Privacy Policy

AltaForm LLC (“AltaForm,” “we,” “us,” or “our”) owns and operates Derekto, a transportation management software platform.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

visit the Derekto website;
create or use a Derekto account;
use the Derekto web or mobile applications;
join a waitlist, early-access program, or founder program;
communicate with us;
request support or a demonstration;
purchase or use a Derekto subscription; or
otherwise interact with Derekto.

In this Privacy Policy, “Derekto” and the “Service” include the Derekto website, web application, mobile applications, APIs, software, communications, and related services provided by AltaForm.

This Privacy Policy should be read together with the Derekto Terms of Service.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information that AltaForm collects:

directly from website visitors, prospective customers, account holders, and authorized users;
automatically through the website, web application, mobile applications, and connected devices;
from customers that use Derekto to manage their transportation operations;
from third-party services and integrations authorized by a customer; and
from communications, support requests, demonstrations, events, and business interactions.

This Privacy Policy does not apply to websites, software, or services operated by third parties, even when they are connected to Derekto.

Third-party services are governed by their own privacy policies.

2. Our Role When Processing Information

Derekto processes personal information in different capacities depending on the circumstances.

2.1 Information We Collect Directly

When we collect information directly from:

website visitors;
account owners;
prospective customers;
billing contacts;
support contacts;
waitlist participants;
job applicants; or
other people who communicate directly with AltaForm,

AltaForm generally determines why and how that information is processed.

In privacy-law terminology, AltaForm may act as a “controller” or “business” for this information.

2.2 Information Controlled by Derekto Customers

A trucking company, carrier, dispatch company, freight broker, logistics provider, or other organization using Derekto may upload or generate information about:

drivers;
employees;
contractors;
owner-operators;
customers;
brokers;
shippers;
consignees;
vendors;
contacts; and
other individuals involved in its operations.

For this information, the Derekto customer generally determines why the information is collected and how it is used.

AltaForm processes that information on the customer’s behalf to provide the Service.

In privacy-law terminology, AltaForm may act as a “processor” or “service provider” for this information, while the customer acts as the “controller” or “business.”

If your information was entered into Derekto by your employer, contracting company, motor carrier, dispatcher, broker, or another Derekto customer, you should generally direct privacy requests to that organization.

AltaForm will assist customers with verified privacy requests when required by law and contract.

3. Information We Collect

The information we collect depends on how you interact with Derekto and which features are enabled.

3.1 Account and Identity Information

We may collect:

first and last name;
username;
business email address;
telephone number;
job title;
company name;
business address;
profile photograph;
account identifier;
authentication information;
user role;
account permissions; and
communication preferences.

Passwords are stored using security protections designed to prevent us from viewing the original password.

3.2 Company and Fleet Information

Customers may provide:

legal and trade names;
business addresses;
USDOT and motor carrier numbers;
tax identifiers;
operating authority information;
insurance information;
fleet size;
equipment information;
truck and trailer identifiers;
vehicle identification numbers;
license plate information;
registration information;
driver assignments;
terminal information; and
other operational business information.

3.3 Driver, Employee, and Contractor Information

Depending on customer use and configuration, Derekto may process:

name;
telephone number;
email address;
driver identification number;
employee or contractor identifier;
commercial driver’s license information;
driver assignment information;
emergency or business contact information;
employment or contractor status;
vehicle assignments;
load assignments;
dispatch activity;
availability information;
operational performance records;
uploaded documents;
settlement information;
expense information;
communications; and
location information.

Customers are responsible for determining which information they enter into Derekto and for providing required notices to their drivers, employees, and contractors.

3.4 Load and Shipment Information

We may process:

load numbers;
shipment numbers;
broker information;
shipper and consignee information;
pickup and delivery addresses;
appointment dates and times;
commodity descriptions;
cargo weight;
equipment requirements;
rate information;
accessorial charges;
special instructions;
routing information;
status events;
delivery information;
notes;
communications; and
related operational records.

3.5 Documents and Files

Customers and users may upload or generate:

rate confirmations;
bills of lading;
proofs of delivery;
invoices;
receipts;
permits;
insurance documents;
registration documents;
driver documents;
equipment documents;
contracts;
spreadsheets;
photographs;
scanned documents;
settlement statements;
expense records; and
other transportation or business documents.

Documents may contain personal information selected and provided by the customer or user.

3.6 Location Information

Certain Derekto features may collect or process location information from:

mobile devices;
browsers;
customer-entered addresses;
connected telematics services;
authorized third-party integrations;
GPS signals;
network information; or
other location-enabled systems.

Location information may include:

precise or approximate latitude and longitude;
device location;
truck or driver location;
date and time of location events;
route history;
geofence entries and exits;
estimated arrival or departure events;
pickup and delivery location activity; and
location accuracy information.

When enabled, the Derekto mobile application may collect location information while the application is open or running in the background.

Background location collection occurs only when:

the applicable customer has enabled a location-based feature;
the user has granted the required device permission; and
the device operating system allows the collection.

Location information may be used to:

display operational locations;
support dispatch and tracking;
detect estimated arrivals and departures;
create geofence events;
calculate estimated arrival times;
provide operational notifications;
associate activity with a load or stop;
troubleshoot location-related features;
protect the security and integrity of the Service; and
provide other location-based functionality requested by the customer.

Derekto does not sell precise location information.

We do not use driver or fleet location information for third-party behavioral advertising.

A user may disable mobile location permissions through device settings. Disabling location permissions may prevent tracking, geofence, arrival, departure, and related features from functioning.

3.7 Payment and Billing Information

When a customer purchases a subscription, we or our payment processor may collect:

billing name;
billing address;
payment method;
payment status;
transaction information;
invoice information;
subscription level;
fleet size;
Active Truck count;
tax information; and
partial payment-card information, such as card type and last four digits.

Full payment-card numbers are generally collected and processed directly by our payment processor rather than stored by AltaForm.

Payment processing is also subject to the payment processor’s privacy policy and terms.

3.8 Communications

We may collect information when you:

contact support;
request a demonstration;
send us an email;
use in-product messaging;
respond to a survey;
join a waitlist;
report a problem;
submit feedback; or
otherwise communicate with us.

This may include:

contact information;
message content;
attachments;
support history;
technical details;
feedback;
call or meeting notes; and
information needed to respond to your request.

We will provide any legally required notice before recording a telephone or video call.

3.9 Device, Log, and Usage Information

When you access Derekto, we may automatically collect:

IP address;
browser type;
operating system;
device type;
device identifiers;
application version;
language settings;
approximate location derived from IP address;
referring URL;
pages or screens viewed;
features used;
buttons clicked;
session dates and times;
error reports;
crash information;
performance data;
authentication events;
security events;
API activity;
integration activity; and
other technical and usage information.

We use this information to operate, secure, maintain, troubleshoot, understand, and improve Derekto.

3.10 Information From Third Parties

We may receive information from:

a Derekto customer;
account administrators;
authorized users;
customer-selected integrations;
mapping and routing providers;
telematics providers;
accounting platforms;
electronic logging providers;
payment processors;
communication providers;
document-processing providers;
identity and security providers;
analytics providers;
business partners;
public databases; and
other services authorized by a customer or user.

Information received from third parties depends on the applicable integration, permission, and third-party service.

4. Automated Document Processing

Derekto may use automated technologies, including optical character recognition and other data-extraction tools, to read and process uploaded documents.

These tools may attempt to identify or extract:

names;
addresses;
telephone numbers;
email addresses;
company information;
load numbers;
dates;
appointment times;
rates;
charges;
mileage;
equipment information;
instructions;
reference numbers; and
other document fields.

Extracted information may be stored in the customer’s Derekto account and associated with a load, contact, invoice, settlement, or other record.

Automated extraction may contain mistakes. Customers and users are responsible for reviewing extracted information before relying on it.

We may use automated processing to improve accuracy, detect errors, organize records, prevent fraud, generate alerts, and provide requested functionality.

We do not use automated processing to make legally binding employment, credit, insurance, or eligibility decisions about individuals on behalf of Derekto customers.

5. How We Use Personal Information

We may use personal information to:

5.1 Provide the Service

create and administer accounts;
authenticate users;
provide transportation management features;
process and organize customer records;
display loads, stops, vehicles, drivers, invoices, and settlements;
support document uploads and extraction;
provide mobile features;
process location events;
operate integrations;
calculate subscription usage;
provide reports and exports; and
perform customer instructions.

5.2 Communicate With Users and Customers

respond to questions;
provide support;
send account notifications;
send operational alerts;
communicate about service incidents;
provide billing notices;
send security alerts;
communicate product changes;
schedule demonstrations; and
administer early-access or founder programs.

5.3 Process Payments

process subscription payments;
issue invoices;
calculate applicable fees;
administer discounts;
determine subscription tiers;
detect failed payments;
prevent billing fraud; and
maintain transaction records.

5.4 Secure and Protect Derekto

detect unauthorized access;
prevent fraud and abuse;
investigate suspicious activity;
enforce permissions;
protect Customer Data;
monitor system integrity;
debug errors;
maintain audit logs;
enforce our Terms of Service; and
protect users, customers, AltaForm, and third parties.

5.5 Maintain and Improve the Service

understand feature usage;
diagnose technical issues;
improve performance;
develop new functionality;
improve document extraction;
improve user experience;
test features;
perform quality assurance;
analyze service trends; and
create aggregated or de-identified analytics.

Where reasonably possible, we use aggregated or de-identified information for product analytics and service improvement.

We do not sell Customer Data or use identifiable driver location histories for advertising.

5.6 Comply With Law

respond to valid legal requests;
comply with court orders;
enforce legal rights;
resolve disputes;
maintain legally required records;
meet tax and accounting obligations;
investigate unlawful activity; and
protect the safety, rights, and property of AltaForm, customers, users, and others.

5.7 Marketing

We may use business contact information to:

provide requested product information;
follow up on demonstrations;
communicate with waitlist participants;
send product announcements;
provide educational content; and
promote Derekto services.

You may unsubscribe from marketing emails using the unsubscribe link in the message.

Unsubscribing from marketing does not prevent us from sending necessary account, billing, legal, security, or operational communications.

6. Legal Bases for Processing

Where applicable law requires a legal basis, we process personal information based on one or more of the following:

performance of a contract;
steps requested before entering into a contract;
legitimate business interests;
compliance with legal obligations;
protection of legal rights;
consent;
protection of the vital interests of a person; or
another basis permitted by applicable law.

Our legitimate interests may include:

providing and improving Derekto;
protecting the Service;
preventing fraud;
supporting customers;
administering business relationships;
communicating about products;
understanding product performance; and
enforcing agreements.

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect processing that occurred before consent was withdrawn.

7. How We Disclose Personal Information

We may disclose personal information as described below.

7.1 To the Derekto Customer

If you use Derekto through your employer, motor carrier, dispatch company, broker, logistics provider, or another organization, that customer and its authorized administrators may access information associated with your use of the Service.

Depending on permissions and customer configuration, this may include:

account information;
driver information;
load assignments;
activity records;
documents;
communications;
location information;
status events;
operational history; and
other information associated with the customer’s account.

The customer controls its users, permissions, and internal use of this information.

7.2 Service Providers and Subprocessors

We may use service providers to perform functions such as:

cloud hosting;
database hosting;
data storage;
software infrastructure;
cybersecurity;
error monitoring;
analytics;
email delivery;
text messaging;
push notifications;
customer support;
mapping and routing;
document processing;
identity and authentication;
payment processing;
subscription management;
accounting; and
professional services.

These providers may process information only as necessary to provide contracted services to AltaForm and are subject to contractual or legal obligations.

A current list of material subprocessors may be provided to customers upon request or made available through Derekto’s legal or trust resources.

7.3 Customer-Authorized Integrations

When a customer enables a third-party integration, we may exchange information with that provider as needed to operate the integration.

The customer is responsible for reviewing and approving the third party’s terms and privacy practices.

7.4 Business Transactions

We may disclose information in connection with:

a financing;
merger;
acquisition;
corporate reorganization;
sale of assets;
investment;
bankruptcy;
due diligence process; or
transfer of all or part of the Derekto business.

Where required, we will provide notice before personal information becomes subject to materially different privacy practices.

7.5 Legal and Safety Reasons

We may disclose information when we reasonably believe disclosure is necessary to:

comply with applicable law;
respond to a subpoena, warrant, court order, or other valid legal process;
respond to lawful requests from government authorities;
investigate fraud, abuse, or unlawful conduct;
enforce agreements;
protect the security of Derekto;
protect the rights or property of AltaForm, customers, users, or others;
respond to an emergency involving danger of death or serious physical injury; or
establish, exercise, or defend legal claims.

AltaForm evaluates legal requests for Customer Data and may notify the affected customer when legally permitted.

We may disclose information when a customer or individual directs us to do so or provides consent.

AltaForm does not sell personal information for money.

AltaForm does not sell or license precise driver or fleet location information.

AltaForm does not share Customer Data with third parties for cross-context behavioral advertising or targeted advertising unrelated to Derekto.

We may disclose limited website and device information to analytics, security, and service providers for purposes such as:

measuring website performance;
understanding website usage;
preventing fraud;
maintaining security; and
operating the website.

If our practices change in a manner that qualifies as a “sale” or “sharing” under applicable privacy law, we will update this Privacy Policy and provide legally required opt-out mechanisms before implementing the change.

9. Cookies and Similar Technologies

Derekto may use:

cookies;
local storage;
software development kits;
pixels;
session technologies;
mobile identifiers; and
similar technologies.

These technologies may be used to:

keep users signed in;
remember preferences;
maintain sessions;
provide requested functionality;
prevent fraud;
protect account security;
understand website and product usage;
diagnose errors;
improve performance; and
measure communications.

9.1 Essential Technologies

Essential technologies are required for security, authentication, account sessions, load balancing, preferences, and core Service functionality.

Disabling essential technologies may prevent Derekto from functioning.

9.2 Analytics Technologies

We may use analytics technologies to understand how visitors and users interact with Derekto.

Where required by law, non-essential analytics technologies will be used only after obtaining consent.

9.3 Browser Controls

Most browsers allow users to remove or block cookies.

Mobile operating systems may also provide controls for application permissions and identifiers.

Blocking certain technologies may affect Service functionality.

9.4 Global Privacy Control

Where legally required and technically applicable, we will recognize valid browser-based opt-out preference signals, such as Global Privacy Control.

Because AltaForm does not currently sell personal information or use Customer Data for cross-context behavioral advertising, such signals may not materially change our current data practices.

10. Data Retention

We retain personal information for as long as reasonably necessary to:

provide the Service;
maintain a customer relationship;
fulfill the purpose for which information was collected;
comply with contracts;
maintain security and audit records;
resolve disputes;
enforce agreements;
comply with law;
maintain tax and accounting records; and
protect legal rights.

Retention periods depend on:

the type of information;
customer instructions;
account status;
subscription status;
product configuration;
legal requirements;
security requirements; and
backup cycles.

10.1 Customer Data

Customer Data is generally retained during the active subscription.

After account termination or expiration, Customer Data may remain available for retrieval for the period described in the Derekto Terms of Service or applicable customer agreement.

After that period, Customer Data may be deleted from active systems unless:

the customer requests earlier deletion;
retention is required by law;
retention is required to resolve a dispute;
information is maintained in secure backups; or
another retention period is stated in an applicable agreement.

Information in backups may remain until the backup is overwritten or deleted according to our normal backup schedule.

10.2 Location Information

Location information is retained only for as long as reasonably necessary to:

provide customer-requested tracking and operational records;
associate activity with loads and stops;
maintain records requested by the customer;
secure and troubleshoot the Service;
comply with contractual obligations; and
satisfy legal requirements.

Derekto customers may have their own legal or operational retention requirements.

AltaForm does not retain precise location information for the purpose of selling it or building advertising profiles.

10.3 Account and Business Records

Certain account, payment, subscription, security, fraud-prevention, tax, and legal records may be retained after account closure when reasonably necessary for legitimate business or legal purposes.

11. Security

AltaForm uses commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information.

These safeguards may include:

access controls;
authentication protections;
role-based permissions;
encryption in transit;
encryption or comparable protections for stored information where appropriate;
logging and monitoring;
backups;
vulnerability management;
restricted production access;
service-provider review;
incident-response procedures; and
employee or contractor confidentiality obligations.

No method of internet transmission, software operation, or electronic storage is completely secure.

We cannot guarantee that unauthorized access, loss, misuse, or disclosure will never occur.

Customers are responsible for:

selecting appropriate administrators;
managing user permissions;
protecting credentials;
removing former users;
securing their devices;
reviewing integrations;
maintaining independent copies of important records; and
notifying AltaForm of suspected unauthorized access.

If we discover a security incident affecting personal information, we will investigate and provide notices as required by applicable law and contract.

12. Privacy Responsibilities of Derekto Customers

Customers using Derekto are responsible for their own privacy compliance.

This may include:

providing privacy notices to drivers, employees, contractors, and other individuals;
explaining how monitoring and location tracking are used;
obtaining legally required consent;
maintaining an appropriate employee or driver privacy policy;
establishing a lawful basis for processing;
responding to privacy requests;
limiting access to authorized personnel;
determining appropriate retention periods; and
complying with employment, labor, surveillance, transportation, and privacy laws.

This Privacy Policy is AltaForm’s policy. It does not replace a customer’s own employee, contractor, driver, or consumer privacy notice.

A customer must not enable background location tracking for an individual unless the customer has the legal right to do so and has provided all required notices and obtained all required permissions.

13. Individual Privacy Rights

Depending on your location and applicable law, you may have the right to:

request access to personal information;
request confirmation that personal information is being processed;
request correction of inaccurate information;
request deletion of personal information;
request a portable copy of certain information;
object to certain processing;
request restriction of processing;
withdraw consent;
opt out of the sale or sharing of personal information;
opt out of targeted advertising;
limit certain uses of sensitive personal information;
appeal the denial of a privacy request;
lodge a complaint with a privacy regulator; and
receive equal service without unlawful discrimination for exercising privacy rights.

These rights are not absolute. A request may be denied or limited where permitted by law, including when information must be retained to:

provide a requested service;
complete a transaction;
maintain security;
prevent fraud;
comply with law;
exercise legal rights;
protect another person’s rights; or
maintain records subject to a valid legal exception.

14. How to Exercise Privacy Rights

Privacy requests may be submitted to:

privacy@derekto.com

Please include:

your name;
your email address;
your relationship to Derekto;
the company account associated with your information, if applicable;
the right you wish to exercise; and
enough information for us to understand and verify the request.

Do not send passwords, full payment-card numbers, Social Security numbers, or unnecessary sensitive documents by email.

14.1 Information Controlled by a Customer

If your information was provided to Derekto by your:

employer;
motor carrier;
dispatch company;
contracting company;
broker;
logistics provider; or
another Derekto customer,

we may direct your request to that customer.

AltaForm cannot independently delete or change customer-controlled information when doing so would conflict with the customer’s lawful instructions or contractual rights.

14.2 Verification

We may need to verify:

your identity;
your authority to act for an organization;
your relationship to the relevant account; and
the authenticity of the request.

We will request only information reasonably necessary for verification.

14.3 Authorized Agents

Where permitted by law, an authorized agent may submit a request on your behalf.

We may require proof of the agent’s authority and may separately verify your identity.

14.4 Appeals

Where applicable law provides a right to appeal, you may appeal a denied request by replying to our decision or contacting privacy@derekto.com with the subject line “Privacy Appeal.”

We will respond within the period required by applicable law.

15. California Privacy Notice

This section applies to California residents where the California Consumer Privacy Act, as amended, applies to AltaForm’s processing.

During the preceding 12 months, we may have collected the following categories of personal information:

identifiers;
customer-record information;
commercial information;
internet or electronic network activity;
geolocation information;
professional or employment-related information;
payment and transaction information;
communications;
inferences derived from Service activity; and
sensitive personal information, such as precise geolocation or account credentials, when required to provide requested features.

We collect these categories from:

individuals;
Derekto customers;
authorized users;
devices and browsers;
customer-authorized integrations;
service providers;
payment processors; and
publicly available or business sources.

We use and disclose these categories for the business and commercial purposes described in this Privacy Policy.

AltaForm does not sell personal information.

AltaForm does not share Customer Data for cross-context behavioral advertising.

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about individuals or for purposes outside those permitted by applicable law.

California residents may have rights to:

know the categories and specific pieces of personal information collected;
know the sources and purposes of collection;
know the categories of third parties receiving information;
request correction;
request deletion;
opt out of sale or sharing;
limit certain uses of sensitive personal information; and
receive equal treatment for exercising privacy rights.

Privacy requests may be submitted using the process described in Section 14.

16. Other United States Privacy Rights

Residents of certain United States jurisdictions may have additional rights under their state privacy laws.

Where applicable, AltaForm will honor legally required rights concerning:

access;
correction;
deletion;
portability;
targeted advertising;
sale of personal information;
certain profiling;
sensitive information;
consent withdrawal; and
appeals.

Because Derekto is primarily a business service, applicability may depend on:

the individual’s state;
the nature of the relationship;
the type of information;
the size and activities of AltaForm; and
whether AltaForm is acting as a controller, processor, business, or service provider.

Nothing in this Privacy Policy is intended to provide fewer rights than applicable law requires.

17. International Users

Derekto is operated from the United States.

If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States and other countries where AltaForm or its service providers operate.

These countries may have privacy laws different from those in your jurisdiction.

Where required, we use appropriate safeguards for international transfers, such as:

contractual protections;
data processing agreements;
standard contractual clauses;
consent;
adequacy decisions; or
another legally recognized transfer mechanism.

Individuals in the European Economic Area, United Kingdom, or Switzerland may have rights to:

access;
correction;
deletion;
restriction;
portability;
objection;
consent withdrawal; and
lodge a complaint with a supervisory authority.

Customers requiring a Data Processing Addendum may contact privacy@derekto.com.

18. Children’s Privacy

Derekto is intended for business use and is not directed to children.

You must be at least 18 years old to independently create a Derekto account.

We do not knowingly collect personal information directly from children under 13 through the public website or self-service account-registration process.

If we learn that personal information was collected directly from a child in violation of applicable law, we will take reasonable steps to delete it.

A parent or guardian who believes a child has provided personal information may contact privacy@derekto.com.

19. Biometric Information

Derekto’s standard features do not currently enroll fingerprints, facial geometry, voiceprints, retinal scans, or other biometric identifiers for identification purposes.

If AltaForm introduces a feature that collects or processes regulated biometric identifiers, we will provide additional notice and obtain consent where required before enabling that feature.

Customer-uploaded documents may contain photographs, signatures, or other information selected by the customer. AltaForm does not treat an ordinary photograph or signature as a biometric identifier unless it is processed for the purpose of identifying an individual through biometric measurement.

20. Do Not Track

Some browsers transmit “Do Not Track” signals.

There is currently no universally accepted technical standard for responding to all Do Not Track signals.

Derekto may not respond to traditional Do Not Track signals in a uniform manner.

Where legally required, we recognize applicable opt-out preference signals such as Global Privacy Control.

21. Third-Party Links and Services

Derekto may contain links to or integrations with third-party websites and services.

AltaForm is not responsible for the privacy, security, content, or practices of third parties.

We encourage users and customers to review third-party privacy policies before providing information or enabling an integration.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

changes to Derekto;
new features;
changes to our data practices;
changes to service providers;
legal requirements;
security developments; or
organizational changes.

The updated Privacy Policy will be posted with a revised “Last Updated” date.

If a change materially affects how we use personal information, we will provide reasonable notice through:

email;
an account notification;
the Derekto website;
the mobile application; or
another appropriate method.

Where required by law, we will obtain consent before materially changing how previously collected information is used.

23. Contact Us

Questions, complaints, and privacy requests may be directed to:

AltaForm LLC Derekto Privacy Email: privacy@derekto.com Location: Washington, United States

For legal notices unrelated to privacy:

Email: legal@derekto.com

Derekto is a software product owned and operated by AltaForm LLC.