Privacy Policy

FleetFalcon serves two distinct roles depending on the data at issue.

• As a processor / service provider. When a motor carrier or other organization (the "Customer") uses the Services to manage its compliance program, the Customer is the controller (or, under U.S. state law, the "business") that determines why and how the data is processed. FleetFalcon processes that data only to provide the Services and only on the Customer's documented instructions, as a processor (or "service provider"). Our handling of that data is governed by our Data Processing Addendum ("DPA"), which forms part of our agreement with each Customer.
• As a controller. For a limited set of data — such as the account and contact details of the people who register and administer a Customer account, billing information, and Site analytics — we act as a controller and determine the purposes and means of processing. This Policy describes that processing directly.

Where we act as a processor, this Policy is informational; the Customer's own privacy notices and our DPA control. If there is a conflict between this Policy and a signed DPA or master agreement with a Customer, that agreement governs for the data processed under it.

We process personal data about several categories of individuals:

• Account users. The administrators, safety managers, and other personnel of a Customer who register for and use the Services ("Authorized Users").
• Drivers and other third parties. Commercial drivers, driver applicants, and other individuals whose records a Customer uploads to or generates within the Services. These individuals generally do not have a direct relationship with FleetFalcon; we hold their data on the Customer's behalf, and the Customer is responsible for providing them with any required notices and for having a lawful basis to share their data with us.
• Site visitors. People who visit fleetfalcon.io or contact us.

Depending on the role and the Services in use, we may collect or process the following categories of data. Much of this is submitted by the Customer about its drivers and applicants, not collected directly from the individual:

• Account & contact data: name, business email, phone, role, and company details of Authorized Users.
• Authentication data: email/password credentials or Google OAuth identifiers.
• Billing data: subscription tier, plan size, and payment information processed through Stripe (we do not store full card numbers).
• Driver qualification (DQ) file data: commercial driver's licenses (CDLs), medical examiner's certificates and national registry data, motor vehicle records (MVRs), employment and road-test records, and related expiry/renewal tracking (DocPulse).
• Onboarding & screening data: background-check reports, Pre-Employment Screening Program (PSP) reports, and MVR pulls obtained during Rapid Onboarding.
• Safety & compliance data: roadside-inspection records, violations and CSA/SMS data (Violation Radar), including data from a carrier-authorized pull of the Customer's own FMCSA SMS/portal account; incident and accident records; and driver citations (Citation Watch).
• Sensitive identifiers: Social Security numbers and similar government identifiers, where provided by the Customer for compliance purposes.
• Drug & alcohol testing data: testing records and related program data subject to 49 CFR Part 40, and, where applicable, FMCSA Drug and Alcohol Clearinghouse data (see Section 5).
• English Language Proficiency (ELP) data: ELP assessment records and results, including voice recordings where the assessment is recorded.
• Usage & device data: log data, device/browser information, and Site analytics collected through Google Analytics.

• Directly from Authorized Users during account creation (sign-up forms or Google authentication) and ongoing use.
• From the Customer, through data and document uploads about its drivers and applicants.
• From third-party sources at the Customer's direction — e.g., MVR/PSP/background providers, and a carrier-authorized pull of the Customer's own FMCSA SMS/portal data.
• Automatically, through cookies and analytics tools when you use the Site.
• From Stripe in connection with billing.

Some of the data we process is highly sensitive and governed by specific federal laws. We apply heightened handling to this data, and we process it only to provide the Services on the Customer's instructions. The Customer, as controller, remains responsible for the lawful basis, consents, and permissible purposes required by these regimes:

• Drug & alcohol testing records (49 CFR Part 40). These records are confidential under Part 40 and are released only as that regulation permits. We treat them as confidential and restrict access accordingly.
• Motor vehicle records (DPPA, 18 U.S.C. §2721). MVR data is protected by the Driver's Privacy Protection Act and may be used and disclosed only for permissible purposes. The Customer warrants it has a permissible purpose for each MVR obtained through the Services.
• Background & PSP reports (FCRA). Where background or PSP reports are used in hiring or other eligibility decisions, the Fair Credit Reporting Act imposes disclosure, authorization, and adverse-action obligations on the Customer. FleetFalcon is not a consumer reporting agency and does not assume the Customer's FCRA duties.
• FMCSA Drug & Alcohol Clearinghouse. Clearinghouse data is subject to statutory consent and limited-use restrictions. Where the Services touch Clearinghouse data, it is processed only pursuant to the specific driver consent and the limited uses the law permits, and only on the Customer's instructions.

• Provide, maintain, secure, and improve the Services.
• Process and analyze compliance data to deliver document and expiry tracking, onboarding, inspection and CSA monitoring, citation tracking, ELP records, and related features.
• Authenticate users and administer accounts.
• Process billing and subscriptions through Stripe.
• Communicate service, security, and account updates.
• Comply with legal obligations and enforce our agreements.

We use data processed on a Customer's behalf only to provide the Services to that Customer and as its DPA permits. We do not use it for our own independent purposes, and we do not sell it.

The Services use automated processing, including artificial intelligence and large language models, to analyze compliance documents and data — for example, to extract fields from uploaded documents, parse roadside inspections, flag expiring credentials, and summarize CSA and violation data. These outputs are decision-support tools and may contain errors; they do not replace a qualified human review.

We do not train AI models on customer or driver data. Customer Data and driver data are not used to train, fine-tune, or improve any FleetFalcon or third-party foundation model. Where we use a third-party AI/LLM provider to process data, we do so under terms that likewise prohibit training on the data and require its confidential handling.

We do not sell personal data. We share data only with service providers (sub-processors) that help us deliver the Services, under contracts that limit their use of the data to that purpose. Our current sub-processors include:

• Stripe — payment and subscription processing.
• Google — OAuth authentication and Google Analytics.
• Railway — backend hosting and data storage.
• Vercel — frontend hosting.
• AI/LLM provider(s) — automated analysis of compliance data, under no-training terms (Section 7).

We maintain a current list of sub-processors and will provide notice of material changes to Customers as required by our DPA. We may also disclose data to comply with law, respond to lawful requests, or protect the rights, safety, and security of FleetFalcon, our Customers, or the public, and in connection with a merger, acquisition, or sale of assets (subject to this Policy).

FleetFalcon does not sell personal data and does not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We honor opt-out preference signals, including the Global Privacy Control (GPC), where legally required.

The Site uses cookies and similar technologies, including Google Analytics, to understand how the Site is used. You can control cookies through your browser settings. Analytics data is used to operate and improve the Site, not to build advertising profiles.

We retain personal data for as long as needed to provide the Services and as required by the Customer's instructions and applicable law. Importantly, much of the compliance data in the Services is subject to mandatory federal retention periods, and deletion is subject to those obligations — this is not a "delete anytime" product. Examples include:

• Driver qualification (DQ) files — retained for the period of employment plus three years after termination (49 CFR 391.51).
• Drug and alcohol testing records — retained for the periods specified in 49 CFR Part 40 and Part 382.
• Accident register and related records — retained for three years (49 CFR 390.15).

When a Customer deletes records or terminates its subscription, we delete or return Customer Data in accordance with the DPA, except where we are required to retain it to meet the Customer's or our own legal obligations, resolve disputes, or enforce agreements. Data we process as a controller (such as account and billing records) is retained as needed for those purposes and applicable legal requirements.

We maintain administrative, technical, and organizational safeguards designed to protect personal data, including encryption in transit and at rest, role-based access controls, least- privilege access, and monitoring. No system is perfectly secure, but we work to protect data consistent with its sensitivity and applicable law.

Where we act as a processor and become aware of a personal-data breach affecting Customer Data, we will notify the affected Customer (the controller) without undue delay and provide the information reasonably needed for the Customer to meet its own notification obligations, as set out in the DPA. Where we act as a controller, we will provide any legally required notifications directly.

If you are a driver, applicant, or other individual whose data a Customer has uploaded, your relationship is with that Customer, which controls the data. Please direct access, correction, or deletion requests to the Customer (your employer or prospective employer). If you contact us directly, we will, where appropriate, refer your request to the relevant Customer and support the Customer in responding, consistent with our DPA and applicable law. We generally cannot delete or alter a driver's compliance records without the controlling Customer's instruction, and some records are subject to the mandatory retention periods in Section 10.

Depending on where you live and our role, you may have rights regarding your personal data.

• California (CCPA/CPRA). California residents may have the right to know, access, correct, and delete personal information, to opt out of sale/sharing (we do not sell or share), to limit use of sensitive personal information, and to be free from discrimination for exercising these rights.
• EU/EEA/UK (GDPR), where applicable. If we process personal data subject to the GDPR, data subjects may have rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with a supervisory authority. Where we act as a processor, we will forward such requests to the relevant controller.
• Other U.S. states. Residents of states with comprehensive privacy laws may have similar rights.

To exercise rights as to data for which we are the controller, contact us at privacy@fleetfalcon.io. For data a Customer uploaded, see Section 13.

FleetFalcon is a business-to-business compliance platform intended for motor carriers and their authorized personnel. The Services and Site are not directed to consumers or to children, and we do not knowingly collect personal information directly from children. Driver records processed in the Services relate to commercial drivers in an employment context, not to consumer or child users.

We operate primarily in the United States, and our hosting providers store data in the United States. If you access the Services from outside the United States, you understand that your data may be processed in the United States. Where required, we rely on appropriate transfer mechanisms for cross-border transfers of data subject to the GDPR or similar laws.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date and, where required, communicated to Customers.

For privacy questions or requests, contact our privacy team at privacy@fleetfalcon.io. You may also reach us at val@fleetfalcon.io.