Privacy Policy

1. Who this policy covers, and our role

“Personal Information” means information about an identifiable individual. This policy covers three groups of people:

• Subscribers and their users—the people who sign up for SCM for their business, and the administrators, staff and drivers whom a subscriber lets into its account.
• Visitors to our websites, including people who contact us.
• Individuals whose information a subscriber puts into SCM—for example, a motor carrier’s drivers, job applicants and employees (“Carrier Personal Information”).

Our role differs by group. For subscribers, users and visitors, we decide why and how their information is used, and we are responsible for it. For Carrier Personal Information, the subscribing carrier is the organization that collects it and decides what to do with it; we hold and process it on the carrier’s behalf and on its instructions, to provide the Service. If you are a driver or applicant and want to see, correct or ask about your information in a carrier’s account, please contact that carrier first; we will help the carrier respond.

2. Information we collect

Information you give us or that a subscriber enters:

• Account and company information: the company’s name, any “doing business as” name, USDOT and MC numbers, operating authority, physical and mailing addresses, plan, and the name, work email address, telephone number and role of each user. Your password is stored only as a one-way cryptographic hash, never in readable form.
• Carrier registry information: when you enter a USDOT number we may retrieve public carrier registry information (such as name, address, telephone number, status and fleet size) from government and public data sources to prefill your account.
• Billing information: your plan, billing period, invoices, payment status, tax amounts, and the brand, last four digits and expiry date of your payment card. Card numbers are collected and held by our payment processor, Stripe, and we do not store full card numbers.
• Carrier Personal Information that a subscriber chooses to enter, which can include, depending on the features used: a person’s name, contact details, date of birth, driver’s licence number, state or province, class and expiry date, medical certificate expiry date and notes, photographs and uploaded documents (such as a licence or medical card), job application details (employment, residence, driving, accident and violation histories, equipment experience, hours-of-service information and statements), drug and alcohol testing records and Clearinghouse query records, training and quiz records, policy acknowledgements, incident reports, warning letters, and the signatures given on documents (typed or drawn).
• Information about vehicles, equipment, permits and insurance policies, which may identify an owner-operator or other individual.
• SCM driver identity information: where a driver has an SCM identity, the driver’s profile information, the email address used to verify them (including one-time verification codes we send), their sharing choices and consents, and an access log of who has seen what.
• Insurance submissions that a carrier chooses to send to an insurance provider or broker, and the provider’s responses.
• Communications: messages you send through our contact form (name, email, telephone, company, message), emails, and notes of support conversations.
• Referral information: if an independent agent referred you, the agent’s identification number.

Information collected automatically:

• Security and technical information: the internet address (IP address) and browser type used when you sign in, sign a document or accept the Terms; records of sign-in attempts (used to block repeated failed attempts); session records; and records of important actions taken in the Service (who did what, and when).
• Support records: when our staff or an independent agent open a support session for an account, we log who did, when, and any change they made.
• Cookies and similar technology, described in Section 7 (Cookies and similar technology).

Information from others: we may receive information from your employer or carrier (if you are a driver, applicant or employee), from other carriers when a driver chooses to share their profile, from public government data sources, from our payment processor about payment status, and from insurance providers about submissions.

Some of this information is sensitive—for example, medical certificate information, drug and alcohol testing records, and employment history. The carrier that enters it is responsible for having the right to do so and for any consent that is required. We treat all Carrier Personal Information as confidential and limit access to it as described in this policy.

3. How we use Personal Information

We use Personal Information to:

• create and run your account, authenticate users, and provide the features you have chosen;
• process subscriptions, payments, taxes and invoices, and manage plan limits and account status;
• send service messages—for example, receipts, renewal and payment notices, security notices, one-time codes, account changes, and compliance alerts and reminders that you have set up;
• respond to your questions and provide support, including by opening a support session when needed;
• keep the Service secure: preventing fraud and abuse, detecting and investigating suspicious activity, limiting repeated sign-in attempts, and keeping audit records;
• maintain, test, troubleshoot and improve the Service, using information in a way that does not identify you where we can;
• keep records of your acceptance of our Terms and this Privacy Policy;
• pay referral commissions to independent agents; and
• meet our legal obligations, enforce our terms, and establish, exercise or defend legal claims.

We do not sell Personal Information. We do not use Personal Information for advertising, we do not build advertising profiles, and we do not make decisions that have legal or similarly significant effects on individuals solely by automated means. Alerts and reminders in the Service are aids for the carrier’s own judgment.

If we send promotional messages, we will do so only with the consent the law requires, and each will include an easy way to unsubscribe. You cannot opt out of service messages while you use the Service.

4. Consent and legal basis

We collect, use and share Personal Information with your consent, which may be express (for example, ticking a box or submitting a form) or implied (for example, when you give us information to receive a service). We may also act without consent where the law permits or requires it, such as to comply with a legal obligation or protect against fraud. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, by contacting us as described in Section 15 (Contact us); if you do, we may be unable to provide some or all of the Service.

A carrier that enters Carrier Personal Information is responsible for giving individuals the notices and obtaining the consents that the law requires for its own collection and use of that information, including for background, driving-record and drug and alcohol testing, for electronic signatures, and for any sharing it chooses to make.

5. Who we share Personal Information with

We share Personal Information only as described here:

• Service providers who help us run the Service, under obligations to protect the information and use it only for our purposes. At the date of this policy these are: Stripe (payment processing and subscription billing); Resend (email delivery); Neon (database hosting); and Vercel (application hosting and file storage). We may change providers, and we will keep this list current in these categories.
• Insurance providers and brokers, but only when a carrier chooses to submit information to them through the Service. They are independent organizations that handle the information under their own policies.
• Other carriers, but only when a driver with an SCM identity chooses to share their profile with that carrier and the driver’s consent is recorded.
• The independent agent assigned to a subscriber’s account, if any. The agent may see the account’s company and contact details (company name, SCM ID, contact name, email address, telephone number and address), the plan and subscription status, and our payments to the agent. An agent may also help the subscriber by opening a support session on the account; a support session can show the records on the pages that support is allowed to open, which can include Carrier Personal Information. Support sessions are logged, are read-only unless they are expressly editing sessions, and agents are required to keep what they see confidential.
• Our professional advisers (such as lawyers, accountants and auditors) and insurers, under duties of confidentiality.
• Government, regulators, courts and law enforcement, where we are required or permitted by law to do so—for example, to respond to a valid legal demand—or to protect our rights, safety or property, or those of our users or others.
• A successor, in connection with a merger, financing, acquisition or sale of all or part of our business, where the recipient agrees to protect the information in a way consistent with this policy.
• Anyone else, with your consent.

Within a subscriber’s account, administrators decide what other users of that account—such as staff and drivers—can see. We cannot control how a subscriber or its users use the information they can see.

6. SCM driver identities and profile sharing

A driver may have an SCM identity and a reusable profile of their own information. A driver’s profile information is not copied to a carrier automatically. It moves only when the driver chooses to share it, after we have verified, using a one-time code sent to the driver’s email address, that the person is who they say they are. Each share is based on the driver’s consent, and we keep an access log that records who accessed shared information and when; that log cannot be edited through the Service. A driver’s identity belongs to the driver, not to any carrier.

7. Cookies and similar technology

We use only what is needed to operate the Service:

• A sign-in (session) cookie that keeps you signed in. It is strictly necessary, is not readable by scripts on the page, and expires after up to 30 days or when you sign out. We store only an irreversible digest of the session code on our side.
• Your browser’s local storage, to remember small display preferences, such as which menu groups you have opened or closed. It is not used to identify you and is not sent to us.

We do not use advertising cookies, we do not use third-party analytics or tracking tools, and we do not track you across other websites. Our payment provider’s hosted checkout pages may set their own cookies under their own policies. If we add analytics or other optional cookies in future, we will update this policy and, where the law requires, ask for your consent first. You can block or delete cookies in your browser, but the Service will not work without the sign-in cookie.

8. Where information is stored and sent

Our hosting and service providers store and process information in the United States and may do so in other countries. As a result, Personal Information may be transferred to, stored and processed in places outside your province or country, where the privacy laws may differ from yours and where courts, law enforcement and national security authorities may be able to access it under local laws. We use contracts and the safeguards described in Section 10 (How we protect information) to protect information that is transferred. If you have questions about our service providers outside Canada, contact us as described in Section 15 (Contact us).

9. How long we keep information

We keep Personal Information only as long as needed for the purposes described in this policy, and as the law requires or permits.

• Account and Carrier Personal Information: while the subscriber’s account is active. After the subscription ends, the Terms give the subscriber thirty (30) days to ask for an export of its data; after that we may delete or anonymize it, and copies in our backups are overwritten in the ordinary course. Carriers decide how long to keep individual records within their account while it is active, and are responsible for any retention period the law requires of them.
• Billing and tax records: for as long as tax and accounting law requires (generally six years in Canada).
• Records of acceptance of our Terms and Privacy Policy, security logs and audit records: as long as needed to protect the Service and to establish, exercise or defend legal claims.
• Session records: they expire after 30 days and are removed on a rolling basis.
• SCM driver identity profiles and sharing records: until the driver asks us to delete the identity, subject to records we are required to keep.
• Contact-form messages and support correspondence: for as long as needed to respond and to keep a record of our dealings with you.

10. How we protect information

We use safeguards appropriate to the sensitivity of the information, including: encrypted connections between your browser and the Service; one-way hashing of passwords; role-based access so that users see only what their role allows; limits on repeated failed sign-in attempts; validation of uploaded files; recording of important actions; restricted, logged support access; and the physical and technical security of our hosting providers. We limit staff access to Personal Information to people who need it for their work and who are bound to keep it confidential.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your password confidential and tell us promptly if you think your account has been accessed without permission. If a breach of security safeguards involving Personal Information creates a real risk of significant harm, we will notify affected subscribers and, where the law requires, the Privacy Commissioner and affected individuals, as soon as feasible.

11. Your choices and rights

Subject to the law, you may ask us to:

• tell you whether we hold Personal Information about you, and give you access to it and an account of how we use and share it;
• correct information that is inaccurate or incomplete;
• delete your information, or limit how we use it, where we no longer need it or are not required to keep it;
• stop using or sharing your information based on consent you have given, or give you a copy of information you provided in a common format, where the law gives you that right.

To make a request, contact us as described in Section 15 (Contact us). We may need to verify your identity first, and we may need to refer you to the carrier that controls the information. We will respond within thirty (30) days (or tell you why we need longer). We do not usually charge for a request, and will tell you in advance if a fee applies. We may refuse a request in the limited cases the law allows—for example, if it would reveal information about another person, or the information is subject to legal privilege—and if so we will explain why.

Residents of other jurisdictions: some laws (for example, certain U.S. state privacy laws) give residents additional rights over their Personal Information. We do not sell Personal Information or share it for cross-context behavioural advertising, and we will honour requests under those laws to the extent they apply to us. We do not direct the Service to individuals in the European Economic Area or the United Kingdom.

If you are not satisfied with how we have handled your information, please contact us first so we can try to resolve it. You may also contact the Office of the Privacy Commissioner of Canada, or the privacy regulator in your province or state.

12. Children

The Service is for business use and is not directed to anyone under 16. We do not knowingly collect Personal Information from children. If you believe a child’s information has been entered into the Service, please contact us and we will take steps to delete it.

13. Links to other websites

The Service may link to websites run by others, such as government registries and our payment provider. We do not control them and are not responsible for their privacy practices. Please read their policies.

14. Changes to this policy

We may update this policy from time to time. Each version shows its version number and effective date. When we publish a new version, we will ask an Administrator of each subscriber to review and accept it before continuing into the portal, as described in our Terms and Conditions of Use, and we will keep the current version on our website. If we make a material change to how we use Personal Information that we already hold, we will tell you before the change applies to that information.

15. Contact us

Questions, requests and complaints about privacy can be sent to our Privacy Officer at Data Assent Limited:

You can also reach us through the Contact page on our website.