Last updated: October 26, 2026
Account information you provide (name, email, organization name), business data you enter or import (suppliers, products, purchase orders, inventory, demand records), and usage data generated by the Service (audit logs, agent run history), and technical data about how the Service is used and where it fails (see Sentry in section 3). If you turn on text-message approvals, we also store your mobile number, when you verified it and agreed to receive texts, and a record of each text we send you (the number, when it was sent and whether it was delivered, but not its wording). Business data includes details of people at your suppliers — names, email addresses and phone numbers you or the agent enter, what they do in the supplier portal (including the name and IP address given when accepting an agreement), and, if you use voice calls, recordings and transcripts of those calls. If you subscribe to a paid plan, we also store your plan tier, subscription status, and identifiers assigned by our payment processor, Stripe — we do not receive or store your card number; Stripe collects and stores that directly.
If you sign in with Google or Microsoft, we keep that provider’s identifier for your account (for Microsoft, the tenant and object ids) so we can recognise the account when you come back, and we delete it when your user is deleted.
To operate the Service, including running the AI agent against your data, sending notifications you’ve configured (e.g. email digests), and maintaining an audit trail of actions taken in your organization.
All Service data is stored and processed on our behalf by our hosting provider, Vercel, and our database provider, Neon. Beyond them, we share data with third-party providers only as needed to perform actions you’ve configured. The relevant business data (not your full database — only what a given proposal or action needs) goes to: Anthropic, to run the agent’s reasoning over your suppliers, inventory, and orders; Stripe, to process subscription payments if you’re on a paid plan; and, only if you’ve connected them, Shippo (shipment tracking), Vapi (AI voice calls to suppliers: every call opens by saying that the caller is an AI assistant and that the call is recorded and transcribed), Resend (transactional email), Twilio (if you turn on text-message approvals, it receives your mobile number and each text we send you; mobile numbers and consent to receive texts are never shared with anyone for their marketing), Intuit QuickBooks (if you connect it, we read your vendors, items and chart of accounts to link them to your suppliers and products, and we create purchase orders and bills there for orders you send and invoices you approve; we never record a payment; disconnecting revokes our access at Intuit and stops all sending), Shopify (if you connect a store, we read its products, costs, locations and recent orders’ line items — SKU, quantity, date and the location that fulfilled them — to build demand history, and when you receive a purchase order we add the received quantity to that location’s stock in Shopify; we don’t read its customers’ names, addresses or contact details), and Google or Microsoft (single sign-on, if you use it to log in).
If you uninstall the Shopify app, we stop using your store’s access at once. About two days later Shopify tells us to erase the store’s data, and we then delete the sales demand we built from its orders and the record of the connection. Products, stock levels, warehouses and suppliers that were created or filled in from the store stay with the rest of your organization’s data, as they belong to your catalogue and your purchase orders refer to them; deleting your organization removes them.
A few providers handle data whether or not you have connected anything. Sentry receives error reports, performance traces and the log lines recorded around an error, so we can find and fix faults. In your browser it also records how our pages are used (a “session replay”) for about one visit in ten and for every visit in which an error happens, except a visit that starts on a page opened from an emailed link that carries a secret. By default a replay hides all text and everything typed into a form and blocks images and media, but it can still show which pages were opened and what was clicked. Secrets in links and email addresses are removed from error reports, traces and log lines before they are sent. Cloudflare runs Turnstile, a check on the sign-up form that tells people from bots, where we have it switched on: Cloudflare receives the visitor’s IP address and browser details, and we send it the token the check produced, with the IP address, to confirm it. ImprovMX forwards email sent to our support address to our own inbox, so it handles the messages you send us there. Slack is not something you connect: we use our own Slack workspace for notifications about our own organization and for enquiries you send us, and your organization’s proposals and digests are not posted to it. We do not sell your data.
If you publish a listing on the cross-organization marketplace, its public fields — title, description, category, list price, minimum order quantity, lead time, and your seller display name — are visible to other organizations using the Service. Your private reserve (floor) price is never shown to a buyer. This is the one place in the Service where an organization’s data is deliberately visible to another organization; every other query is scoped to your own organization only.
We retain your organization’s data for as long as your account is active, plus a reasonable period afterward for backups and legal compliance, unless you request deletion sooner. The step-by-step record of an AI review (what the assistant read and wrote while working) is cleared about eighteen months after the review; its date, outcome, usage and any proposals it made are kept. Supplier call transcripts, summaries and links to recordings are kept with the rest of your organization’s data and deleted with it. The recordings and transcripts are also held by Vapi, our call provider, under its own retention settings. When you delete your organization or erase a supplier contact, we ask Vapi to delete each of those calls: the request is queued together with the deletion, and we repeat it for about five days if Vapi is unavailable or refuses it (if Vapi has still not confirmed by then we are alerted and follow it up by hand). Vapi confirms by answering our request successfully; we cannot see inside its systems, so copies in its own backups are outside what we can promise. To have one recording deleted without erasing anything else, email support@ecaravan.org with the supplier and the date of the call, and we will delete it from our call provider’s account. Records of texts we sent are deleted after about thirteen months, and records of replies after 30 days; replying STOP stops all texts to that number. The one thing we keep after you stop, or after your organization is deleted, is a minimal record that you agreed to texts: a scrambled fingerprint of the number (made with a secret key, so the database alone cannot reveal the number), the time you agreed, which version of the wording you saw, and the time texts stopped. It has no name and no organization. We keep it for four years after texts stop, because that is how long someone can bring a claim about text messages in the United States and it is the only way we could show that you agreed. Enterprise enquiries sent from inside an account are deleted with the organization; one sent from the public pricing page (a name, work email, company and message) is kept as a sales enquiry until you ask us to delete it. What we read from QuickBooks (your chart of accounts, the links between your suppliers and products and its vendors and items, and your company’s name and currency) is deleted 30 days after QuickBooks is disconnected or stops accepting our access, or at once if you choose “Disconnect and delete QuickBooks data” in Settings.
You may request access to, correction of, or deletion of your personal data, subject to applicable law. An admin can download all of your organization’s data as one JSON file from Settings (it leaves out passwords, keys and other credentials); suppliers, products, inventory, purchase orders and the audit log also export to CSV from their own pages. A supplier contact’s name, email and phone can be erased from a supplier’s page, which also removes them from the emails, call records, proposals and audit entries in our own records that mention them. Signed supplier agreements keep the signer’s name and IP address, as the record that the agreement was accepted. When a member is removed from an organization, or deletes their own account, the audit entry records only their role and a shortened form of their email address (such as j***@acme.com). Erasing a contact, or deleting your organization from Settings (which permanently removes its data from our database), does not reach the copies held by the other providers in section 3, which keep them under their own retention. The exception is call recordings and transcripts: we ask Vapi to delete those (see section 5). Contact us using the details below for anything that self-service doesn’t cover.
Some people deal with Caravan only because a company that uses it entered their details, or invited them into its supplier portal, for example a salesperson at a supplier. If that is you, this is what applies. Caravan runs the software and the portal for that company and acts on its behalf; the company decides what to ask of you and is the first person to ask about your details. Using the portal is under our terms of service, which you are not asked to tick: there is no account, only an emailed sign-in link.
Where your details come from. From the company that entered them (your name, email address, phone number and role at the supplier), and from you when you type your name, prices or terms into the portal. What we hold. Those contact details; what you do in the portal (orders you confirm, quotes and invoices you send, prices, lead times and terms you enter, agreements you accept, with the name you typed, the time and your IP address); the emails we send you for the company; and, if the company’s AI assistant phones you, the recording and transcript of the call, which the assistant tells you about as it begins. When you ask for a sign-in link, the address you typed and your IP address sit in a rate-limit counter for about an hour; the link itself is deleted 30 days after it expires, and a sign-in lasts seven days. Why. So the company can run its purchasing with you, and keep a record of what was agreed. Who sees it. The company, and the providers in section 3 only as far as they are needed to host the portal, send you email and make calls. We do not sell it.
How long, and your choices. Your details stay for as long as the company keeps them (section 5). You can ask the company, or us at support@ecaravan.org, to show you, correct or erase them; erasing a contact removes your name, email and phone from our records of the emails, calls, proposals and audit entries that mention them, and asks Vapi to delete the recordings (section 6). A signed agreement keeps the signer’s name and IP address as the record that it was accepted.
Data is encrypted at rest and all traffic is served over TLS. Optional two-factor authentication and role-based access control are available on every account, and every create, update, approval, and rejection is written to an append-only audit log (the one exception: erasing a supplier contact also removes their details from past entries). We use reasonable technical and organizational measures to protect your data, but no method of transmission or storage is completely secure, and the Service is not currently SOC 2 certified or ISO 27001 compliant.
The Service is a business tool and is not directed at, or knowingly used to collect information from, anyone under 18.
We may update this Privacy Policy from time to time. We’ll indicate the date of the most recent revision above.
Questions about this policy: support@ecaravan.org.
Intuit and QuickBooks are registered trademarks of Intuit Inc. Used with permission.
← Back to sign up