Legal

Privacy Policy

Effective August 14, 2026 · Last updated August 14, 2026

This policy explains what Carmossa Inc. (“Carmossa”, “we”, “us”) collects when you use carmossa.com or the Carmossa apps, why we collect it, who else sees it, and how long we keep it. It is written to be read, not to be survived.

The short version. We collect what it takes to move a vehicle and prove what happened to it: who you are, where the car goes, what the car is, and photo evidence at both ends. Your addresses and contact details go to the carrier hauling your vehicle and nobody else’s. Photos and signatures live in private storage and are kept for seven years, because that is how long a damage dispute can take to surface. We do not sell personal information and we do not run advertising trackers.

Who we are#

Carmossa Inc., Seattle, Washington. Carmossa is a marketplace that connects people and dealerships shipping vehicles with independent, licensed motor carriers. We operate carmossa.com, the Carmossa customer app, the dealer portal, the carrier dashboard and the driver app.

What we collect#

Account information. Your name, email address, phone number and account type (customer, dealership, carrier, driver). Passwords are handled by our authentication provider and stored as hashes — we never see or store the password itself.

Shipment details. Pickup and delivery addresses, which we convert into map coordinates so we can measure real road miles and draw the route; the contact name and phone number for each end of the move; your requested dates; and the vehicle — year, make, model, condition, whether it runs, any modifications, and the VIN if you give it to us.

Photo and signature evidence. At pickup and at delivery, the driver documents the vehicle in a fixed set of photo slots. Those photos carry the time they were taken and, when the device permits it, the location they were taken at. At delivery, the receiving party signs on the driver’s screen. Both are attached to the shipment record.

Pickup code events. Every handoff uses a six-digit, single-use code that expires in ten minutes. The code itself is stored hashed — we keep the record of when it was issued, when it was verified and by whom, not a readable copy of the number.

Carrier and driver business information. For carriers: company details, USDOT and MC numbers, insurance certificates, truck and driver records. We check the DOT and MC numbers against public federal FMCSA records and re-check insurance monthly.

Location, for drivers on a job. The driver app captures location with inspection photos and reports progress along an active shipment. It is tied to jobs, not to the driver’s day — we are not building a movement history of anyone.

Pilot signups and messages. If you join the Seattle pilot or write to us: your name, email, phone, what kind of user you are, the page that referred you, your browser user agent and your IP address. The last three are there to keep bots out of the list.

Device and log data. IP address, browser and device type, timestamps, pages requested, and error logs. Standard server-side records, used to keep the service up and to investigate abuse.

Payments. Carmossa collects a flat deposit at booking. When card payments go live, card details will be entered directly with our payment processor — Carmossa does not store card numbers. The balance of your transport charge is settled directly with the carrier at delivery and does not pass through us at all.

What we do not collect#

We do not sell or rent personal information.
We do not run advertising or behavioural tracking pixels, and we do not build ad profiles.
We do not track customers in the background. Location comes from the driver documenting a job, not from your phone sitting in your pocket.
We do not ask for a Social Security number to ship a vehicle.

Why we use it#

To price a move honestly — real road miles and real curb weight, which needs the addresses and the vehicle.
To run the shipment: dispatch it, keep both sides informed, and get the vehicle to the right person.
To prove what happened. Codes confirm the handoff; photos and signatures settle a damage question with evidence instead of an argument.
To vet and re-vet carriers against federal records and current insurance.
To notify you by text message, push notification and email about the shipment you booked.
To detect and stop fraud, abuse and fake bookings.
To meet legal, tax and transport recordkeeping obligations, and to respond to lawful requests.
To fix bugs and improve the product.

Messages you will get#

Booking a shipment opts you into the messages that shipment needs: text, push and email about pickup, codes, delays and delivery. You can stop text messages by replying STOP, and turn push notifications off in your device settings. Essential email about an active shipment cannot be turned off while the shipment is live — it is part of the service. Marketing email, if we ever send any, has an unsubscribe link and is separate from all of that.

Who sees your information#

The other party to your shipment. The carrier and the assigned driver see the pickup and delivery addresses, the contact names and phone numbers, the vehicle details and your notes. You see the carrier’s identity, its MC and DOT numbers, the truck and the driver assigned. Carriers and drivers only ever see the shipments they are party to.

Service providers who run parts of the system. They get the minimum needed to do their job and are not permitted to use your information for anything else:

Supabase — our database, file storage and authentication, hosted in the United States. This is where shipment records, photos and signatures live.
Map and geocoding providers — OpenStreetMap Nominatim for turning addresses into coordinates, OSRM for road distance and routing, and CARTO for map tiles. They receive the address or coordinates needed to answer the query, not your account.
Message delivery providers — the email, text-message and push services that carry our notifications to you.
A payment processor — when card payments launch, to take the deposit. Card data goes to them, not to us.

Federal carrier records. We look carriers up in the FMCSA’s public databases. That is a one-way lookup — we send a DOT or MC number and read back what is published. No customer information goes to FMCSA.

Legal and safety. We will disclose information when the law requires it — a valid subpoena, court order or lawful request — and when we believe in good faith that it is needed to prevent fraud, injury, theft of a vehicle, or a violation of our Terms of Use.

A change of ownership. If Carmossa is acquired or merges, information may transfer as part of that business. We will say so here before it changes how your information is handled.

Where it lives, and how it is protected#

All data is stored in the United States, in a managed database with row-level access rules — users, carriers and drivers can only read the records they are party to.
Inspection photos and signatures are kept in private storage buckets. There is no public URL for them. Access is granted through short-lived signed links, issued only to people party to that shipment.
Pickup codes are hashed at rest, single-use, and expire in ten minutes.
Traffic is encrypted in transit. Passwords are hashed by our authentication provider.
Access to production data is limited to the people who need it to operate the service.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your information, we will notify you and the appropriate regulators as required by law.

How long we keep it#

Transport records are kept for seven years. That means the shipment record, the pickup and delivery photos, the signature and the code events — kept for seven years from delivery. This is deliberate and it is a feature: a cargo damage claim, an insurance dispute or a title question can surface long after the truck has gone, and the photos are what settles it. We do not delete the evidence early, including at your request.

Account information: for as long as your account is open, and for a reasonable period after you close it so we can meet legal, tax and accounting obligations.
Pilot signup information: until launch, or until you ask us to remove you — whichever comes first.
Server and error logs: a short operational window, then discarded.
Carrier vetting records: for as long as the carrier is on the platform and for seven years after their last completed shipment.

Your choices and your rights#

You can view and correct most of your account and shipment information by signing in. For anything else, write to support@carmossa.com and tell us what you want. You can ask us to:

Give you a copy of the personal information we hold about you.
Correct information that is wrong.
Delete your account and the personal information we are not required to keep.
Stop sending you marketing messages.

We will verify that the request is really coming from you before we act on it, and we will answer within the time the law allows. Depending on where you live — Washington, California and several other states have their own privacy statutes — you may also have the right to know what is collected, to opt out of any sale or sharing (we do neither), and to not be treated differently for exercising these rights.

One honest limit. Deleting an account does not delete a completed shipment’s transport record. The photos, signature and code events stay for the seven years described above, because they are the carrier’s evidence as much as yours and there are recordkeeping rules attached to them.

Cookies#

We use cookies to keep you signed in and to keep the session secure. That is it — no advertising cookies, no cross-site trackers, nothing sold to a data broker. Blocking cookies will stop you from staying signed in.

Children#

Carmossa is not directed at children. You must be 18 or older to create an account, book a shipment or drive on the platform. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it. Write to support@carmossa.com if you believe a minor has given us information.

Changes to this policy#

When this policy changes we update the date at the top of the page. If a change materially affects how we handle your information, we will tell you — by email or in the app — before it takes effect.

Contact#

Carmossa Inc.
Seattle, Washington, United States
support@carmossa.com