Privacy Notice
Effective Date: August 7, 2026
Last Updated: August 20, 2026
This notice describes the implemented data practices of D&S Portfolio Group Inc. for PRAEVIS AI™. The public demonstration uses controlled sample information. The authenticated PRAEVIS AI application may process real information supplied by an authorized user.
Information PRAEVIS AI May Process
When a user chooses an applicable reporting function, incident information may include reporter and contact information; incident date, time and location; precise device location; vehicle, tractor, trailer, plate and VIN information; insurance information; police information; witness identity, contact information and statements; photographs, documents, audio and video evidence; reporter statements and narratives; injury or illness information, including reporter-confirmed body locations selected or confirmed on the visual injury map; cargo, property and environmental information; AI-assisted review results; electronic certification/signature information; and report exports.
Account and administration information may include identity account information, access requests, organization or Fleet information, roles, entitlements, expiration information, EULA acceptance, registered-device identifiers, invitation status, two-step-verification status, security/audit information, organization report-branding settings such as a company display name or logo, and technical information needed to operate and protect the service.
Users may choose to maintain a persistent customer profile containing saved vehicle and insurance information. Fleet administrators may maintain corresponding organization-level vehicle and insurance profile information. Saved profile information is separate from temporary incident-report working data and remains editable by the authorized account holder or Fleet administrator.
If a user chooses Photo-to-Profile, a supported insurance, registration or vehicle-document image may be sent for one-time AI extraction. The profile-extraction function does not store the source profile image in PRAEVIS temporary evidence object storage or persistent customer-profile tables. Extracted values remain subject to user review. Only information the user confirms and saves becomes persistent profile data.
For Fleet customers, commercial records may include organization billing contacts, plan and seat information, subscription status, provider customer/subscription identifiers, invoices or billing events, and related audit records. PRAEVIS does not store raw payment-card numbers or CVV values; payment-card entry is handled by the payment provider.
Two-Step Verification and Account Security
PRAEVIS may offer or require authenticator-app two-step verification depending on the account role. A two-step-verification enrollment uses a TOTP authenticator secret. The server encrypts that secret before storage. One-time recovery codes are stored only as cryptographic hashes after they are initially shown to the user.
Two-step verification is enforced by the protected PRAEVIS server authorization layer for accounts that enable it and for privileged roles when mandatory enforcement is configured. Verification status may be associated with a registered PRAEVIS device for a bounded period. Signing in again with the account password requires the second factor again for an MFA-enabled account.
Visual Injury Map
When an injury-reporting workflow is used, PRAEVIS may display front and back body diagrams so the reporter can identify a reported injury location. If the reporter directly names a supported body area, PRAEVIS may pre-highlight that area for review. A suggested or selected location does not become a confirmed body-map record until the reporter confirms it.
The visual injury map documents reporter-provided or reporter-confirmed information. PRAEVIS does not use the body map to diagnose an injury, determine medical causation, or infer an injury or medical condition from a photograph.
Local Device Storage
PRAEVIS AI may keep an active recovery draft on the user’s device so a report can recover from interruption or temporary loss of connectivity. The web/PWA implementation encrypts the local draft before writing it to browser storage. Clearing the draft, deleting the account, clearing application data, or removing relevant device storage can make that local recovery draft unavailable.
The packaged mobile application uses local application assets and connects to the PRAEVIS secure backend for authenticated services. Provider, payment, integration and MFA master secrets are not intended to be embedded in the Android, iOS or web application package.
Temporary Server-Side Incident Session
PRAEVIS AI is designed as a temporary incident-reporting system rather than a permanent incident-document repository. Temporary report content, AI results and evidence are held only for the active reporting/recovery lifecycle.
Confidential temporary report-state content is stored in private object storage with integrity metadata rather than being intentionally retained as report payload in long-term relational database backups. The relational database retains account, ownership, lifecycle and other operational metadata needed to authorize and manage the temporary report. Temporary evidence uses private object storage and server-controlled object identifiers.
Active working report sessions normally expire after a short period while permitting authorized activity to extend an unfinished report within configured limits. After a report is successfully exported, the current production design begins one 72-hour recovery window. Re-exporting does not restart the recovery period. A user may request earlier deletion instead of waiting for expiration.
Automated cleanup removes expired temporary report state and associated evidence, retries failed deletion work, and uses aggregate operational health information rather than incident content for cleanup monitoring. The 72-hour recovery rule applies to temporary incident-report content and does not automatically delete vehicle, insurance or reminder information that a user intentionally saves in a persistent customer or organization profile.
Photographs, Documents, Audio and Video Evidence
Supported evidence may include photographs, documents, temporary audio and supported video formats. Evidence is accessible only through protected PRAEVIS operations rather than public object-storage links.
PRAEVIS applies server-side file-type, file-signature, size, report-capacity and ownership checks. Larger files may be uploaded in authenticated bounded chunks. PRAEVIS computes cryptographic integrity values for accepted evidence, including whole-file SHA-256 values for supported large evidence. Video and audio may be referenced in a signed report’s evidence inventory without embedding the complete media file into the PDF.
AI and Cloud Processing
Cloud processing is used only for supported PRAEVIS AI functions and where the application requires the reporter’s processing choice. Depending on the selected feature, information may be processed for unified interview assistance, factual narrative preparation, document extraction, speech transcription, evidence analysis, preliminary damage triage, completeness/consistency review, illustrative reconstruction, customer-profile document extraction, or user-started conversational voice guidance.
PRAEVIS AI uses OpenAI services through protected server-controlled integration points. PRAEVIS centrally configures supported Responses API calls not to create application-state storage and does not use background Responses processing for incident data. Provider-side abuse-monitoring or other provider retention is governed by the applicable provider configuration and terms; PRAEVIS will not represent application-level store:false as equivalent to provider Zero Data Retention unless the relevant OpenAI organization/project has that retention configuration.
AI-generated or AI-extracted information remains subject to PRAEVIS confirmation and truth controls. PRAEVIS is designed not to convert missing information into facts and not to make final determinations of fault, liability, exact speed, medical diagnosis or causation, insurance coverage, final repair cost, or legal conclusions.
Conversational Voice
When an authorized user actively chooses Talk to PRAEVIS, the application may establish a server-authorized WebRTC session with OpenAI Realtime. Microphone audio is transmitted for the requested speech-to-speech processing so PRAEVIS can listen, respond aloud, allow ordinary conversational turn-taking and interruption, and propose report facts from the user’s own spoken words.
The live microphone stream is not written to the PRAEVIS application database or temporary evidence object storage merely because conversational voice is active. Realtime transcription and assistant text may be displayed in the active application session. Facts proposed from voice remain provisional until the reporter confirms them.
Conversational voice is not an always-listening feature. Microphone capture begins only after the user starts the voice function and the device grants permission. Choosing End Voice, closing the connection, or ending the application session stops the application’s active microphone tracks. Realtime provider credentials are not exposed in browser or mobile application code.
Camera, Microphone and Location
Camera permission is requested when a user chooses camera functionality. Microphone permission is requested when the user chooses speech functionality. Precise-location permission is requested only when the user enables a location-supported function. Manual alternatives remain available where supported.
When location-supported context is requested with processing consent, coordinates may be used server-side to resolve a location, retrieve historical weather context, or suggest likely law-enforcement agencies. Current context services include Open-Meteo and OpenStreetMap-based services. Suggested contextual information requires user review and confirmation.
Insurance Expiration Reminders
When enabled by the account holder or Fleet administrator, PRAEVIS may use a saved policy expiration date and reminder email address to send administrative reminders before the saved expiration date. These reminders are convenience notifications only. PRAEVIS does not renew, bind, verify, cancel, modify or determine the validity of insurance coverage.
Service Providers
Netlify services are used for hosting, serverless functions, identity/authorization, managed database services, temporary object storage, forms, deployment and related infrastructure. OpenAI services are used for supported AI processing and supported Realtime voice. Stripe is used for supported Fleet subscription and billing functions. Open-Meteo and OpenStreetMap-based services are used for optional location-related context. Approved email/delivery providers may process information when the user invokes a supported delivery function.
Provider availability and technical routing may change as PRAEVIS is maintained. This notice should be updated before a material production data-flow change is released broadly.
Fleet Billing
Fleet service is purchased and managed through PRAEVIS web billing. Store-delivered Android/iOS applications may recognize an already-paid Fleet entitlement but are not intended to initiate Stripe checkout, purchased-seat changes or external billing-management sessions from inside the mobile application.
Sharing, Fleet Administration and Partner Integrations
PRAEVIS AI does not currently submit an incident report automatically to police, insurers, employers, government agencies or attorneys. A user may choose to download, print, email or otherwise share a completed report.
Fleet Administration is currently an access, seat, billing, company-profile and report-branding console. Merely being a Fleet administrator does not provide that administrator with another user’s temporary incident report, photographs, narrative, body-map record or evidence through the Fleet Administration interface. A Fleet administrator may manage organization-level vehicle and insurance profile information and organization-controlled report presentation settings intended for authorized Fleet reports.
Direct insurer/claims and TMS connections remain planned integration capabilities unless a specific integration is separately implemented and identified as active. PRAEVIS includes a separate versioned API foundation for future approved partner integrations. Partner service credentials are organization-scoped, limited by explicit scopes, expiring/revocable, and stored as hashes after one-time display. The current integration capability endpoint does not return report or evidence data and is not a browser or mobile store for partner API keys, OAuth tokens or client secrets.
Retention and Deletion
Temporary incident-report content is governed by the report lifecycle described above. Account, entitlement, organization, billing, agreement, administration, security, integration, and intentionally saved customer-profile records may persist while needed to operate the account, protect the service, complete transactions, maintain audit/security integrity, or meet applicable legal obligations.
Users can initiate account deletion inside PRAEVIS AI. Users who no longer have the app installed can use the standalone PRAEVIS AI Account & Data Deletion page. Account deletion removes applicable active PRAEVIS access, registered devices, invitations, entitlements, saved personal customer-profile information, and temporary incident sessions and evidence associated with that account, subject to limited records that may need to remain for security, transaction integrity, legal obligations or proof of deletion.
Organization-level profile, billing, integration and branding information belongs to the organization account rather than an individual Fleet administrator and may remain while that organization account remains active.
Security
D&S Portfolio Group Inc. uses layered administrative and technical safeguards appropriate to the implemented service, including authenticated access, role/organization controls, registered-device controls, server-enforced optional or mandatory two-step verification, request-origin protections, server-side provider credentials, bounded temporary evidence storage, cryptographic integrity checks, protected local recovery drafts, security/audit records, dependency and secret-leak monitoring, and controlled release testing. No internet service or end-user device environment can guarantee absolute security.
Privacy Choices and Rights
Where applicable, a person may request access, correction, deletion, a copy or portability, or other rights provided by law. Account holders can edit saved profile information and can use the account deletion resource. Identity verification may be required before acting on a request.
Updates
This notice may be updated as PRAEVIS AI changes. The displayed Last Updated date identifies the current version. Material changes to implemented processing, security or retention practices should be reflected here before the affected feature is released broadly.