Privacy Policy

1. Our Two Roles: Controller and Processor

How we handle information depends on the context in which we receive it.

When we act as a controller. For information about website visitors, waitlist registrants, prospective customers, account owners, and job applicants, we determine how and why the information is used, and this Privacy Policy governs that use.

When we act as a processor (service provider). Our customers — the carriers, owner-operators, and other transportation businesses that subscribe to the Services — use the Services to run their businesses. In doing so, information about their drivers, employees, contractors, brokers, and business partners ("Customer Data") is submitted to the Services. For Customer Data, the subscribing customer is the controller and is solely responsible for the lawful basis, notices, and consents required for that data, as set out in the Terms. We process Customer Data to provide the Services and on our customers' instructions.

Some information is submitted directly by the individual it concerns — for example, when a driver uploads their own license or medical card through the app or website. In those cases we collect the information directly from the individual and also make it available within the associated carrier's account. If you are a driver, broker, or other individual whose information is managed by a carrier, direct privacy requests to that carrier, which is the controller; we will provide reasonable assistance to that carrier as described in Section 14.

VirtueTMS is a software provider. We are not the employer of any driver, contractor, or other individual whose information is processed through the Services, and we do not control the employment or engagement relationships between our customers and their drivers or personnel.

2. Information We Collect

Information you provide directly

• Waitlist and marketing. Your name, email address, phone number, USDOT number, and any message you send. If you consent to be contacted by phone or text, we also record that consent and its timestamp.
• Account information. Your name, business name, business structure, operating authority or USDOT number, email, phone number, and authentication credentials.
• Driver documents. When a driver uploads a commercial driver's license (CDL), medical certification card, or similar document, we collect the document image and the information contained in it, which may include a license number and medical-certification status. These are treated as sensitive information (see Sections 5, 11, and 12).
• Billing information. Subscription payments are processed by Stripe. We do not store full card numbers; we receive limited billing metadata (such as card brand, last four digits, and billing status) from Stripe.
• Communications. Support requests, feedback, and your messaging and marketing preferences.
• Job applications. The information in your application and resume, if you apply for a role with us.

Information collected automatically

• Log and usage data. IP address, browser and device type, operating system, access times, referring pages, in-app activity, authentication events, and record and document activity. This information is used for security, fraud prevention, troubleshooting, capacity planning, billing verification, and improving the Services.
• Location data. Location data is used to support dispatch, routing, and shipment tracking. Consent for this processing is provided when you agree to our Terms of Service, and location must be enabled for drivers to use the mobile app and its core features. We generate route and mileage information from load entries using our mapping provider (see Section 8). We do not provide GPS or telematics hardware or services; where a customer connects a telematics or GPS device or service, that provider is chosen and paid for by the customer, and its data is handled as described in Section 8.
• Cookies and similar technologies. See Section 9.

Information from other sources

• Connected accounts. If you connect QuickBooks, we access the accounting data you authorize through that integration to enable invoicing and syncing.
• Regulatory lookups. We query public carrier databases (such as the FMCSA / SAFER system) to retrieve and verify DOT and authority information. Information obtained from public regulatory databases may not always be current or complete.

3. Carrier and Driver Information

Because the Services are a transportation management system, we may process information relating to drivers, contractors, owner-operators, vehicles, equipment, shipments, loads, safety events, and regulatory compliance records. This information is generally submitted by our customers or their drivers and is processed on the customer's behalf to operate the Services, as described in Section 1.

4. Document Uploads and Optical Character Recognition

The Services let users upload documents such as CDLs, medical cards, rate confirmations, and bills of lading. To extract data from these documents, we transmit them to Google Cloud, which performs optical character recognition and AI-assisted field extraction. We use this processing only to populate records within the Services. Uploaded documents and extracted fields may be routed for human review before being written to live records. We do not use images taken from uploaded documents as biometric identifiers.

5. Artificial Intelligence and Model Improvement

We use automated technologies, including artificial intelligence and machine learning, to assist with document processing, field extraction, workflow automation, and improving the Services, with human oversight where appropriate. We may also use certain data to train and improve our models and to build and maintain business directories (for example, of brokers and other transportation businesses). Business and entity contact information is treated as business information rather than personal information. We do not use sensitive personal information to infer characteristics about individuals. The complete terms governing model training, aggregated data, and business directories, including any choices available to customers, are set out in our Terms of Service.

6. How We Use Information

• To provide, operate, secure, and support the Services, including creating accounts, verifying business and operating-authority information, processing payments, and delivering features you request.
• To process uploaded documents and generate invoices, settlements, and shipment records.
• To communicate with you about your account, transactions, and support requests.
• To send marketing communications, from which you may opt out at any time.
• To analyze usage and improve the Services.
• To detect, prevent, and investigate fraud, abuse, and security incidents, and to comply with law and enforce our agreements.

We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement.

7. How We Do Not Use Information

We do not sell your personal information, and we do not use it for advertising or cross-context behavioral tracking.

8. How We Share Information

We share information with the following categories of recipients:

• Service providers / sub-processors who support the Services, limited to what they need to perform their function. Our current sub-processors include:
• Amazon Web Services — application hosting and document/file storage
• Railway — application hosting and deployment infrastructure
• Google Cloud — document data extraction (optical character recognition and AI-assisted field extraction)
• Stripe — payment processing
• Twilio — SMS and voice messaging
• Intuit QuickBooks — accounting and invoicing integration (where connected)
• Trimble Maps — mapping, routing, and mileage
• PubNub — in-app messaging
• Vercel — marketing website hosting
• Google — waitlist and lead storage

This list is provided for information only and is current as of the date above. We may add, remove, or replace service providers at any time, in our discretion, without notice.

• Customer-connected integrations. Where a customer connects a third-party service — such as a GPS/telematics provider the customer chooses and pays for, or an accounting integration — data is transmitted to that provider and is then handled under that provider's own terms and security practices, over which we have no control.
• Our customers, where you are a user acting under a customer's account.
• Counterparties, where a customer directs the Services to share load, tracking, document, or contact information with brokers, shippers, consignees, factoring providers, insurers, or similar parties through the Platform's features.
• Professional advisors and authorities, where required to comply with law or legal process, or to protect rights, safety, and the integrity of the Services.
• In a business transfer, such as a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
• With your consent, for any other disclosed purpose.

9. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and secure the Services. We do not use cookies or similar technologies for advertising or cross-context behavioral tracking. Most browsers let you refuse or delete cookies, though some features may not function properly if you do.

10. SMS / Text Messaging

If you opt in, we may send you account, transactional, or marketing text messages at the number you provide. Message and data rates may apply. You can opt out at any time by replying STOP, or reply HELP for assistance. Consent to receive marketing texts is not a condition of purchase. We record the consent you provide and its timestamp. We do not share your mobile opt-in or text-messaging consent with third parties for their own marketing purposes.

11. Data Security

We maintain administrative, technical, and physical safeguards designed to protect Customer Data within our hosted environment against unauthorized access, use, disclosure, alteration, and destruction, appropriate to the size and complexity of our business and the sensitivity of the data. These measures currently include:

• encryption of data in transit and at rest;
• role-based access controls that limit access to sensitive documents, such as CDLs and medical cards, to authorized personnel on a need-to-know basis;
• controls designed to separate each customer's data within the Services;
• authentication controls, including one-time passcode verification for account access;
• logging and monitoring of authentication, record, data-access, and document-processing activity; and
• documented incident-response procedures.

We do not commit to obtaining or maintaining any particular security certification or audit framework. No method of transmission or storage is completely secure, including due to acts of third parties, and we cannot guarantee absolute security of information you transmit to us.

In the event of a security incident affecting Customer Data, we will use commercially reasonable efforts to notify the affected customer without unreasonable delay after we confirm the incident has occurred, except where an authority directs us to delay. The customer, as controller, is responsible for determining whether the incident triggers any obligation to notify individuals or regulators and for making any such notification. Where we act as controller, we will provide any notification required of us by applicable law.

12. Data Retention

We retain personal information for as long as needed to provide the Services and to meet legal, accounting, and reporting obligations, after which we delete or de-identify it.

Following closure, expiration, or termination of an account, we retain Customer Data — including uploaded documents such as CDLs and medical cards — for a retention period of thirty (30) days, during which the customer may export it. After that period, we may permanently delete Customer Data without further notice. Deleted data cannot be recovered and may persist in routine backups, archives, and disaster-recovery systems for a limited period before being overwritten or expiring in the ordinary course. The retention period is materially shorter than the retention periods imposed by transportation regulations; customers are solely responsible for exporting and independently retaining any records they are required to keep.

Certain data, including usage metrics, model-training data, aggregated data, business directory data, and logs, is retained as described in our Terms of Service and is not subject to the retention period above.

13. Categories of Personal Information We Collect

For the purposes of US state privacy laws, the categories of personal information we collect include:

14. Your Privacy Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to opt out of certain processing, and to appeal a denied request. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states may have additional rights under applicable state privacy laws. Because we do not sell personal information or use it for advertising or cross-context behavioral tracking, no opt-out of those activities is necessary.

• Account information. You can review and update your account details by signing in.
• Account cancellation. Account owners may cancel at any time through account settings, as described in the Terms.
• Requests about Customer Data. If your information is part of a carrier's account, that carrier is the controller. We will forward to the carrier any request we receive directly and provide reasonable assistance to the carrier, which may be at the customer's expense as described in the Terms.
• Marketing. Unsubscribe using the link in any marketing email, or reply STOP to texts.
• Location. Location is required for drivers to use the mobile app; its core features do not function without location enabled. Turning off location in device settings will prevent the driver app from working as intended.
• Submitting a request. Contact us at Support@VirtueTMS.com. We will verify your identity before acting.
• Do Not Track. Because there is no common standard, we do not respond to browser Do Not Track signals.

To the extent we process any health-related information, such as driver medical-certification status, we do so on behalf of carriers in an employment context and solely to provide the Services.

15. No Professional or Regulatory Advice; Customer Compliance Responsibility

The Services are software tools intended to assist with transportation operations. They are not, and do not provide, legal, tax, accounting, safety, insurance, or regulatory advice, and no feature, default setting, output, or behavior of the Services should be relied upon as a determination that any legal or regulatory requirement is or is not satisfied.

Customers are solely responsible for their own compliance with all laws and regulations applicable to their business and operations, including requirements of the FMCSA and DOT, hours-of-service rules, hazardous-materials rules, driver qualification and medical-certification requirements, insurance requirements, and IFTA and IRP obligations. Customers are also solely responsible for determining which privacy, data-protection, biometric, employee-monitoring, vehicle-tracking, and consumer-protection laws apply to their business and use of the Services, for providing all notices and obtaining all consents required from their drivers and other individuals, and for responding to any request by an individual to access, correct, delete, or restrict the processing of their personal data.

We do not determine which laws apply to any customer, do not advise any customer as to its obligations, and do not represent that the Services or any configuration of them satisfy any requirement applicable to a customer. Information obtained from public regulatory databases, such as FMCSA / SAFER, may not always be current or complete, and customers are responsible for independently verifying it where accuracy matters. These responsibilities are described further in the Terms of Service, which govern.

16. Children's Privacy

The Services are intended for business use and are not directed to anyone under 18. We do not knowingly collect personal information from minors. If we learn we have done so, we will delete it.

17. International Users and Data Residency

The Services are operated from the United States, and we process personal information primarily in the United States. Some sub-processors may process personal information outside the United States in accordance with their own terms and safeguards. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, whose laws may differ from those of your country.

18. Changes to This Policy

We may update this Privacy Policy from time to time, in accordance with the change process in the Terms, and will post changes here with an updated "Last Updated" date. If required by law, we will provide additional notice or obtain consent before material changes take effect.

19. Dispute Resolution

Any dispute concerning privacy matters is subject to the dispute resolution provisions of the Terms of Service, including the arbitration agreement, class-action waiver, and governing-law and venue provisions, and the opt-out rights described there.

20. Language

This Privacy Policy is provided in English only. Any translation obtained from any source is unofficial and has no legal effect; the English version controls.

21. Contact Us

LK Technologies LLC

Scottsdale, Arizona

Email: Support@VirtueTMS.com