Privacy Policy
Effective Date: October 14, 2026
1. Introduction
Fleet Collect, operated by Solve For Solutions LLC ("we," "us," or "our"), provides a cloud-based Driver Qualification File (DQF) management platform and IFTA mileage tracking application designed to help motor carriers maintain compliance with Federal Motor Carrier Safety Administration (FMCSA) regulations and International Fuel Tax Agreement (IFTA) requirements. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, mobile applications, and services (collectively, the "Services").
By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.
2. Information We Collect
2.1 Information Provided by Motor Carriers (Administrators)
When motor carriers register for and use our Services, we collect:
- Company name, DOT number, MC number, and business contact information
- Administrator names, email addresses, phone numbers, and login credentials
- Billing information, including payment card details processed through our payment processor
- Communication preferences and correspondence with our support team
2.2 Driver Information Collected on Behalf of Motor Carriers
On behalf of motor carriers using our platform, we collect and process the following driver information as required for DQF compliance:
- Full legal name, date of birth, and Social Security Number (SSN)
- Commercial Driver's License (CDL) number, state of issuance, and expiration date
- Driver's physical address, email address, and phone number
- Employment history for the past ten (10) years as required by FMCSA regulations
- Motor Vehicle Records (MVRs) from state DMVs
- DOT medical examination certificates and medical examiner information
- Results of pre-employment and random drug and alcohol testing
- Background check results obtained through our partner, Checkr, Inc.
- Road test certifications and training records
- Annual review of driving records and certifications of violations
- Hours of Service (HOS) records, if applicable
- Photographs and electronic signatures
2.3 SMS and Mobile Communications Data
When drivers use our SMS-based IFTA tracking features, we collect:
- Mobile phone numbers of enrolled drivers
- SMS message content including trip commands, fuel logs, and responses
- Message timestamps and delivery status
- Consent records and opt-in/opt-out history for TCPA compliance
- IP addresses associated with enrollment actions
This information is collected and processed on behalf of motor carriers (the data controllers) to facilitate IFTA compliance tracking and driver communication.
2.4 Information Collected Automatically
When you access our Services, we automatically collect:
- Device information (browser type, operating system, device identifiers)
- IP address and approximate geographic location
- Usage data including pages visited, features used, and time spent on our platform
- Cookies and similar tracking technologies (see Section 8)
2.5 Location Data Collection (Mobile Application)
When you use the FleetCollect Driver mobile application, we collect location data as follows:
Types of Location Data Collected:
- GPS coordinates (latitude, longitude)
- Location accuracy measurements
- Speed and movement data
- Timestamps of location readings
- Detected state/province jurisdictions
When Location Is Collected:
- Continuously during active trips (every few seconds)
- In the background when a trip is in progress
- At fuel stop locations when logging purchases
- At trip start and end points
How Location Data Is Used:
- Calculate miles driven in each state for IFTA reporting
- Detect state border crossings
- Generate quarterly tax reports
- Display trip routes on maps
- Verify fuel purchase locations
Location Data Sharing:
- Location data is shared with your employer/company administrator
- Aggregated location data may be used for service improvement
- We do not sell location data to third parties
2.6 Mobile Application Data Collection
The FleetCollect Driver app collects the following information:
Device Information:
- Device type, model, and operating system
- Push notification tokens
- App version and settings
Trip Data:
- Start and end times
- Route information and state crossings
- Total miles driven
- Trip notes and tags
Fuel Purchase Data:
- Gallons purchased
- Purchase location (state, city)
- Price per gallon (if provided)
- Receipt images (stored in AWS S3)
Equipment Data:
- Vehicle information (make, model, VIN, license plate)
- Inspection records
- Maintenance history
- Service requests
Usage Data:
- App interactions and feature usage
- Error logs and crash reports
- Session duration
3. How We Use Your Information
We use the information we collect for the following purposes:
- To provide, maintain, and improve our DQF management Services
- To process driver qualification files in compliance with 49 CFR Part 391
- To facilitate background checks and MVR retrievals through authorized third parties
- To send SMS-based trip tracking messages and IFTA mileage confirmations to drivers who have provided consent
- To send compliance alerts, document expiration reminders, and service notifications
- To process payments and manage subscription billing
- To respond to customer support inquiries and provide technical assistance
- To analyze usage patterns and improve our platform's functionality
- To maintain TCPA compliance records including SMS consent logs and opt-out history
- To analyze and extract information from uploaded compliance documents using artificial intelligence for automated document processing
- To detect, prevent, and address fraud, security issues, and technical problems
- To comply with legal obligations and regulatory requirements
4. How We Share Your Information
4.1 Service Providers
We share information with trusted third-party service providers who assist us in operating our Services:
- Checkr, Inc.: We partner with Checkr to conduct background screening services, including criminal background checks, employment verifications, and MVR retrievals. Checkr's privacy practices are governed by their privacy policy.
- Twilio Inc.: We use Twilio to send and receive SMS messages for IFTA trip tracking. Twilio processes driver phone numbers, message content, and delivery metadata in accordance with their privacy policy.
- Payment Processors: We use third-party payment processors (Stripe) to handle billing transactions. We do not store complete payment card information on our servers.
- Amazon Web Services (AWS): Cloud storage for data and receipt images.
- Google Maps Platform: Mapping, directions, and geocoding services for IFTA tracking.
- Apple Push Notification Service / Firebase Cloud Messaging: Push notifications for mobile app.
- Expo: Mobile app development and notification services.
- Plaid, Inc.: We use Plaid to enable bank account linking and transaction import for expense tracking. Plaid accesses your bank account information, including transaction history, account balances, and account holder details, in accordance with Plaid's End User Privacy Policy. You authorize this access when you connect your bank account through the Plaid Link interface.
- Anthropic (Claude AI): We use Anthropic's Claude AI to analyze uploaded compliance documents (extracting expiration dates, document types, and key fields from images) and to parse SMS messages for IFTA trip tracking commands. Document images and SMS text content are sent to Anthropic's API for processing. Anthropic does not use this data to train its models.
- Amazon Simple Email Service (AWS SES): We use AWS SES to send transactional emails including account verification, password resets, compliance alerts, and onboarding communications.
- Microsoft Clarity: We use Microsoft Clarity on our website and web application for usage analytics and interaction data, including aggregated click patterns, scrolling behavior, and page navigation, to improve our user experience.
- Google Analytics 4 (GA4) and Google Tag Manager (GTM): We use GA4 and GTM on our marketing site and web application to analyze website traffic, user behavior, and advertising conversion metrics. These services use cookies and similar technologies to collect usage data.
- Meta (Facebook) Pixel: We use the Meta Pixel on our marketing site for advertising conversion tracking and audience measurement.
4.2 Mobile Contact Information
We do not share mobile contact information with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors in support services, such as customer service. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
4.3 Motor Carriers (For Driver Data)
Driver information is collected and processed on behalf of motor carriers who are the data controllers for their drivers' information. Motor carriers may access, export, and manage their drivers' DQF data through our platform.
4.4 Legal and Regulatory Disclosures
We may disclose information when required by law or in response to valid legal process, including:
- Subpoenas, court orders, or other legal process
- Requests from FMCSA, DOT, or other regulatory agencies during audits or investigations
- To protect the rights, property, or safety of Fleet Collect, our users, or others
- In connection with a merger, acquisition, or sale of assets
4.5 AI Assistants and Connectors
When you connect your account to an AI assistant (such as Muse by Meta, Claude, or ChatGPT), we send the account data that the assistant requests to that assistant at your direction. The assistant provider handles that data under its own terms and privacy policy. See Section 12 for what a connector can access, who else processes it, and how long related records are kept.
5. Data Retention
We retain information for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal and regulatory requirements:
- Active Account Data: Retained while your account remains active and for a reasonable period thereafter.
- Driver Qualification Files: Retained in accordance with FMCSA requirements, which mandate that certain records be maintained for three (3) years after a driver leaves employment with a motor carrier.
- IFTA Trip and Fuel Data: Retained for minimum four (4) years from the end of the fiscal year (IFTA audit requirement). Quarterly reports retained indefinitely unless deletion requested. GPS coordinate data may be aggregated after report generation.
- Billing Records: Retained for seven (7) years to comply with tax and accounting requirements.
- Usage Logs: Generally retained for up to two (2) years for security and analytical purposes.
- AI Connector Records: Credentials, connection records, and change records related to AI assistants are retained as described in Section 12.5.
Motor carriers may request deletion of their data subject to our legal retention obligations.
6. Security Measures
We implement commercially reasonable security measures to protect personal information:
- Encryption of data in transit using TLS/SSL protocols
- Encryption of sensitive data at rest, including SSNs and background check results
- Access controls and authentication requirements for platform users
- Regular security assessments and vulnerability testing
- Employee training on data protection and security practices
- Incident response procedures for potential data breaches
DISCLAIMER:
WHILE WE STRIVE TO PROTECT YOUR INFORMATION USING COMMERCIALLY REASONABLE MEASURES, NO METHOD OF TRANSMISSION OVER THE INTERNET OR ELECTRONIC STORAGE IS 100% SECURE. WE CANNOT AND DO NOT GUARANTEE ABSOLUTE SECURITY. YOU ACKNOWLEDGE THAT YOU PROVIDE INFORMATION AT YOUR OWN RISK AND THAT WE SHALL NOT BE LIABLE FOR ANY UNAUTHORIZED ACCESS, USE, OR DISCLOSURE OF YOUR INFORMATION EXCEPT TO THE EXTENT CAUSED BY OUR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.
6.1 Data Breach Notification
In the event of a data breach that compromises your personal information, we will notify affected individuals and applicable regulatory authorities in accordance with applicable law. For California residents, notification will be provided without unreasonable delay and no later than seventy-two (72) hours after becoming aware of the breach, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach.
7. Your Rights and Choices
7.1 For Motor Carrier Administrators
You may access and update your account information through the platform settings. You may also contact us to request account deletion, subject to our retention obligations.
7.2 For Drivers
Drivers whose information is processed through our platform should contact their employer (the motor carrier) to exercise rights regarding their personal information. Motor carriers are the data controllers responsible for responding to such requests. We will assist motor carriers in fulfilling these obligations upon request.
7.3 California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
- Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: We do not sell personal information.
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
To exercise these rights, contact us at info@fleetcollect.net.
7.4 Canadian Residents (PIPEDA)
If you are a Canadian resident, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation (including Quebec's Law 25). You have the following rights:
- Right to Access: Request access to personal information we hold about you.
- Right to Correction: Request correction of inaccurate or incomplete personal information.
- Right to Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information, subject to legal or contractual obligations.
- Right to Complain: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated.
We collect, use, and disclose your personal information only for purposes that a reasonable person would consider appropriate, and with your knowledge and consent. GPS location data collected for IFTA mileage tracking in Canadian provinces is processed in accordance with PIPEDA's accountability and safeguarding principles.
To exercise these rights, contact us at info@fleetcollect.net.
8. Cookies and Tracking Technologies
We use cookies and similar technologies to operate and improve our Services:
- Essential Cookies: Required for basic platform functionality, authentication, and security.
- Analytics Cookies: Help us understand how users interact with our Services.
- Preference Cookies: Remember your settings and preferences.
- Analytics and Advertising Cookies: Including Google Analytics 4, Google Tag Manager, Meta (Facebook) Pixel, and Microsoft Clarity, used for traffic analysis, advertising conversion tracking, and audience measurement.
- Usage Analytics: Microsoft Clarity uses cookies and scripts to capture aggregated user interaction data including clicks, scrolling behavior, and page navigation patterns for usage analytics and site improvement.
You can control cookies through your browser settings. Disabling certain cookies may affect platform functionality.
9. Children's Privacy
Our Services are not intended for individuals under 18 years of age. The FleetCollect Driver app is intended for use by commercial motor vehicle operators who must be at least 18 years old (21 for interstate commerce). We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will promptly delete that information.
10. International Data Transfers
Our Services are operated in the United States. If you access our Services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using our Services, you consent to such transfer.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time at our sole discretion. We will notify you of material changes by posting the updated policy on our website. Your continued use of our Services after such changes constitutes acceptance of the updated policy. It is your responsibility to review this Privacy Policy periodically.
12. AI Assistants and Connectors
12.1 How Connectors Work
You can connect your Fleet Collect account to an AI assistant (such as Muse by Meta, Claude, or ChatGPT) through our Model Context Protocol (MCP) server, using OAuth or an API key that you create in your account settings. Once connected, the assistant can ask our server for information from your account, and we return the requested data to the assistant at your direction. The assistant provider receives and handles that data under its own terms and privacy policy, not this Privacy Policy. Technical details are published at fleetcollect.net/developers.
12.2 What a Connector Can Access
Every request is limited on our servers to the account that authorized the connection. A read-only connection can return:
- Drivers and compliance: driver names, hire dates, DQF checklist items, compliance status, and document expiration dates. These results do not include Social Security numbers, license numbers, email addresses, phone numbers, or drug and alcohol test results.
- IFTA: trip counts, miles by jurisdiction, fuel totals, and quarterly tax figures, and IFTA driver names with trip activity.
- Dispatch: load rates, miles, commodity, and status, without shipper, consignee, or broker names or contact details.
- Drug and alcohol testing: counts of test orders by status. If your plan includes drug and alcohol testing, also test orders and DOT physicals by driver with their status and dates, open random selections already released to you, and orders awaiting a Designated Employer Representative sign-off. Test results are never returned, but an order marked as awaiting sign-off is one whose result was flagged for Medical Review Officer review.
- Subscription: plan, billing status, and driver limits, without payment card details.
- Document review (if your plan includes it): uploaded document details and form answers, including driver application answers such as address, phone, email, and employment and accident history, and documents received in your document inbox (including the address they were sent from). Social Security numbers are limited to the last four digits, license numbers are masked, and dates of birth are withheld. Links to stored files expire after ten (10) minutes.
- Auditor links and AI change history: the links you have shared with auditors (including the link address while it is active) and summaries of changes AI assistants made to your account, which can include driver names and the phone number or email a message was sent to.
- Carrier lookups: public records from the Federal Motor Carrier Safety Administration (FMCSA).
12.3 Who Receives Connector Data
- The AI assistant you connect: receives the data it requests, as described above.
- FMCSA: for carrier lookups we send only the USDOT or MC number to FMCSA's public services; no account data is sent.
- Hosting: our servers and database run on Heroku (Salesforce), which processes connector requests as part of operating the Services.
- Error monitoring and logs: if an error occurs while handling a connector request, an error report (the error message, the tool name, and where in our code it occurred) is sent to our error-monitoring provider (Sentry) and written to application logs held by our log-management provider (Papertrail). Error reports do not include the request body or the data returned to the assistant.
- Sign-in page: when you sign in to approve a connection, our sign-in page does not load analytics or advertising technologies.
We do not sell data returned through a connector, and we do not use it for advertising, profiling, or to train AI models. We do not store the data our read-only tools return to an assistant.
12.4 Protections
- OAuth connections use the authorization code flow with PKCE (S256), required for every client. You sign in and approve each connection on a consent screen, and you can revoke it at any time (Section 12.6). OAuth access tokens are accepted only by our connector endpoint, and reuse of an already-replaced refresh token revokes every token from that connection.
- We store only one-way (SHA-256) hashes of API keys, OAuth access tokens, refresh tokens, authorization codes, and client secrets, never the values themselves.
- Every request is checked again on our servers. A connection stops working immediately if your subscription is no longer active or trialing, or if the team member who created it is removed.
12.5 What We Keep and for How Long
- OAuth authorization codes: valid for five (5) minutes and deleted when used. Unused codes are deleted one (1) day after they expire.
- OAuth access and refresh tokens: access tokens expire after one (1) hour and refresh tokens after sixty (60) days. Token records, including revoked and replaced ones, are deleted thirty (30) days after the refresh token's expiry, so no token record is kept more than about ninety (90) days after it was issued.
- OAuth client registrations: an assistant's registration (its name and redirect addresses, not your data) is deleted ninety (90) days after it was created once it holds no tokens or codes.
- API keys: do not expire. A revoked key stops working immediately and its record is deleted ninety (90) days after it was revoked.
- Request records: for read-only tools we record only the time a credential was last used, not the requests or responses.
- AI change history: changes made by AI assistants with change permissions are recorded (what was requested and the result) so you can review and undo them. Records are deleted after one (1) year. Records used to prevent duplicate retries are deleted after seven (7) days, and used confirmation codes after one (1) day.
- Rate-limit counters: request counts per credential or IP address for each limit window (one minute to one day), deleted after two (2) days.
- Public carrier data: cached copies of FMCSA responses are deleted within seven (7) days.
- Error reports and logs: error reports are kept by Sentry for thirty (30) days. Application logs are searchable in Papertrail for two (2) days and archived there for seven (7) days.
12.6 Revoking Access and Deleting Connector Data
- API keys: you can revoke a key at any time in Settings → Integrations → API access & AI agents. A revoked key is rejected from the next request.
- OAuth connections: you can revoke a connected AI app at any time in Settings → Integrations → API access & AI agents → Connected AI apps. All of that app's access and refresh tokens for your account are rejected from the next request. If the assistant supports token revocation, disconnecting it in the assistant also revokes its access.
- Deletion requests: to request deletion of connector-related records, email info@fleetcollect.net. When an account is deleted, we delete its API keys, OAuth tokens and authorization codes, AI change history, and connector settings.
13. Contact Us
If you have questions about this Privacy Policy or our privacy practices, please contact us:
Solve For Solutions LLC dba Fleet Collect
20526 Leapwood Ave
Carson, CA 90746
Email: info@fleetcollect.net