Privacy Policy

1. Whose information this covers

• Account users: the owners, office managers and dispatchers who sign in to FileFeed for their company.
• Drivers and other people in a customer’s records: a customer (the trucking company, “Customer”) decides what to store about its drivers. For that information we act as the Customer’s service provider and handle it only on its instructions; see section 5.
• Visitors to our sign-in and registration pages.

2. Information we collect

• Account: your name, work email and password. Passwords are stored only as a one-way hash; nobody at [COMPANY LEGAL NAME] can read them. If you sign in with Google, Apple or Microsoft, we receive your name, email address and an account identifier from that provider, never your password.
• Company profile: legal name, USDOT and MC numbers, address, phone, company email, time zone and how the company operates (interstate or intrastate, for hire or private, hazmat), plus reminder email settings.
• Driver records: names, phone, email, home base and ZIP code, employment type and dates, license class and state, the last four characters of the license number, endorsements, the assigned truck and an optional photo.
• Documents you upload: files and their dates for drivers, vehicles and the company. Driver documents can include licenses, medical certificates, motor vehicle records, drug and alcohol test results, Clearinghouse queries, employment applications and Social Security cards, which are sensitive personal information.
• Fleet records: trucks, trailers, transponders and maintenance, including VINs and plate numbers.
• Billing: when you subscribe, Stripe collects your card details directly; we receive only the subscription status, the card’s brand, last four digits and expiry, and your invoices.
• Technical information: our servers record requests to the Service, such as IP address, browser type, the page or action and the time, to keep it secure and fix problems.

We get this information from you and the other users of your account, from the sign-in provider you choose, from Stripe and from your browser. We don’t buy personal information from anyone.

3. Cookies and browser storage

We use only what the Service needs to work. There are no advertising or analytics cookies.

• Sign-in cookies keep you signed in and renew your session. They can’t be read by scripts on the page, and they end when you sign out or, unless you chose “Keep me signed in”, when you close the browser.
• A short-lived cookie (10 minutes) protects sign-in with Google, Apple or Microsoft while you’re on the provider’s page.
• Your browser’s own storage remembers your light or dark theme, notices you dismissed and whether you ticked “Keep me signed in”. It stays on your device.

Blocking these cookies stops sign-in from working.

Nobody, including us, collects information about your activity over time and across other websites through the Service. Because there is no such tracking and we don’t sell or share personal information, browser “Do Not Track” and Global Privacy Control signals change nothing here.

4. How we use information

• To provide the Service: show records and documents and their status, send the expiration reminders you set up, and build document packages, whose “ready” email links to FileFeed rather than to the file.
• To create and secure accounts, verify email addresses, prevent misuse and investigate problems.
• To bill subscriptions, answer support requests and send notices about the Service or these policies.
• To improve the Service, using aggregated or de-identified information that doesn’t identify a person or a Customer.
• To comply with the law and enforce our Terms.

We use sensitive personal information, such as Social Security numbers and drug and alcohol test results, only to provide the Service and for the other purposes the law allows, never to infer anyone’s characteristics. Because of that, there is no separate request to limit its use.

5. Drivers’ information

The Customer, not [COMPANY LEGAL NAME], decides which driver information to collect and is responsible for giving drivers the notices and obtaining the consents the law requires, including under the Fair Credit Reporting Act and 49 CFR Part 40 where they apply. We use driver information only to provide the Service to that Customer and never contact drivers for our own purposes. A driver who wants to see, correct or delete their information should ask their employer or carrier; if a request reaches us, we pass it on to the Customer.

6. Who we share it with

We share personal information only:

• with service providers who run parts of the Service for us (hosting and file storage, email delivery, payments through Stripe, sign-in through Google, Apple and Microsoft), under contracts that limit their use to providing their service;
• within a Customer’s account: everyone signed in to it sees its records and documents, and reminder and package emails go to the company email and the owner’s sign-in email;
• when the law, a court order or a valid government request requires it, or to protect someone’s safety;
• with a buyer or successor if our business is sold or merged, under this policy’s protections;
• with anyone else only when the Customer asks us to.

We have not sold or shared personal information, as California law defines those terms, in the past 12 months and have no plans to, and we have no actual knowledge of selling or sharing information about anyone under 16. The categories in section 2 are disclosed only to the service providers above, only for the purposes in section 4.

7. How long we keep it

• Records and documents stay as long as the account is open, until the Customer deletes them.
• A deleted document’s file is removed from storage with it.
• Document packages (ZIP files) are deleted 7 days after they’re built.
• Account users’ names, emails and sign-in details stay as long as the account is open.
• Server logs with technical information are deleted after [90] days.
• Invoices and payment records are kept as long as tax and accounting laws require, also after the account is closed.
• After an account is closed, the Customer has [30] days to download its documents; then we delete its information, except what the law requires us to keep, and backups that expire on their normal schedule. Records the Customer must keep itself, such as drug and alcohol testing records, should be downloaded first.

8. How we protect it

Information travels over encrypted connections (HTTPS). Each account sees only its own records, files are opened only through short-lived links, and passwords are hashed. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

9. Your choices and rights

• You can see and correct your account, company and driver information in FileFeed, and delete records and documents there.
• Depending on where you live, including California, Colorado, Virginia and other US states with privacy laws, you may have the right to know what personal information we hold about you, to get a copy, to have it corrected or deleted, and to opt out of its sale or use for targeted advertising (we do neither). Email [PRIVACY CONTACT EMAIL] to make a request. We confirm your identity by asking you to reply from your sign-in email or to answer questions about your account. An authorized agent can make a request for you if they send us your signed permission, and we may still ask you to confirm it. We answer within 45 days; if we need more time, we’ll tell you why within those 45 days and answer within 45 more.
• The account owner can close the account and have its information deleted by emailing [PRIVACY CONTACT EMAIL] from the owner’s sign-in email. Section 7 explains what happens next.
• If we decline a request, we’ll explain why. You can appeal by replying to our answer or by emailing [PRIVACY CONTACT EMAIL] with “Appeal” in the subject. We answer an appeal within 45 days and, if we deny it, tell you how to contact your state’s attorney general.
• We won’t treat you differently for using these rights.

10. Children

The Service is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect information from children; if you believe we have, contact us and we’ll delete it.

11. Where information is processed

We store and process information in the United States.

12. Changes to this policy

We may update this policy. We’ll email the account owner at least 30 days before a material change takes effect. The effective date at the top always shows the current version.

13. Contact

[COMPANY LEGAL NAME], [MAILING ADDRESS]. Privacy questions and requests: [PRIVACY CONTACT EMAIL].