Privacy Policy - KAR App

Effective date: September 2, 2026

Company: KAR Holdings Ltd.

Overview

KAR App is an internal application designed exclusively for authorized KAR Group staff to view operational reports, update fuel pricing, complete site and QSR visit reviews, and read standard operating procedures. All users are employees who authenticate using their existing KAR Group credentials.

KAR App collects only the information needed to operate. Most data stays within KAR Group’s infrastructure. The one exception is the price-sign scanning feature, which sends the photo you capture to a third-party vision service for the sole purpose of reading the prices off the sign. This is described in detail below.

Authentication

Users authenticate using their existing KAR Group employee accounts.
These credentials are already established through KAR Group’s other company software systems.
Authentication is handled securely between the user’s device and KAR Group’s backend servers.
Session tokens are generated to maintain secure, authorized access to the app.

Information We Collect

KAR App collects the minimal information necessary to operate:

1) Authentication Information

Employee username and authentication token, used for API authorization.
These are generated during login using your existing KAR Group account credentials.

2) Operational Data You View

Fuel and convenience store sales figures
Operational targets and performance data
Grading, mystery shop, and analytics data
Standard operating procedure documents

3) Data You Submit

Price survey entries, including the fuel prices and the date and time you record
Site visit and QSR visit review answers, including any photos you choose to attach
Feedback and issue reports you send from the Profile tab

Some submissions are saved on your device first so they are not lost if you are offline, and they are sent to KAR Group’s backend automatically once you reconnect.

4) Photos

Photos you capture or select for price scanning
Photos you attach to a site or QSR visit review

5) Technical Information

Device and app identifiers necessary to maintain secure sessions
Request timestamps for security and logging purposes

Price-Sign Scanning and Third-Party Processing

When you add a photo on the price update screen, KAR App sends that image to a third-party vision service to read the prices on the sign and fill them in for you. This processing:

Is used only to extract the fuel prices from the image.
Sends only the photo you provided for the scan, not your other personal data.
Is initiated by you each time you choose to scan a photo.

You can always review and correct any scanned values before submitting.

Photo checks and the survey log

Photo origin check. When you pick a survey photo from your gallery, the app reads the photo’s embedded metadata (the camera make and model and the capture time) on your device to judge whether it is a fresh camera photo, an older one, or a screenshot or forwarded image. Nothing is shown to you and nothing is blocked. If the photo is judged to be a screenshot, an automated text message naming the site and the survey is sent to the KAR Group survey administrator. The metadata itself is not uploaded; the photo sent for scanning is re-encoded without it.
Three-day survey log. Each completed price survey (site, prices, time, photo count) and its photos are also kept for three days on KAR Group’s cloud account, separately from the backend, so that an automated end-of-day text message can tell the survey administrator which sites filed a survey that day and which did not. Both the log rows and the photos are deleted automatically after three days. Links to that day’s photos are signed and expire on the same schedule.
Home-screen widgets. If you add a KAR App widget, a snapshot of the figures it shows is stored on your device in the app’s shared storage. It is never sent anywhere and is cleared when you log out.

How We Use Information

Information is used solely for:

Authenticating users with their existing KAR Group credentials
Delivering core app functionality, including reports, price surveys, reviews, SOPs, and analytics
Reading prices from photos you submit for scanning
Maintaining system security and preventing unauthorized access
Complying with legal and regulatory requirements

Data Storage and Processing

Operational data and the entries you submit are processed and stored on KAR Group’s backend infrastructure.
Photos submitted for price scanning are processed by the third-party vision service for the purpose of reading the sign, as described above.
Some submissions are stored temporarily on your device until they can be synced to the backend.

We do not sell or rent your information, and we do not use it for marketing or advertising. Information is shared only as needed to operate the app:

Within KAR Group, data is accessible only to authorized personnel and departments.
Photos you submit for price scanning are processed by the third-party vision service solely to read the prices on the sign.
The automated survey texts described above are delivered through a third-party SMS provider and contain site names and survey status only, never your password or credentials.

Data Retention

Information is retained only as long as necessary:

Authentication tokens: Retained during active sessions and cleared upon logout.
Submissions (price surveys, reviews, feedback): Retained per KAR Group’s business records retention policy.
Survey log and its photos: Deleted automatically three days after the survey.
Server logs: Retained for security and troubleshooting purposes.
Account information: Retained during employment and per company policy after termination.

Your Rights and Choices

As an authorized KAR Group employee, you have the right to:

Access: Request access to your data by contacting your administrator.
Correction: Request correction of inaccurate information.
Deletion: Request deletion of your data, subject to legal retention requirements.
Contact: Submit requests to humza@karholdings.ca.

Security

KAR App implements the following security measures:

Secure Authentication: Uses established KAR Group credentials and session tokens.
Encrypted Communication: All data transmission uses HTTPS/TLS encryption.
Access Controls: Role-based permissions ensure users only access authorized data.
Secure Backend: Core data is stored on KAR Group’s infrastructure.

Children’s Privacy

KAR App is intended exclusively for authorized KAR Group employees and is not directed to individuals under 13. We do not knowingly provide access to children.

Data Breach Notification

In the event of a data breach affecting personal information, KAR Group will notify affected individuals in accordance with applicable legal requirements and company policy.

Changes to This Policy

We may update this privacy policy at any time. We will update the effective date above and notify users of material changes via email or in-app notification.

Contact Us

For privacy questions, concerns, or requests:

Email: humza@karholdings.ca
Contact: Humza Aziz

Last Updated: September 2, 2026