Privacy Policy

This policy explains what information the Convoy Service Logistics Platform, operated by [LEGAL ENTITY] ("Convoy," "we," "us"), collects, how it is used and shared, how long it is kept, and the choices and rights you have.

1. Information we collect

• Account information: name, work email, company or dealership, role, and branch or area assignment. Passwords are handled by our authentication provider and are never visible to Convoy.
• Fleet and dealer contacts: names, work phone numbers and work email addresses of branch contacts and service advisors shown on a job.
• Vehicle information: VIN, unit number, make, model and year, mileage (when provided for a service request), branch, and fleet status (including removal from fleet).
• Service and recall jobs: recall campaigns, status history, appointment dates, RO numbers, hold reasons, service notes and certifications.
• Invoices and proof of repair: uploaded invoice and repair-order files and the amounts entered from them.
• Billing details: plan, billing contact email, invoice history, and the payment method's brand, last four digits and expiry. Full card and bank numbers are collected only by our payment processor and are never entered into or stored by Convoy.
• Support messages: messages you send through Contact Convoy and any optional phone number you add.
• Messages on jobs: messages exchanged between fleets and dealers on a job.
• Activity log: who took each action and when, sign-in times, and security logs.

The Platform is designed for business vehicle records. We do not collect dates of birth, driver's license numbers, Social Security numbers, or renter or driver personal information, and Users should not enter them.

2. How we use information

• To match recalls to vehicles, route jobs to dealers, and track repairs to completion.
• To send notifications and optional daily summary emails.
• To bill subscriptions and keep invoice records.
• To respond to support requests.
• To produce reports and compliance records for the Organization that owns the data.
• To secure the Platform, investigate misuse, and meet legal obligations.

3. Who can see what

• Within a fleet: Users see only the branches their role allows. Company administrators see all branches.
• Between fleets and dealers: a dealer sees a fleet's vehicle only when the vehicle has an open recall the dealer can service, or a job the dealer has accepted. Dealers never see a fleet's full vehicle list.
• Released jobs: if a dealer releases a job, the next dealer does not see the earlier dealer's messages.
• Other organizations: no Organization can see another Organization's data.

4. Service providers

We share information only with service providers that process it on our behalf under confidentiality obligations:

• Supabase — hosting, database, file storage and sign-in (authentication).
• [PAYMENT PROCESSOR] — collects and stores card and bank details and processes payments.
• [EMAIL PROVIDER] — sends account verification, password reset and notification emails.
• NHTSA recall lookups — VINs are sent to the National Highway Traffic Safety Administration's public recall service to find open recalls. No personal information is sent.

We may also disclose information to regulators or authorities when required by law or valid legal process, and as directed by the Organization that owns the data.

5. We do not sell or share personal information

Convoy does not sell personal information and does not share it for cross-context behavioral advertising, as those terms are defined under US state privacy laws. We do not use analytics or advertising cookies. See our Cookie Notice.

6. Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale and sharing of personal information, and any optional advertising tools stay off for browsers that send it.

7. Retention

• Recall, service, certification and activity records: [RECALL RECORD RETENTION PERIOD] after the recall is closed, or longer where the law requires.
• Invoices and billing records: [BILLING RETENTION PERIOD].
• Support messages: [SUPPORT RETENTION PERIOD].
• Account information: while the account is active, then [ACCOUNT RETENTION PERIOD]. Deactivated accounts remain in the activity log but can no longer sign in.
• Vehicles removed from a fleet are kept, marked as removed, with their history intact, for the recall record period above.
• On termination, an Organization may request an export of its data within [EXPORT WINDOW] days, after which it will be deleted except where retention is legally required.

8. Your US state privacy rights

Depending on the state where you live, you may have the right to:

• Access the personal information we hold about you, and receive a copy.
• Correct inaccurate personal information.
• Delete personal information, subject to legal and record-keeping exceptions.
• Opt out of the sale and sharing of personal information and of targeted advertising. We do not sell or share, but you may still submit this request.
• Appeal our decision on your request, and not be discriminated against for exercising these rights.

To make a request, email [CONTACT EMAIL]. We will verify your request using your account email and respond within the time required by law. You may use an authorized agent where state law allows. Because the Platform holds business records for Organizations, we may refer some requests to your Organization's administrator.

9. Security

• Individual, email-verified logins with role-based access. Passwords are handled by our authentication provider and stored only in hashed form.
• Encryption in transit (TLS). [ENCRYPTION AT REST — confirm.]
• Uploaded files are stored privately and served only to authorized Users through short-lived links.
• An activity log of changes, including who made them.
• Access by Convoy staff is limited to support and operations needs.

If we become aware of unauthorized access to an Organization's data, we will notify the affected Organization without undue delay and within [BREACH NOTICE PERIOD], and as required by law.

10. Children

The Platform is for business use and is not directed to children under 16. We do not knowingly collect their information.

11. Changes

We will post updates to this policy with a new version date and ask Users to acknowledge material changes.

12. Contact

[LEGAL ENTITY] · [MAILING ADDRESS] · Privacy questions and requests: [CONTACT EMAIL]