HaulVet Privacy Policy

1Who we are

HaulVet (haulvet.com) is a product of Syed Media, LLC d/b/a HaulVet, a Wyoming limited liability company at 30 N Gould St, #47039, Sheridan, WY 82801, USA ("HaulVet", "we", "us"). We are the controller of the personal information described in this policy. Privacy questions: support@haulvet.com.

2Two kinds of information

This policy covers two different things.

1. Information about our users. People who visit the site, sign up, pay and use the Service. Sections 3 to 6.
2. Public-record information about motor carriers. The government registration records we republish, which can include the names, phone numbers, email addresses and business addresses that carriers filed with the U.S. Federal Motor Carrier Safety Administration (FMCSA). Section 7.

3Information we collect from users

We do not collect Social Security numbers, driver licence numbers, dates of birth, precise geolocation or biometric data from users. Please do not enter such data into notes.

4How we use user information

• To provide the Service: accounts, lookups, monitoring, alerts, Snapshots, exports.
• To bill you and prevent fraud.
• To send service emails, listed below.
• To understand how the Service is used and fix problems (analytics, error reports and logs).
• To learn which of our own campaigns bring sign-ups and paying customers (the campaign words in section 3), so we spend on the ones that work.
• To answer the messages you send us, by email or through the support form.
• To enforce our terms, respond to legal requests and protect our rights.
• To keep the record that you agreed to our Terms, and to produce it if a payment or a contract is ever disputed.

The emails we send, and how to stop them.

• Sign-in emails. Email confirmation, sign-in links, password resets, and a note when someone tries to sign up with an address that already has an account. They go to the address typed in, only because someone asked for them.
• Invitations. Sent to the address an owner invites.
• Account emails. A welcome note after your first payment; a note when your password changes, when you are removed from an organisation, when ownership moves, when the account is closed, and when the subscription ends. They go to the person concerned or the account owner, and have no unsubscribe link because each is about the account.
• Alert emails. Instant alerts, reminders the day before a date a carrier's record holds, and the daily digest. They go to the account owner and to the addresses the owner lists in alert settings, up to ten. A listed address does not have to belong to a HaulVet user. Which alert emails are sent follows the owner's alert settings, and any address can stop the daily digest with the link in it. That link takes one click, needs no login, and stops the digest for that one address only. Instant alerts and reminders sent to a listed address carry a "Stop sending alerts to this address" link. It also takes one click and needs no login. It stops instant alerts and reminders to that one address; the address still receives the digest, which has its own link. The owner sees each stopped address in alert settings and is the only person who can undo it. Each alert email also has a "Mute this carrier" link, which stops emails about that carrier for the whole brokerage and needs a team member's login. These links work for 180 days after the email is sent. After that, the owner can change the list in alert settings, or you can write to support@haulvet.com. A person removed from the organisation gets no more alert emails.
• Correction emails. A receipt and our decision, sent to the person who asked.
• Support replies. Our answers to messages you send us. The support form sends you no email of its own; it delivers your message to our mailbox, and we reply from there.
• Notices. We email account owners about material changes to our Terms or this policy, as section 14 says.
• Receipts, invoices and failed-payment notices come from Stripe, not from us. Stripe sends receipts, invoices and failed-payment notices to the billing address on the account, which follows the account owner. Stripe's own settings decide which of these it sends.
• We do not send marketing or newsletter email. If we ever do, we will send it only to people who ask for it, and every such email will have an unsubscribe link.

Sign-in, invitation, correction and billing emails have no unsubscribe link, because each one is sent only because of something you or your organisation did.

• To advertise HaulVet, and to measure whether the advertising works. We intend to advertise through Google Ads. When we do, a Google tag will run on our public marketing pages. It does two things. It records that a visit which came from one of our ads later did something we count, such as starting a plan, so we know which ads work. And it adds your browser to an advertising audience, so that Google can show you a HaulVet advertisement again on other sites you visit afterwards. This is called remarketing. It sets a cookie on our own domain and reads the click identifier Google adds to the link when you click an ad. It does not receive your name, your email address, your notes, or anything about the carriers you look up, and it never runs inside the signed-in app. No advertising tag runs on this site today. This paragraph takes effect on the day the tag is installed.

We do not sell your information for money. But remarketing means that, once the tag is installed, we share personal information for cross-context behavioural advertising: your browser identifier and the fact that you visited our pages go to Google, and Google uses them to show you our advertisements elsewhere. California law calls that "sharing". Since 1 July 2023 Google does not act as our service provider for it, so Google is a separate company deciding things for itself rather than a supplier acting only on our instructions. We are telling you this plainly rather than calling it something else. Section 4a says how to stop it.

We do not use Customer Match or enhanced conversions. We never give Google your email address, hashed or otherwise, and we never upload a customer list. What we share is limited to the browsing described above.

We do not use your information to train machine-learning models.

4a. How to stop the advertising sharing

You can stop it, and it costs you nothing else on this site.

• Use the link. Every page that can carry an advertising tag has a "Do Not Sell or Share My Personal Information" link in its footer: our home page, every marketing and legal page, the free lookup tools, the correction form and every public carrier record. It opens haulvet.com/privacy-choices, where one switch turns the sharing off for this browser. No account and no email address is needed. The sign-in and sign-up pages carry the link too. The signed-in app does not, because no advertising tag ever runs inside it (section 4).
• Or let your browser say it for you. If your browser or an extension sends a Global Privacy Control signal, we treat that as the same request, automatically. You do not have to find the link.
• What happens then. We stop adding your browser to advertising audiences, and we tell Google to restrict what it does with the data it has already received from this browser. We may still count, for our own reporting, that one of our ads led to a sign-up.
• It applies to this browser, and it does not last for ever. The choice is remembered in a cookie on our own domain, so clearing your cookies or using a different browser or device means telling us again. Browsers also put their own limit on how long a site may keep a cookie, about 13 months, so after that the choice lapses and you would need to set it again. We keep it for as long as your browser allows. We have no way to recognise you across browsers without asking for more information than we want to hold, and we would rather ask you twice than ask you who you are.

No advertising tag runs on this site today, so there is nothing to stop yet. The link and the switch work now, and a choice you make now is remembered and honoured on the day the tag is installed.

5Cookies and similar technologies

• Essential cookies. Your sign-in session; the organisation you chose, if you belong to more than one; the sign-up check in section 3, which lasts 24 hours; and, on the correction form and the support form, an anonymous identifier, kept for up to a year, that limits how many requests one browser can send; on the correction form also Cloudflare's bot check (Turnstile), which sends your network address to Cloudflare. Required for the Service to work.
• Browser storage. Your light or dark theme is kept in your browser's local storage. A few values that last only while the tab is open help the sign-up and the product tour pick up where you left off.
• Analytics. For visitors in the United States and other countries outside the European Economic Area, the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar, Switzerland and India: when PostHog is switched on, it stores an identifier in your browser's local storage, not in a cookie, to recognise the same browser across visits. Two more values go with it: in local storage, the campaign words of your first visit (section 3), so a sign-up a few days later is credited to the campaign that brought you; we stop using them after 30 days and remove them the next time the site reads them; and, in session storage for the open tab only, the name of the site and the campaign words this visit started with, which we stop using after 30 minutes without activity. We have turned off session recording, automatic click events and surveys, and PostHog is set not to record your IP address. Heatmaps are on: they record click and mouse positions on a page, never what was written there. Page views are recorded by our own code with the general page address only (section 3). PostHog does not load at all for visitors in the European Economic Area, the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar, Switzerland or India, or when we cannot tell where you are, so nothing is stored in your browser for analytics and no campaign words are kept.
• Error reports. Sentry stores nothing in your browser. Its code normally loads after the page has finished loading; an error page may load it earlier.
• Advertising. When the Google tag in section 4 is installed, it will set one cookie on our own domain, on the public marketing pages only, so that an ad click, a later sign-up and an advertising audience can be joined up. It will not run inside the signed-in app. Section 4a turns it off. No such cookie is set today.
• The choice you make in section 4a is itself stored in a cookie on our own domain, so that we can keep honouring it. That one cannot be turned off, because it is how "off" is remembered.

You can block cookies and clear local storage in your browser. The public lookup tools work without analytics. The app needs the essential cookies.

We honour the Global Privacy Control signal. Your browser sends it with each page request. We treat it as a request to stop the advertising sharing described in section 4, for this browser. You do not have to click anything, and we do not ask you to confirm. Because no advertising tag runs today, there is nothing yet for it to stop; the haulvet.com/privacy-choices page already reads it and tells you it was seen.

6Who we share user information with

We share user information with the service providers below, which process it for us under their data-processing terms. Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal duties, under Stripe's privacy policy. We also share it with Google for advertising, which is not one of them and is described separately underneath; and with the law when required.

Our servers in Oregon also read public FMCSA and other U.S. government web pages about carriers, one carrier at a time, for example when a signed-in user opens a carrier. Each of those requests carries only the carrier's USDOT number, never a name, an email address or anything else about our users.

Google appears twice, and the difference matters. As the host of our mailboxes, Google works for us under contract, like the companies in the table. Advertising is different. When the advertising tag in section 4 is installed, Google will receive your browser identifier and the fact that you visited our public marketing pages, for two purposes: measuring which of our ads lead to sign-ups, and adding your browser to an advertising audience so it can show you our advertisements elsewhere (remarketing). Since 1 July 2023 Google does not act as a service provider for that in California, so it decides for itself what it does with what it receives, and we cannot instruct it the way we instruct the companies above. That is why section 4 calls it sharing rather than processing, and why section 4a exists. It receives nothing about the carriers you look up, no name, no email address and no notes, and it never runs inside the signed-in app. Data goes to the United States. No advertising tag runs on this site today.

We will update this table before adding a service provider and email account owners about material changes.

We may also disclose information to comply with law, a subpoena or court order; to enforce our terms; to protect the safety of any person; or to a successor if our business is sold, with notice to you.

7Public-record information about motor carriers

7.1 What it is. The carrier information in the Service comes from public records that FMCSA and the U.S. Department of Transportation publish for download, mainly the Company Census file and the operating-authority, insurance, process-agent, revocation and out-of-service files, and from government web pages we read one carrier at a time, including FMCSA's own carrier pages. See our Data Sources page for the full list.

7.2 What it contains. Those records include the business contact details that carriers file on FMCSA Form MCS-150 and in their operating-authority applications: legal and DBA names, physical and mailing addresses, telephone and fax numbers, email addresses, the names of up to two company officers, fleet size, cargo types, insurance filings, process agents and the history of authority status. For a one-person trucking company these details can identify an individual.

7.3 It is government-record data. This information is created and published by the U.S. Government under federal regulations that require public release of motor carrier registration data. We do not collect it from the individuals concerned, and we do not add personal information from other sources. Under the California Consumer Privacy Act (Cal. Civ. Code 1798.140(v)(2)) and the Texas Data Privacy and Security Act, information that is lawfully made available from federal, state or local government records is "publicly available information" and is not "personal information" or "personal data" under those laws.

7.4 What we do with it. We show it as filed, with the source and date of each record. We show three checks, Authority, Insurance and Orders, each read from those records by fixed written rules as pass, hold, stop or unknown, with the record behind it. We compute "indicators" by comparing records, for example that a phone number appears on more than one active USDOT record. We do not compute scores, ratings or opinions about any carrier or person, and we do not decide whether a carrier is safe or honest.

7.5 We do not sell it. Access to our Service is sold by subscription. We do not sell, license or transfer carrier records or lists to other companies, do not offer a download of our carrier database, and do not build marketing lists. A customer can export the records of the carriers on its own list.

7.6 Masking and correction. Even though this is public-record data, a carrier or an individual named on a carrier's record can ask us to mask their phone number, email address or officer name on our site, or to correct an error in how we display a record. Use the Correction and Removal form at haulvet.com/correction or email support@haulvet.com. We aim to decide within 5 business days and to email you the decision. When we approve a masking request, we apply the mask by hand, check that it shows on our site, and only then email you that it is live. Once applied, the value is removed from lookups, the shared-contact tools, exports and new Snapshots, and it stays masked when we reload FMCSA data. Alert emails never carry phone numbers, email addresses, street addresses or officer names. We cannot change FMCSA's own record; see the form page for how to do that.

7.7 Snapshots already created by customers are that customer's business record of what they saw and are not rewritten after masking.

8Where your data is stored

Our servers and database are in the United States, hosted by Hetzner in Hillsboro, Oregon. Our backups are in Germany: nightly copies on a backup server in Falkenstein, and an off-site copy in Nuremberg; section 9 says how long each is kept. Error reports are stored by Sentry in its EU data region, in Germany; Sentry's own staff and some of its systems may process them elsewhere under its policy. Cloudflare serves cached public pages from locations close to the visitor, including in the United States. Stripe, Resend, Google (our mailboxes) and PostHog process data in the United States, and Google will receive advertising data there once the tag in section 4 is installed. When a signed-in user opens a carrier, our server may ask FMCSA's own website for that carrier's current record; that request carries only the carrier's USDOT number. HaulVet is operated from India: the people who run it sign in to these systems from India to operate the Service, answer requests and handle billing tasks, and they receive operational emails about them. By using the Service you understand that your information is stored in the United States, that backup copies and error reports are kept in Germany, and that we access it from India.

9How long we keep information

The three rules that matter, before the table.

1. While your account is open, we keep your records. Nothing your brokerage has recorded is deleted on a timer, and there is no age at which a decision, a Snapshot or a note expires. The one thing we do not keep is the rendered copy of an alert email after it has been sent; the alert itself stays in your feed.
2. When the account is closed, the records go. You get 90 days to export, then a daily job deletes your organisation's records in bounded batches. Only the items named as surviving below are kept after that.
3. Unless the law makes us keep it. If a law, a court order, a regulator's request or a dispute that has been raised with us requires us to keep particular records, we keep only those records, only for as long as that requirement lasts, and we delete them afterwards.

10Your rights

Depending on where you live you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, to opt out of sale or sharing or of targeted advertising, and not to be discriminated against for exercising these rights. This includes rights under the California Consumer Privacy Act, the Texas Data Privacy and Security Act and similar laws in other states.

To use these rights, email support@haulvet.com from the address on your account, or use the Settings page to export your data or close the account (after the 90-day export window your brokerage's records are deleted by a daily job that may take some days, as section 9 says; your sign-in profile is removed on request by email). The owner's export is a file with the organisation and its members, the monitored list, decisions, Snapshots, notes (deleted ones marked), alerts and alert settings; the owner can download it while the account is open and for 90 days after it closes. Any member can download the monitored list as a spreadsheet. You can see your own agreement record in Settings. We will check that a request really comes from you and answer within the time the law sets (45 days in most states). You can appeal a refusal by replying to our decision; we will answer the appeal within the statutory period. You may use an authorised agent where the law allows.

Publicly available information. Rights under these laws do not apply to publicly available government-record information such as FMCSA registration data. We still offer the masking process in section 7.6 as a matter of policy.

Business context. Under the Texas law and similar laws, people acting in a commercial or employment context, including as a representative of a carrier or broker, are not "consumers" for those laws' purposes. We still honour reasonable requests from them.

California notice at collection. The categories we collect are listed in section 3, the purposes in section 4, and the retention periods in section 9. We do not sell personal information for money. We do share it for cross-context behavioural advertising, as section 4 describes, once the advertising tag is installed. That is "sharing" as the CCPA defines it, and section 4a is how you stop it. We do not collect sensitive personal information from users.

11Security

We protect your information with access controls, encryption in transit, hashed passwords, org-level isolation in the application, rate limiting, restricted server access and backups on a separate server. No system is perfectly secure. If a breach affects your data we will notify you as the law requires.

11a. Visitors outside the United States

HaulVet is sold to businesses in the United States, but our public pages can be read from anywhere. The planned advertising cookie in section 4 will not be set for visitors in the European Economic Area, the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar, Switzerland or India, or when we cannot tell where a visitor is, because visitors there would first have to be asked, and we would rather not set it than ask. The same applies to analytics, and that part is in force today: PostHog does not load for visitors in the European Economic Area, the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar, Switzerland or India, or when we cannot tell where a visitor is. Everything else on the public pages works the same wherever you are. The advertising half describes the position from the day the tag is installed; no advertising cookie is set anywhere today.

12Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children.

13Do Not Track and Global Privacy Control

We read and honour the Global Privacy Control signal, as sections 4a and 5 describe: it is treated as a request to stop the advertising sharing, for that browser. We do not respond to browser "Do Not Track" signals, which have no agreed meaning and which no law treats as a request.

14Changes to this policy

We will post changes here with a new date at the top and email account owners about material changes at least 30 days before they take effect.

15Contact

Syed Media, LLC d/b/a HaulVet, 30 N Gould St, #47039, Sheridan, WY 82801, USA. Privacy: support@haulvet.com. Corrections and masking: support@haulvet.com or the Correction and Removal form.