Version of 21 October 2026
1. Who processes your data
1.1. The data controller is individual entrepreneur Imerov Adilkhan, Kyrgyz Republic ("we", "us"). Contact on personal data matters: [email protected].
1.2. This Policy applies to the Karavan mobile app, the web cabinet and related services (the "Service") and follows the Law of the Kyrgyz Republic "On Personal Information".
2. What we collect
2.1. Account: phone number, e-mail address, name, profile photo, role, countries of operation, language, password (stored only as a hash).
2.2. Sign-in with Google or Apple: the provider's account identifier, the confirmed e-mail address (for Apple possibly a private relay address) and your name if you chose to share it.
2.3. Identity verification: photos of your passport or ID card, driving licence, vehicle registration certificates, a selfie, a short liveness video, a photo of the truck. The document number and expiry date are read automatically; to detect reuse of a document we keep a cryptographic fingerprint of its number, not the number itself.
2.4. Company (for logistics agents, optional): legal form, name, tax ID, documents.
2.5. Use of the Service: cargo and truck listings, responses, deals, checklist photos and videos, chat messages (text, photos, videos, voice messages, location if you sent it), ratings, Support tickets.
2.6. Location: for a carrier and a driver — coordinates, speed and heading during a deal, from "Agreed" until arrival. Location is not collected outside a deal.
2.7. Device and technical data: installation identifier, platform, push token, IP address, sign-in times, session log.
2.8. Payments: what was bought, the amount, the status and the payment service's payment identifier. We do not receive card or bank account details.
3. Why we process it
- registration, sign-in, account and device protection;
- running the marketplace: listings, responses, deals, chat, delivery tracking;
- verifying carriers and granting the "Verified" badge;
- handling disputes and tickets, moderation, fraud prevention;
- calculating ratings;
- plan payments and usage limits;
- notifications (push, e-mails, code messages);
- legal compliance.
Legal grounds: your consent given at registration, performance of the Terms of Use, and legal obligations.
4. Automated identity verification
4.1. Documents and selfies are checked automatically by our own service on our own servers: the machine-readable zone is read, the faces on the document, selfie and video are compared, and the video is checked to be of a live person. These materials are not shared with third parties for verification.
4.2. An automated check may approve or reject a request without human involvement. You may contest the decision through Support, and an Administrator will then review the request.
5. Who sees your data
5.1. Other users see your name, photo, rating, badges, listings and, in a deal, the truck's location. Your phone number, tax ID and documents are never shown to other users.
5.2. Support staff see deal materials only while a ticket about the deal is open. Identity documents are seen only by an Administrator.
5.3. We share data with providers the Service cannot run without, only to the extent they need:
- Cloudflare (file storage);
- Google — Firebase Cloud Messaging (push), Google Sign-In, Gmail (e-mail delivery);
- Apple (Sign in with Apple, iPhone push);
- WhatsApp (delivery of confirmation codes);
- OctoPay and banks of the Kyrgyz Republic (payments);
- the server hosting provider.
Some of these providers are located outside the Kyrgyz Republic, so data may be transferred abroad. By registering you agree to such transfer.
5.4. We do not sell personal data or share it for third-party advertising. Data is disclosed to authorities only where required by law.
6. Retention
6.1. Account data, verification documents, listings, messages and files are kept while the account exists.
6.2. Location points are deleted 48 hours after a deal is completed or cancelled; in a dispute — after it ends.
6.3. When you delete your account, your profile, contacts, verification documents, listings, messages, notifications, Google and Apple links and files are deleted at once, and your sessions end. Completed deals stay with counterparties without your personal data, marked "User deleted". Payment records and the staff action log are kept in de-identified form as long as required by law and for fraud prevention.
7. Your rights
You may learn what data we process about you, correct it, withdraw consent, delete your account and data, and contest an automated decision. Most actions are available in the app profile; for anything else write to [email protected] — we reply within 30 days.
8. Security
Data travels only over encrypted connections, files are kept in private storage and served through short-lived links after an access check, passwords are stored as hashes, and staff actions are logged.
9. Children
The Service is not intended for persons under 18, and we do not knowingly collect their data.
10. Changes
A new version of this Policy is published in the Service; after material changes it must be accepted at the next sign-in. If the Russian and English versions differ, the Russian version prevails.
11. Contact
[email protected], the "Support" section of the app.