Privacy Policy

This policy explains what TruePermit (“we”, “us”), the operator of truepermitdot.com, mailing address 1122 East Elk Avenue, Glendale, CA 91205, United States, collects about you, why, who processes it for us, how long we keep it, and the choices and rights you have. It covers the website, the free compliance tools, the account dashboard, our emails, and the public lookups. It is written for the motor carriers and fleet staff who use the service; it applies to anyone who visits.

• Account details: name, email address and a password stored only as a salted scrypt hash, or your Google account identity if you sign in with Google. We never see your Google password.
• Carrier and fleet data you enter: USDOT and MC numbers, legal and DBA names, the states you run, vehicles and VINs, drivers' names and license details where you add them, credentials and permits with their dates.
• Files you upload: ELD state-mileage exports, fuel-card statements (CSV, Excel or PDF), permits, insurance certificates and other compliance documents, and everything we extract from them: trips, fuel purchases, odometer readings.
• Public agency records about your carrier: the FMCSA registration, authority, MCS-150 and safety record we fetch for the USDOT numbers you check or add.
• Billing records: your plan, invoices, and the subscription identifiers Dodo Payments gives us. Card numbers never reach us.
• Messages: what you send through the contact form, by email, or to the AI Copilot.
• Technical data: server logs with IP address, browser type, pages requested and timing, kept for security and reliability, and a session cookie that keeps you signed in.

We also send informational emails to motor carriers whose business contact details appear in the public FMCSA registration data, for example about an upcoming IFTA quarter or a UCR fee change. Those emails come from the news.truepermitdot.com domain, carry a one-click unsubscribe link and a postal address, and stop for good when you unsubscribe or reply “stop”; we also stop automatically after a few unanswered messages. We do not buy contact lists and do not send to addresses outside the United States.

We use data to run the service for you and for nothing else:

• determine which obligations apply to your carrier and compute IFTA and state weight-distance taxes from your files;
• keep your trips, fuel and documents on file for the audit window and let you export them;
• send the deadline alerts, import results and account emails you asked for;
• answer questions in the AI Copilot using your own data;
• bill your subscription, prevent abuse of the public lookups, and keep the service secure;
• understand which pages are used, in aggregate, so we can improve them.

We do not sell or rent personal information, do not share it for cross-context advertising, and do not use your data to train AI models. Our AI provider processes your requests under terms that forbid training on them.

We set one first-party cookie, tp_session, which keeps you signed in and is strictly necessary. Page analytics come from Vercel Web Analytics and Speed Insights, which measure visits and page speed in aggregate without cookies or cross-site identifiers. We do not run advertising pixels or third-party trackers. Because we use no tracking cookies, there is no cookie banner to click through.

These providers process data on our instructions, under their own data-processing terms, and only for the purpose listed:

• Vercel (hosting, serverless functions, private file storage for your uploaded documents, analytics) and Neon (the Postgres database), both in the United States.
• FMCSA (US DOT): we look up your carrier's public registration and safety record by USDOT number.
• Anthropic (Claude): the AI Copilot and the reading of PDF statements and documents you upload. Only the content needed for your request is sent; Anthropic does not train on it.
• HERE: geocoding and truck-legal routing for the addresses and trips you enter.
• NHTSA vPIC: decoding of VINs you enter.
• Resend (via Amazon SES): delivery of account, alert and informational emails.
• Dodo Payments: merchant of record for subscriptions; holds your card and billing details.
• Google: only if you sign in with Google, or when we exchange email with you from our Google Workspace mailbox.
• Upstash: a short-lived counter used to rate-limit the public lookups by IP address.

We may also disclose data when the law requires it, to protect the service or its users from abuse, or to a successor that takes over the service under this policy.

• Account, carrier, trips, fuel and documents: for as long as your account is open. IFTA and weight-distance audits reach back four years, which is why the archive keeps every quarter until you remove it or close the account.
• After you close your account: we delete your account and carrier data within 30 days, and it leaves encrypted backups within 90 days. Invoices stay with Dodo Payments as long as tax law requires.
• Server logs and lookup counters: days to a few weeks.
• Emails you send us: as long as needed to answer and to keep a record of the conversation.
• Unsubscribe requests: indefinitely, so we never email you again.

All traffic is encrypted in transit (TLS, HSTS). Passwords are stored as salted scrypt hashes; sessions are random tokens stored hashed. Uploaded documents live in a private store that is not publicly addressable. Access to production systems is limited to the people who operate the service. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

Whoever you are and wherever you live, you can:

• see and export your data: your dashboard shows it, and the audit archive downloads each quarter as CSV;
• correct anything in the dashboard, or ask us to;
• delete your account and data by emailing support@truepermitdot.com from the account's address;
• stop emails: alert settings live in the dashboard; informational emails have an unsubscribe link, or reply “stop”;
• ask questions or complain at the same address.

We answer requests within 30 days and may ask you to confirm your identity first. We never charge for a request or treat you differently for making one.

In the past 12 months we collected the categories listed in section 2: identifiers, commercial information, professional information, internet activity and the content you upload. We use them for the business purposes in section 4 and disclose them only to the service providers in section 6. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months; we do not knowingly collect information about anyone under 16. You have the right to know, access, correct and delete your personal information, the right to opt out of sale or sharing (which we do not do), and the right not to be discriminated against for exercising these rights. Exercise them by emailing support@truepermitdot.com; an authorized agent may act for you with written permission.

The service is built for US motor carriers and our systems run in the United States. If you use it from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States and we rely on the contract with you (to provide the service), our legitimate interests (security, improvement, business communication) and your consent (optional emails) as legal bases. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority. Contact support@truepermitdot.com.

The service is for businesses and adults working in them. We do not knowingly collect information from anyone under 18; if you believe a minor has given us data, email us and we will delete it.

We update this policy when the service or the law changes and move the “Last updated” date above. For changes that reduce your rights or widen what we collect, we email account holders at least 14 days before the change takes effect.

Privacy questions and requests: support@truepermitdot.com, the contact form, or by mail to TruePermit, 1122 East Elk Avenue, Glendale, CA 91205, United States.