Privacy Policy

1. Categories of Information We Collect

We limit collection to data necessary to maintain system security, enforce tier usage quotas, process commercial subscriptions, and execute carrier intelligence queries:

A. Account & Authentication Information

Registration Data: When you create an account or authenticate via our identity providers (e.g., Supabase Auth, Clerk, or Google OAuth), we collect your name, business email address, company name, and hashed/tokenized session identifiers.

Credentials: If using password-based authentication, passwords are salted and hashed through secure one-way algorithms; our systems never store plaintext passwords.

B. Payment & Commercial Transaction Data

Third-Party Payment Processing: All billing, credit card tokenization, bank details, and recurring charges are handled directly by our PCI-DSS Level 1 compliant payment processor, Stripe, Inc. ("Stripe").

Data Transmitted to Stripe: When you subscribe to a plan (Pro, Fleet Unlimited) or purchase a one-off report, your raw payment details (card number, expiration, CVC, billing address) flow directly to Stripe's secure infrastructure.

Data We Retain: FleetOpsOS does not collect, store, or process raw credit card numbers. We retain only non-sensitive transactional metadata returned via Stripe webhooks, including:

Stripe Customer ID (cus_xxx)

Stripe Subscription ID (sub_xxx)

Card brand and last 4 digits (for account invoice display only)

Subscription status, renewal date, and transaction timestamp

C. Search Queries & Audit Logging

Search Input Data: When you initiate a query via our web dashboard or API, we record the searched parameters, specifically USDOT numbers, MC/MX/FF docket numbers, and company legal names.

Operational Audit Logs: To prevent unauthorized scraping, enforce rate limits, and maintain system integrity, our Edge API gateway records:

Actor ID (authenticated user ID, API token ID, or anonymized guest session ID)

Request timestamp (UTC)

Client IP address and geographic point-of-presence (PoP)

Target DOT/MC queried

Endpoint path and HTTP response status code

Calculated quota decrements (lookups used vs. remaining monthly balance)

D. Device, Network, & Automated Telemetry

Standard serverless edge runtime logs: browser type/version, operating system, referrer URL, device type, network protocol, and performance diagnostic metrics.

2. How We Use Your Information

We process collected information strictly for operational and product-delivery purposes:

Service Provision: Generating dynamic carrier compliance reports, evaluating authority status, and serving cached FMCSA safety records.

Quota Management & Metering: Tracking query volume against your plan’s monthly allocation, enforcing rate limits, and calculating overage or reset dates.

Billing Administration: Enabling the Stripe Customer Portal, executing recurring subscription renewals, processing invoices, and preventing fraudulent transactions.

Platform Security & Abuse Prevention: Monitoring API traffic for automated bots, unauthorized scraping, DDoS attacks, and credential stuffing.

System Optimization: Improving edge cache hit ratios, reducing query latency across upstream federal endpoints, and identifying broken API routes.

Administrative Notifications: Delivering transactional communications (e.g., account confirmation, password reset, payment failure notices, and material updates to Terms or this Policy). We do not send marketing spam.

3. Sourcing and Handling of Public Domain Federal Data

Public Domain Exemption: FleetOpsOS aggregates, structures, and indexes public records from the Federal Motor Carrier Safety Administration (FMCSA) and the U.S. Department of Transportation (USDOT) under 17 U.S.C. § 105.

Carrier Profile Information: Public carrier details—including carrier safety ratings, inspection summaries, registered fleet sizes, corporate officer names listed on government filings, and public insurance policies—are public records and do not constitute consumer personal data owned or controlled by FleetOpsOS.

4. Disclosure and Sharing of Information

FleetOpsOS does not sell, rent, monetize, or trade your personal information or search query histories to data brokers, marketing networks, or third-party advertisers.We disclose data only to the following vetted third-party infrastructure processors under strict confidentiality obligations:

Stripe, Inc.: Payment gateway, customer billing portal, tax compliance. Data shared: Email, billing address, tokenized card details, plan ID.

Edge & Database Hosting (e.g., Cloudflare, Neon, Supabase): Global edge compute, serverless API execution, encrypted D1/PostgreSQL database hosting. Data shared: Authentication tokens, encrypted audit logs, lookup quotas.

Authentication Providers (e.g., Clerk, Supabase): User session authentication, multi-factor security, identity verification. Data shared: User email, hashed session tokens, login IP.

We may also disclose information if required by law, subpoena, or legal process, or to protect the safety, security, and rights of FleetOpsOS, our users, or the public against fraud or security threats.

5. Cookies, Local Storage, & Fingerprinting

Essential Cookies Only: We use secure HTTP-only session cookies and browser LocalStorage solely to maintain authenticated user sessions, store dashboard interface preferences (e.g., dark/light mode), and prevent CSRF (Cross-Site Request Forgery) attacks.

Guest Rate Limiting: For non-authenticated visitors using the free tier (e.g., 3 free lookups), we generate an ephemeral, one-way cryptographic hash of the client IP address and user-agent string to prevent quota abuse. This identifier is retained only for the duration of the rolling quota window.

No Third-Party Ad Trackers: We do not deploy cross-site tracking cookies, Meta Pixels, or third-party advertising retargeting networks.

6. Data Security and Encryption

We implement modern technical and organizational controls to protect data from unauthorized access, alteration, or disclosure:

Transport Encryption: All web and API traffic is forced over HTTPS using TLS 1.3 encryption.

Database Encryption: All primary databases, cached tables, and audit logs are encrypted at rest using AES-256.

Key Isolation: Stripe private API keys and database connection strings are stored exclusively in isolated serverless environment variables with zero client-side exposure.

Edge Redaction: API error responses are stripped of internal stack traces, database schema paths, or backend network indicators.

7. Data Retention & Deletion

Account Records: Stored as long as your account remains active. Upon written request or account cancellation, account records are purged within thirty (30) days, except where retention is required by tax or commercial accounting regulations (e.g., Stripe invoices).

Search Audit Logs: Raw IP-level query logs and audit records are retained for security auditing, billing dispute resolution, and rate-limit enforcement for up to twelve (12) months, after which they are permanently deleted or anonymized.

Edge Caches: Cached FMCSA carrier records are purged or re-indexed periodically to ensure data currency and do not retain user identifiers.

8. Your Rights & Choices

Depending on your geographic jurisdiction (such as California under CCPA/CPRA or other applicable state privacy laws), you may have the following rights regarding personal data:

Access & Portability: Request a copy of the personal data we hold about your account.

Correction: Update or correct inaccurate account details directly via your dashboard settings.

Deletion: Request the permanent deletion of your account and associated personal data, subject to lawful business retention requirements.

Opt-Out: Because we do not sell personal data or use third-party behavioral advertising cookies, we do not require an opt-out mechanism for data monetization.

To exercise any of these rights, submit a verified request to the contact address in Section 10.

9. Modifications to This Policy

We reserve the right to revise this Privacy Policy periodically to reflect infrastructure enhancements, regulatory developments, or new platform features. Any modifications will be posted to this page with an updated "Last Updated" timestamp. Continued use of FleetOpsOS after modifications take effect indicates your acceptance of the updated practices.

10. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our operational data handling practices, contact:

Platform: FleetOpsOS

Domain: https://fleetopsos.com

Privacy Officer / Support: privacy@fleetopsos.com