HaulGuard AI LLC — Privacy Policy

1. Introduction

HaulGuard AI LLC (“HaulGuard AI,” “we,” “us,” or “our”) is committed to protecting the privacy and security of information entrusted to us. This Privacy Policy explains how we collect, use, store, share, and protect personal and business information when you use the HaulGuard AI platform, website at haulguard.ai, mobile applications, APIs, and all related services (collectively, the “Service”).

This Policy should be read alongside our Terms of Service and EULA. By accessing or using the Service, you agree to the data practices described in this Policy. If you do not agree, you must discontinue use of the Service immediately.

This Policy applies to: (a) registered account holders (fleet operators, dispatchers, carrier owners, freight brokers); (b) individual drivers who access the Service under a fleet account; and (c) visitors to our website. Where practices differ between these user types, this Policy notes those differences.

2. Who We Are — Data Controller

HaulGuard AI LLC is an Arizona limited liability company (ACC #25047349) with registered offices at 5830 W Thunderbird Rd, Ste B8-142, Glendale, AZ 85306. HaulGuard AI is the “controller” of personal data collected through the Service, meaning we determine the purposes and means of data processing.

Privacy contact: support@haulguard.ai · +1 (623) 462-3405

3. Information We Collect

The Service collects different categories of information depending on your role (fleet operator, dispatcher, or driver) and the features you use.

3.1 Account and Business Information (All Users)

When you register for the Service, we collect:

• Full name and job title;
• Business name, business address, USDOT number, and MC/MX number (where applicable);
• Email address and phone number;
• Account credentials (username and securely hashed password); and
• Payment and billing information (credit/debit card or ACH details — processed by our payment processor; HaulGuard AI does not store full card numbers).

3.2 Driver-Specific Credential Data

For drivers using the Service (directly or through a fleet account), we collect:

• Commercial Driver’s License (CDL) number, issuing state, class, and expiration date;
• CDL endorsements, including Hazmat endorsement (H), Tank Vehicle endorsement (N), Doubles/Triples (T), and Combination Vehicle (X);
• Medical Examiner’s Certificate (MEC/medical card) number and expiration date;
• Transportation Worker Identification Credential (TWIC) card number and expiration date;
• IFTA license number and expiration date;
• Cab card information; and
• Driver attestation records and digital signatures for each hazmat load.

Note on TWIC Cards: TWIC cards issued by the Transportation Security Administration may contain biometric data (fingerprint template) stored on the card chip. HaulGuard AI captures only the TWIC card number and expiration date — we do not scan, capture, or store any biometric data from TWIC card chips. Drivers retain physical possession of their cards.

3.3 Load and Cargo Data

When you create a Compliance Record or process a load through the Service, we collect:

• Hazmat cargo description, UN/NA identification number, hazard class, and packing group;
• Shipping document details and load manifest data;
• Origin and destination information;
• Placard determination and associated 49 CFR citations generated by the AI; and
• Load weight, quantity, and packaging information.

3.4 Fleet and Vehicle Data

For fleet operators and dispatchers, we may collect:

• Vehicle identification numbers (VIN), license plate numbers, and vehicle type;
• ELD device identifiers and telematics integration data;
• HOS (Hours of Service) status and remaining drive time; and
• Maintenance records and DOT inspection due dates (where the Predictive Maintenance module is available).

3.5 Location and Geolocation Data

The Service collects GPS and geolocation data to support Hazmat-aware routing, fleet tracking, and HOS optimization. Specifically:

• Real-time GPS location (when the mobile application is active and location permissions are granted);
• Route history and trip path data; and
• Proximity to hazmat-restricted zones, tunnel ban areas, and permit-required routes.

Geolocation data is collected only when the mobile application or fleet tracking features are active and location permissions are enabled. Fleet operators can configure which dispatchers and administrators have access to driver location data within the fleet dashboard. You may disable location permissions at the device operating system level, but this will disable route compliance and HOS features.

3.6 EcoScore and Emissions Data

Where EcoRoute features are available, we collect fuel consumption metrics, CO2 emissions estimates per trip, and fleet-wide EcoScore data for ESG compliance reporting.

3.7 Automatically Collected Technical Data

When you access the Service, we automatically collect:

• IP address (used for access security and session management; retained only as long as necessary for these purposes);
• Device type, operating system version, browser type and version;
• Log data including timestamps, pages or screens visited, features accessed, and error events;
• Session identifiers and authentication tokens; and
• Crash reports and performance diagnostics.
• Electronic acceptance records: the date, time, IP address, and account identifier associated with each instance of your acceptance of our Terms of Service, EULA, Order Forms, or other agreements, maintained as evidence of contract formation in accordance with the Electronic Records and Signatures section of our Terms of Service.

3.8 Information from Third Parties

We may receive data about you from:

• Fleet telematics and ELD providers (where integrations are enabled by the fleet operator);
• Load board partners (DAT, Truckstop.com, 123Loadboard) — only where you authorize these integrations;
• Apple App Store or Google Play — limited installation and update metadata; and
• Payment processor — transaction confirmation and fraud signals (no full card data).

3.9 Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

• Essential / Session Cookies (First-Party): Required for core Service functionality, including login session management, authentication tokens, and security features. These cannot be disabled without affecting Service access.
• Preference Cookies (First-Party): Remember your settings and preferences (e.g., dashboard layout, notification preferences). Persist across sessions.
• Analytics Cookies (First- and Third-Party): Collect aggregate, anonymized usage statistics to help us understand how the Service is used and identify areas for improvement. We use tools such as Google Analytics or similar services configured to anonymize IP addresses.
• Security Cookies (First-Party): Used for fraud prevention, bot detection, and session integrity.

We do not use advertising or behavioral tracking cookies. We do not currently respond to browser Do Not Track (DNT) signals.

Cookie Preferences: You can manage non-essential cookies through your browser settings. Note that blocking essential cookies will prevent Service login and functionality.

3.10 Feedback Data

When you voluntarily submit Feedback — as defined in the Feedback section of our Terms of Service — through in-platform feedback tools, the Forum, email to support@haulguard.ai, conversations with HaulGuard AI personnel, survey responses, beta program participation, or any other channel, we collect:

• The content of your feedback submission, including suggestions, bug reports, feature requests, and usability observations;
• The date, time, and channel through which the Feedback was submitted;
• Your account identifier and associated contact information; and
• Any attachments, screenshots, or supporting materials included with your submission.

Important: By submitting Feedback, you grant HaulGuard AI a perpetual, irrevocable, royalty-free worldwide license to use, modify, and commercialize that Feedback without restriction or compensation, as described in the Feedback section of our Terms of Service. Feedback is not treated as confidential. Do not submit Feedback that contains proprietary information, trade secrets, or personally identifiable information of third parties. See Section 8 (Data Retention) for applicable retention periods.

3.11 Forum and Community Data

If HaulGuard AI makes a subscriber forum or community platform (the “Forum”) available, we collect the following information from your Forum activity:

• Posts, replies, and other content you submit to the Forum;
• Profile information you choose to display in the Forum;
• Reaction, vote, and engagement data; and
• Reports of Forum content submitted by other users.

Forum posts may be visible to other registered subscribers. Exercise caution in what personal or business information you include in Forum posts. HaulGuard AI reserves the right to remove Forum content that violates our Terms of Service or applicable law.

4. How We Use Your Information

We use collected information for the following purposes, grouped by function:

4.1 Service Provision and Core Operations

• Creating and managing your account and subscriptions;
• Verifying CDL credentials, endorsements, and driver eligibility for hazmat operations;
• Generating Compliance Records, AI placard determinations, and Evidence Packets;
• Maintaining the cryptographically-verifiable Audit Ledger;
• Enabling fleet dispatch, real-time compliance monitoring, and driver location tracking (for fleet operators); and
• Processing subscription payments through our payment processor.

4.2 Safety and Compliance

• Enforcing Hazmat routing compliance (tunnel bans, restricted zones, permit requirements);
• Sending document expiration alerts at 30, 14, and 7 days before CDL, medical card, Hazmat endorsement, TWIC card, IFTA license, and cab card expirations;
• HOS monitoring and smart break optimization; and
• Supporting DOT roadside inspection documentation.

4.3 AI Model Improvement and Platform Development

We may use de-identified and aggregated data derived from Service usage — including anonymized load patterns, route data, and compliance outcomes — to improve the accuracy and reliability of our AI models, regulatory database, and placard determination algorithms.

4.4 Communications

• Transactional: Account confirmations, billing notices, subscription renewal reminders, and policy change notifications — these cannot be opted out while your account is active;
• Operational: Service status updates, maintenance windows, feature releases, and compliance alerts; and
• Marketing: Product updates, new module announcements, and industry insights — you may opt out at any time (see Section 11).

4.5 Security and Fraud Prevention

• Detecting and investigating unauthorized access, fraud, or misuse;
• Maintaining and improving platform security; and
• Responding to security incidents and data breaches.

4.6 Legal and Regulatory Compliance

• Complying with applicable law, including DOT, FMCSA, and PHMSA recordkeeping requirements;
• Responding to lawful government requests, court orders, or subpoenas;
• Enforcing our Terms of Service, EULA, and dispute resolution provisions (including arbitration proceedings under our Terms of Service); and
• Enforcing our Terms of Service and EULA.

4.7 ESG and Emissions Reporting

Where the EcoRoute module is available, using fleet emissions and fuel data to generate ESG compliance reports for corporate carrier clients.

4.8 Feedback and Forum Data

We use Feedback you submit and Forum content you post to: (a) improve Service features and identify bugs; (b) assess user needs and prioritize product development; (c) develop, modify, adapt, and commercialize new or existing features, consistent with the perpetual license granted in the Feedback section of our Terms of Service; and (d) moderate and maintain the Forum. Feedback is not treated as confidential and may be used without attribution or compensation.

5. Legal Bases for Processing

We process personal data on the following legal bases:

• Contract Performance: Processing necessary to provide the Service you have subscribed to, including Compliance Record generation, credential management, and billing;
• Legal Obligation: Processing required by applicable law, including FMCSA driver qualification recordkeeping (49 CFR Part 391), PHMSA hazmat documentation (49 CFR Parts 171-172), and applicable state regulations;
• Legitimate Interests: Security, fraud prevention, platform improvement using de-identified data, and ensuring the integrity of the Audit Ledger — where such interests are not overridden by your rights; and
• Consent: Where we rely on your consent — including for optional marketing communications and optional push/SMS notifications — you may withdraw consent at any time without affecting prior processing. Note: Use of identifiable personal data for AI model training is not a consent-based activity; it is prohibited outright under the User Content section of our Terms of Service.

6. How We Share Your Information

HaulGuard AI does not sell your personal information to third parties. Period.

We may share information in the following limited circumstances:

6.1 Within Your Fleet Account

When you use the Service through a fleet operator account, the fleet administrator and designated dispatchers may have access to:

• Driver real-time location (GPS data), as configured by the fleet operator;
• HOS status and remaining drive time;
• Driver credential expiration alerts; and
• Compliance Records and attestation records for loads assigned to their fleet.

Individual drivers can see their own data at all times. Fleet account access controls are managed by the fleet account administrator.

Important — Motor Carrier Responsibility: HaulGuard AI shares fleet data with the fleet operator as a documentation and decision-support tool only. As established in our Terms of Service, the motor carrier — not HaulGuard AI — remains the DOT-registered entity responsible for all regulatory compliance, driver qualifications, cargo securement, placarding, and routing. The motor carrier is the Offeror of hazardous materials shipments within the meaning of 49 CFR Part 171 and bears all associated legal responsibilities. Fleet operators are responsible for implementing internal verification procedures to confirm the accuracy of all data accessed through their fleet account before any hazmat shipment departs.

6.2 Service Providers

We share data with trusted third-party vendors that help us operate the Service, under contractual data protection obligations:

• Payment processor (subscription billing and fraud prevention — receives tokenized payment data only);
• Cloud infrastructure and hosting providers (encrypted data storage and processing);
• Analytics providers (receive aggregate, de-identified usage data only — not personal data or load records);
• Mapping and geolocation API providers (receive route and location data to generate maps and route compliance checks);
• Customer support software providers; and
• Email delivery and notification service providers (receive email address and notification content).

All service providers are required by contract to: (a) use data only for the purposes we specify; (b) implement appropriate security safeguards; and (c) not further disclose data to unauthorized parties.

6.3 Legal and Regulatory Disclosure

We may disclose personal data when required by law, including:

• In response to a valid court order, subpoena, or government demand;
• To DOT, FMCSA, PHMSA, or other regulatory authorities in connection with a lawful investigation or enforcement action;
• To comply with mandatory reporting obligations following a hazmat incident; and
• To protect the safety of individuals when we have a good-faith belief that disclosure is necessary to prevent harm.

Where legally permitted, we will notify affected users before disclosing their data in response to government requests.

6.4 Business Transfers

In connection with a merger, acquisition, asset sale, financing, or corporate reorganization involving HaulGuard AI, your information may be transferred to the acquiring entity. We will notify you by email and/or in-platform notice at least thirty (30) days before any such transfer becomes effective, and you will have the ability to close your account if you do not consent.

6.5 With Your Explicit Consent

Where you authorize specific third-party integrations (such as load board connections), we share relevant data with those services only to the extent necessary to fulfill the integration, and only after you enable the integration.

7. De-Identification and Anonymization

HaulGuard AI may create de-identified or aggregated data sets derived from Service usage for product development, industry research, and AI model improvement purposes. De-identified data: (a) does not contain information that can reasonably identify you or any specific driver, load, or shipment; (b) is processed using industry-standard anonymization techniques; and (c) is not subject to re-identification. HaulGuard AI will not attempt to re-identify de-identified data.

8. Data Retention

We retain personal information for the periods described below. Retention periods are based on applicable law, our legitimate business needs, and regulatory recordkeeping requirements. Upon account closure, you have thirty (30) days to export your data before deletion.

Data Category	Retention Period	Legal Basis	Notes
Account & contact info	Duration of account + 3 years	Contract / legal obligation	Deleted on request post-account closure
CDL credentials & endorsements	Duration of account + 1 year min.	FMCSA recordkeeping (49 CFR 391)	May be retained longer per FMCSA
Load manifests & hazmat docs	2 years minimum	49 CFR 172.201 / PHMSA	Carriers may have longer requirements
Compliance Records & Audit Ledger	3 years minimum	FMCSA / PHMSA regulatory; Terms of Service	Immutable ledger; cryptographic chain preserved
Real-time GPS/geolocation	90 days rolling	Legitimate interest / HOS compliance	Historical trip data retained separately
Historical trip & route data	1 year	Service provision / analytics	De-identified after 1 year
EcoScore & emissions data	Duration of account + 1 year	Contract / ESG reporting	Used for ESG report generation
Payment info (tokenized)	Duration of subscription + 7 years	Legal obligation / tax compliance	Full card numbers never stored
Log data & session info	90 days	Security / fraud prevention	Aggregated analytics retained longer
Support communications	3 years	Legitimate interest / contract	Used to resolve disputes
Electronic acceptance records	7 years	Legal obligation / contract formation (E-SIGN Act; Terms of Service)	Evidence of agreement formation; date, time, IP address, account ID
Feedback submissions	Indefinitely	Perpetual license (Terms of Service)	Subject to irrevocable perpetual license grant; may be incorporated into product improvements
Forum posts & community data	Duration of account + 1 year	Legitimate interest / contract	De-identified or deleted after account closure + 1 year; public posts may persist in aggregated form

After the applicable retention period, data is securely deleted or irreversibly anonymized. The Audit Ledger, by design, maintains a cryptographic chain that may preserve certain hashed records even after personal data deletion; however, these records are not personally identifiable after the underlying data is removed.

9. Data Security

HaulGuard AI implements layered administrative, technical, and physical safeguards to protect your information:

• Encryption in transit: All data transmitted between your device and the Service is encrypted using TLS 1.2 or higher;
• Encryption at rest: Sensitive data — including CDL numbers, credential data, and load manifests — is encrypted at rest using AES-256 or equivalent;
• Audit Ledger integrity: Compliance Records and Audit Ledger entries are cryptographically chained, making unauthorized modification detectable;
• Access controls: Role-based access controls (RBAC) ensure that only authorized personnel and fleet administrators can access specific data;
• Security assessments: We conduct regular internal security reviews and periodic third-party security assessments;
• Incident response: We maintain a documented incident response plan; and
• Employee training: HaulGuard AI personnel with access to personal data are required to complete data security training.

No security system is completely impenetrable. In the event of a data breach that triggers notification obligations under applicable law (including applicable state data breach notification laws and, where applicable, FMCSA regulations), we will notify affected users and regulators within the legally required timeframe.

10. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you, in a portable format;
• Correction: Request correction or update of inaccurate or incomplete information;
• Deletion (“Right to be Forgotten”): Request deletion of your personal information, subject to our legal retention obligations (including FMCSA and PHMSA recordkeeping requirements, which may require us to retain certain data);
• Data Portability: Request your data in a structured, machine-readable format (JSON or CSV);
• Restriction: Request that we limit processing of your data in certain circumstances;
• Objection: Object to processing based on legitimate interests;
• Opt-Out of Marketing: Unsubscribe from promotional emails using the unsubscribe link in any marketing email, or by contacting support@haulguard.ai; and
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@haulguard.ai with subject line “Privacy Rights Request.” We will verify your identity and respond within thirty (30) days (or sixty (60) days for complex requests with written notice of the extension). We will not discriminate against you for exercising your privacy rights.

11. Communications Preferences

11.1 Email

Transactional emails (billing, account security, document expiration alerts) are essential to the Service and cannot be opted out while your account is active. Marketing and product update emails include a one-click unsubscribe link in every message. You may also update your email preferences in your account settings.

11.2 Push Notifications

The HaulGuard AI mobile application may request permission to send push notifications for compliance alerts, document expiration reminders, and route updates. You can manage push notification permissions in your device’s operating system settings at any time.

11.3 SMS / Text Messages

HaulGuard AI may offer optional SMS alerts for critical compliance events (e.g., approaching CDL expiration, hazmat route alerts). SMS notifications require your express opt-in consent. Standard messaging rates from your carrier may apply. To opt out of SMS notifications, reply STOP to any SMS message from HaulGuard AI, or update your preferences in your account settings.

12. California Privacy Rights (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it;
• Right to Delete: You may request deletion of personal information we have collected, subject to legal exceptions;
• Right to Correct: You may request correction of inaccurate personal information;
• Right to Opt-Out of Sale or Sharing: HaulGuard AI does not sell personal information. We do not share personal information for cross-context behavioral advertising. You may submit a “Do Not Sell or Share My Personal Information” request at support@haulguard.ai, which we will honor even though we do not engage in such activities;
• Right to Limit Use of Sensitive Personal Information: CDL numbers and government-issued identification numbers are sensitive personal information under CPRA. HaulGuard AI uses this data solely to provide the Service. You may request limitation of this use at support@haulguard.ai; and
• Right to Non-Discrimination: We will not discriminate against you for exercising CCPA/CPRA rights.

To submit a California privacy rights request: email support@haulguard.ai with subject line “California Privacy Request” or call +1 (623) 462-3405.

13. Other U.S. State Privacy Rights

Residents of the following states may have additional privacy rights under applicable state law:

13.1 Virginia (VCDPA)

Virginia residents may have rights to access, correct, delete, and port their personal data, to opt out of profiling for decisions that produce legal or significant effects, and to opt out of targeted advertising (which we do not conduct). Contact us to exercise these rights.

13.2 Colorado (CPA)

Colorado residents have rights to access, correct, delete, and port personal data, and to opt out of targeted advertising and profiling (which we do not conduct). Contact us to exercise these rights.

13.3 Connecticut (CTDPA)

Connecticut residents have rights to access, correct, delete, and port personal data, and to opt out of targeted advertising (which we do not conduct). Contact us to exercise these rights.

13.4 Texas (TDPSA)

Texas residents have rights to access, correct, delete, and port personal data, and to opt out of targeted advertising and profiling (which we do not conduct). Contact us to exercise these rights.

13.5 Other States

As additional state privacy laws take effect, HaulGuard AI will update this Policy. For all states, our primary commitment is: we do not sell personal data, we do not engage in targeted advertising, and we honor verifiable consumer rights requests within applicable legal timeframes.

To exercise rights under any applicable state law, contact us at support@haulguard.ai.

14. Data Processing Addendum (DPA) for Fleet Customers

Fleet operators and commercial customers who process personal data (including driver CDL records, HOS logs, and geolocation data) through the Service may act as data controllers with respect to their drivers’ personal data, with HaulGuard AI acting as a data processor on their behalf.

Consistent with our Terms of Service, upon request HaulGuard AI will enter into a Data Processing Addendum (DPA) that supplements these Terms with specific obligations governing all of the following:

• Data processing instructions and purpose limitation;
• Subprocessor management and disclosure;
• Data subject rights assistance (access, correction, deletion, portability);
• Security incident notification timelines and procedures;
• Data transfer mechanisms for any cross-border processing; and
• Audit rights and compliance certifications.

To request a DPA, email support@haulguard.ai with subject line “DPA Request.”

15. Children’s Privacy

The Service is directed exclusively at commercial transportation professionals and is not intended for individuals under 18 years of age. HaulGuard AI does not knowingly collect personal information from minors. If we learn that we have inadvertently collected information from a minor, we will delete it promptly. If you believe we may have information about a minor, contact support@haulguard.ai immediately.

16. International Users

The Service is designed for and directed at users located within the United States. If you access the Service from outside the United States, you acknowledge that: (a) your information will be transferred to and processed in the United States; (b) U.S. data protection laws may differ from those in your jurisdiction; and (c) by using the Service, you consent to this transfer and processing. HaulGuard AI does not actively market the Service outside the United States.

17. Links to Third-Party Services

The Service may contain links to or integrations with third-party websites, load boards, and services (including DAT, Truckstop.com, mapping providers, and ELD vendors). HaulGuard AI is not responsible for the privacy practices, data collection, or security of any third-party service. We encourage you to review each third party’s privacy policy before enabling integrations.

18. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our data practices, the Service, or applicable law. We will:

• Post the updated Policy on our website at haulguard.ai/privacy;
• Update the “Effective Date” at the top of the Policy;
• Notify you by email to your registered address and/or by in-platform notice at least thirty (30) days before material changes take effect; and
• For significant changes to how we use your personal data, request your affirmative acknowledgment where required by law.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Policy.

19. Dispute Resolution for Privacy Matters

Any dispute, claim, or controversy arising out of or relating to this Privacy Policy, including disputes regarding our data collection, use, retention, or disclosure practices, is subject to the Governing Law and Dispute Resolution provisions set forth in our Terms of Service, which are incorporated herein by reference.

This means that privacy-related disputes are governed by Arizona law, are subject to mandatory informal dispute resolution before formal proceedings may begin, and will be resolved through binding individual arbitration administered by the American Arbitration Association (AAA) unless an exception applies. Class action and collective proceedings are waived. Emergency injunctive relief may be sought in courts located in Maricopa County, Arizona.

To initiate informal resolution of a privacy dispute, contact us at support@haulguard.ai with subject line “Formal Dispute Notice — Privacy” and include the information required by the Informal Dispute Resolution section of our Terms of Service.

20. Contact Us

If you have questions, concerns, or privacy rights requests regarding this Privacy Policy or our data practices, please contact HaulGuard AI’s privacy team:

HaulGuard AI LLC — Privacy
5830 W Thunderbird Rd, Ste B8-142
Glendale, AZ 85306
Email: support@haulguard.ai (subject: “Privacy Inquiry”)
Phone: +1 (623) 462-3405
Website: haulguard.ai

We will respond to all privacy inquiries within thirty (30) days.