates under its own privacy policy and is contractually bound to use the data only to provide the service to us.
• For legal reasons — to comply with subpoenas, court orders, regulatory inquiries (DOT, FMCSA, IRS, state authorities), or to investigate fraud, theft, or violations of our Terms of Service.
• In a business transaction — if Cars2go LLC is acquired, merged, or sells assets, your information may transfer to the successor entity, subject to this Privacy Policy or a successor policy you are notified of.

6. Data retention

• Account and profile data — duration of your active use plus 7 years after account closure (DOT/FMCSA driver record retention)
• Load history, GPS tracks, photos, signatures, BOL documents — 7 years (IRS record retention for transportation businesses)
• Messages — 7 years for dispute resolution and legal compliance
• Crash logs and analytics data — 90 days, then aggregated and de-identified
• Push notification tokens — duration of the App's installation on your device

You may request earlier deletion by emailing [email protected]. We will honor such requests except where we are legally required to retain specific records.

7. Data security

• All data transmitted between the App and our servers uses TLS 1.2 or higher
• Passwords are hashed using industry-standard algorithms (managed by Supabase)
• Database access is restricted via row-level security — your data is accessible only to your carrier organization, the brokers you work with, and authorized Cars2go LLC personnel
• Sensitive credentials stored on device (auth tokens) use the Android Keystore via expo-secure-store
• The PIN protocol uses cryptographic context binding (device + GPS + shipment + time bucket) to prevent PIN reuse across devices

No security measure is perfect. If we discover a breach affecting your data, we will notify you in accordance with applicable laws (including state data breach notification statutes).

8. Your rights and choices

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate information
• Deletion — ask us to delete your information (subject to legal retention requirements)
• Portability — request your data in a machine-readable format
• Objection — object to certain uses of your information
• Withdraw consent — revoke any consent you previously gave; for location, do this through your device's permission settings at any time

To exercise any of these rights, email [email protected]. We will respond within 30 days.

California residents: you have additional rights under the California Consumer Privacy Act (CCPA). We do not sell your personal information.

Canadian residents: we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). For Quebec residents, we also comply with applicable provincial privacy law (Loi 25). For carrier users in Canada, your information is processed under PIPEDA and may be transferred to the United States for storage and processing.

9. Children's privacy

The Prevayl Carrier App is intended for licensed motor carriers and their drivers, all of whom must be at least 18 years old (most US/Canadian commercial driver license programs require 21 for interstate operation). We do not knowingly collect personal information from anyone under 18. If you believe a child has used the App, contact [email protected] and we will delete the information.

10. International users

The App is operated from the United States. By using the App, you consent to the transfer of your information to the United States, where data protection laws may differ from those of your country.

If you are in the European Union, United Kingdom, or Switzerland, please note that we do not currently offer the App to consumers in those regions, and we have not evaluated the App for GDPR compliance because we do not target those markets.

11. Permission descriptions

The App requests the following Android permissions. Each is used only for the disclosed purposes:

We do not request: contacts list, call log, SMS, calendar, or device admin privileges.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy at this URL, update the "Last updated" date at the top, and for material changes affecting your data rights, send a push notification to active App users and email you at the address on file. Continued use of the App after a policy change constitutes acceptance of the updated policy.

13. Contact

For questions, concerns, or requests related to this Privacy Policy or your data:

• Email: [email protected]
• General support: [email protected]
• Mailing address: Cars2go LLC, South Lyon, Michigan, United States