Privacy Policy

Caravan Portal is a Business-to-Business (B2B) enterprise tool for automotive brokerage firms. Accounts are provisioned by a company administrator (“Broker”); there is no public sign-up and no in-app purchasing. The application acts as a secure management overlay that lets Brokers grant employees and clients (“Buyers”) access to corporate auction accounts without exposing raw login credentials.

1. Data Collected for Security Purposes

To facilitate secure access to third-party auction platforms and protect the integrity of corporate brokerage accounts, the application collects specific technical and behavioral data from the devices used by Client and Employee users (“Buyers”). This data includes:

• Network IP address, and the country derived from it (country-level only — no city, precise, or GPS location)
• Device type and model (e.g., iPhone 15 Pro)
• Software environment — operating system and browser/runtime version, reported via the device’s User-Agent
• A unique device identifier, used only to bind access to broker-approved devices and never as a cross-app or advertising identifier. Its nature depends on the platform:
  • On iOS: the Identifier for Vendor (IDFV) and/or an identifier generated by the app and stored on the device. This value may reset (for example, if the app is removed) and is not a permanent hardware serial number.
  • On desktop (Windows and macOS): an identifier derived from stable device hardware characteristics, designed to persist across reinstalls so the broker’s device whitelist remains reliable.
• In-app activity within the secure enterprise browser — specifically bidding history and login timestamps.

2. Purpose of Collection (Device Whitelisting and Auditing)

This information is never used for advertising, cross-app tracking, or marketing profiling. It is collected strictly for security authentication, fraud prevention, and corporate compliance:

• Device control: Brokers enforce device “whitelisting” / “banning” using the device identifier — sensitive corporate auction accounts can be accessed only from broker-approved devices. IP address and country are recorded for the audit trail and login visibility only; they are not used to allow or block access.
• Audit transparency: Bidding activity and login history are logged to give the Broker a transparent audit trail of corporate purchases made by their assigned Buyers.

3. Data Sharing and Transparency

Because this platform is an enterprise management tool, a Buyer’s bidding activity, login history, and device data are made directly visible to the Broker/Employer who provisioned the account. This data stays within the enterprise ecosystem and is never sold to data brokers, shared with unrelated third parties, or fed into advertising networks.

4. User Consent and Account Deactivation

Buyers are presented with a clear disclosure regarding this device and activity monitoring before launching the secure browser environment for the first time. Buyers who do not consent must decline the prompt, which prevents access to the enterprise-managed auction accounts.

Because accounts are provisioned by the enterprise, Buyers wishing to deactivate their account or remove their data must submit a request directly to their managing Broker. The Broker can deactivate the account, which immediately revokes access. Transient browsing data (such as watchlist entries) is automatically deleted on a short schedule. Certain transactional and security records — for example, bidding history and audit logs — are retained for legitimate business, accounting, and compliance purposes even after an account is deactivated, in line with the Broker’s record-keeping obligations.

This policy is versioned with the application. Material changes are surfaced through an updated in-app consent prompt on next launch.