Privacy policy.

About this policy

Octane Auto operates Document Desk at booking.octaneauto.ca for approved staff to send customer documents to selected lender email addresses. This policy covers Document Desk. Other Octane services, Google services, and lenders may have their own privacy policies.

Information we handle

• Staff accounts: verified Google email address, Google account identifier, account-domain verification, assigned role, access status, and sign-in records.
• Submissions and scans: customer names, lender reference numbers, selected recipient addresses, message subjects and text, notes, filenames, and uploaded or scanned files. Files may contain identity, income, or other financial information supplied for the lender.
• Operational records: submission status, timestamps, Gmail message identifiers, scanner routing, and records of staff actions such as sending, viewing, downloading, and administrative changes.
• Connection and security data: essential sign-in cookies and temporary authorization records. Hosting and email providers also process technical connection information, such as IP addresses, to operate and protect their services.

Google permissions

Staff sign-in requests Google identity and email verification. It does not request access to staff inboxes or Google Drive files, and the portal does not receive Google passwords.

Separately, the owner of info@octaneauto.ca authorizes Gmail sending. The portal stores an encrypted authorization token so approved staff can send through that company mailbox without signing into it. This permission sends the reviewed email and attachments; the portal does not request Gmail inbox-reading permission. Replies are handled in the company mailbox.

The portal uses Google account and Gmail API response data to authenticate staff, send requested messages, and record their status. It does not use that data for advertising, sale to data brokers, AI model training, credit scoring, or automated lending decisions.

Document Desk’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Use and sharing

We use information to route scans to the correct staff account, prepare and send requested lender emails, keep submission records, control access, and investigate service or security issues. Staff must have authority to handle the customer’s information and must check the recipient and attachments before sending.

Approved administrators can review the portal archive and activity records. Google Cloud provides hosting and storage, and Google Workspace processes outgoing mail. The selected lender receives the email and attachments and handles its copy under its own practices. Authorized service support may access information when needed to resolve an issue or protect the service. Information may also be disclosed when required by applicable law.

Service providers and recipients may process information outside Canada. This portal does not promise Canada-only storage or processing. Its interface contains no advertising or third-party analytics trackers.

Access and retention

Salespeople can access only records assigned to their account. Incoming scans are available for 24 hours after the portal first receives them. Successfully sent submissions are available for 24 hours after Gmail accepts the message. The portal also limits access to unsuccessful submission records. A shared Sales Team login shares that account’s recent documents and activity history.

The 24-hour limit applies to portal access, not deletion. The current portal has no automatic deletion deadline for its administrative archive. Customer documents, submission history, and activity records remain available to authorized administrators until an authorized retention or deletion action is carried out. Retention and deletion requests need a separate review of business and applicable recordkeeping requirements.

Temporary scanner files are removed after the portal confirms receipt and the files pass cleanup checks. Failed transfers or imports may remain for recovery. Backups and service-provider copies can have separate retention periods. Deleting a portal record does not recall an email or erase copies held by a lender, Gmail, or someone who downloaded it.

Access checks, private document storage, encrypted mailbox authorization, and protected network connections help safeguard information. No service can guarantee absolute security.

Your choices

Contact us to request access to, correction of, or deletion of information held in Document Desk, or to raise a privacy concern. We may need to verify your identity and authority. We will review the request, explain any relevant retention constraints, and identify which records or external copies require a separate request.

Staff can sign out and ask an administrator to disable their portal account. The mailbox owner can revoke the portal’s Google connection through Google Account connections. Revoking access stops future authorized use; it does not delete existing submissions or emails. Contact the administrator to remove stored connection credentials.

The portal uses essential cookies for sign-in and session protection. The normal staff session lasts up to 12 hours; a sign-in attempt expires after 10 minutes. Blocking these cookies prevents sign-in. Document Desk does not use advertising cookies.