Privacy Policy

This notice explains what Carva handles, why, where it goes, and the choices available to you. Carva stores core records on your phone and may also send specific information online when you sign in or use an online feature.

Who is responsible for your information. Carva, P.O. Box 1483-00100, Nairobi, Kenya, is the controller for the information described in this notice. Reach us at privacy@getcarva.com or the postal address above for anything about what Carva stores, how it is used, or a request under Kenya's Data Protection Act, 2019.

Information Carva handles

Account and device information. Email address, sign-in identifiers, app version, device and crash information, permissions, and settings.

Vehicle records. Vehicle identity, registration details you enter, odometer readings, services, expenses, fuel records, parking records, documents, photos, diagnostic readings, and notes.

Location and motion. Location fixes, recorded trip routes, speed and motion-derived driving information, saved parking positions, fuel-station arrivals, and any live location you deliberately share.

Community and communications. Road-trip and club memberships, chosen display details, text chat, short voice notes, check-ins, alerts, shared vehicle summaries, and community contributions you opt into.

How Carva uses it

Carva uses this information to provide the features you request, calculate and organize vehicle records, restore signed-in accounts, keep shared groups working, prevent abuse, diagnose failures, protect the service, meet legal duties, and answer support or privacy requests. Optional community contributions stay off until you switch them on.

On-device and online processing

Core records are first stored on your device. Text recognition for document, odometer and dashboard scans runs on-device. If you sign in and backup is available, supported records and media may be copied to account-protected cloud storage. Carva AI and online verification can send the prompt, relevant vehicle context, and an image or audio sample you submit to an online AI service; the feature should show this before sending.

Road-trip and club members see the profile and vehicle label you choose for that group. Live location is shared only while its control is on. Family & Friends receives only the sections and people you select. A number plate is shared with a road trip only if you deliberately choose plate display.

Service providers

Carva uses Google Firebase services for sign-in, protected cloud records and files, app integrity checks, server functions, crash reporting, notifications, and online AI; Google Maps and Places for places and route context; Mapbox for maps, routes and map matching; Apple and Google for app distribution, sign-in or purchases where selected; RevenueCat for subscription status when paid plans are enabled; and Safaricom for an M-Pesa transaction you start. LiveKit is not active in the released voice-note feature.

These providers process only the information needed for their part of the service and may process it outside Kenya under their own security and data-transfer safeguards. Carva does not sell personal information.

Retention and security

Local records remain until you delete them, clear the app, or uninstall it. Account backups remain while the account or record exists and until deletion is completed. Road-trip voice notes expire after 24 hours or when the trip ends, whichever comes first. Expired road-hazard reports and their restricted audit records are removed on a rolling 30-day schedule. Some information may be kept longer where law, fraud prevention, payment reconciliation, or a dispute requires it.

Carva uses account access controls, app integrity checks, restricted server operations, and encrypted network connections. No system is completely secure; contact security@getcarva.com to report a concern.

Your rights

You can review and correct records in the app and export the account-owned data held on your device, including readable local media. You may ask for access, correction, objection, restriction, portability where applicable, or deletion by writing to privacy@getcarva.com. Self-service account deletion is temporarily unavailable until the server can verify and complete every deletion safely; see how to request deletion.

You may also complain to the Office of the Data Protection Commissioner in Kenya. Carva may need to verify your identity before acting on a request.

Children and changes

Carva is not intended for children under 18. If we learn that a child provided personal information, contact us so it can be removed. Material changes to this notice will be shown in the app or on this page with a new effective date.

Contact

Questions about your data, or to make a request: privacy@getcarva.com