Privacy Policy

1. Overview

HighwayTMS is a multi-tenant transportation management system operated by Highway TMS (“we,” “us”). This Privacy Policy explains what information the Service handles, why, how it is protected, and the choices you have. It applies to the public pages, the authenticated application, and related APIs (together, the “Service”).

This policy describes the Service as it actually works today. Where the law that applies to you depends on facts we cannot know (your location, your customers, your contracts), we say so rather than guessing.

2. Two Kinds of Information

It helps to separate two categories:

Customer Data — information a trucking-company customer and its users enter or upload: company settings, loads, trucks, drivers, rates, repairs, expenses, settlement information, and documents (BOLs, PODs, rate confirmations, CDL and medical-card files). The customer decides what goes in.

Account & Platform Data — information needed to run the Service itself: user email addresses and credentials, company membership and roles, and authentication/security metadata such as session records and logs.

3. Our B2B Relationship (Who Decides What)

HighwayTMS is a business-to-business service. The trucking company that creates a workspace decides what driver, employee, contractor, load, and document data it submits and why. Depending on the privacy law that applies, that company may be the “data controller” or “business” for the personal information in its workspace, while we process that information on its instructions to provide the Service.

We do not make definitive claims about which legal role applies in every jurisdiction — that can depend on your location and our contract. For customers who want one, we publish a Data Processing Addendum template intended for legal review before execution. If you are a driver, employee, or contractor of a company using HighwayTMS, questions about your information in that company’s workspace should usually start with that company.

4. Information We Handle

Account data

• Email address used to register and sign in;
• Name or display details, where your company provides them;
• Authentication and account metadata (account identifiers, session and sign-in events, email-verification and password-recovery events);
• Company membership and account role (Admin, Employee, or platform Sysadmin).
• Records of your acceptance of our legal terms (document version, date and time, account, and the IP address and browser user agent at the time of acceptance), kept as proof of consent and shown in the workspace audit trail.

Company data

• Company name and workspace settings;
• Business timezone and tenant configuration (for example calculation or invoicing preferences).

Driver & contractor data (entered by the customer)

• Names, phone numbers, and email addresses;
• Credential details and expiry dates (CDL, including issuing state, and DOT medical-card information);
• Drug-test records and any result documents the customer chooses to upload (stored on the customer’s behalf; see the Terms for what the Service does and does not do with these);
• Trucking operational information, such as truck assignments and load history.

Document data

• Bills of lading (BOLs) and proofs of delivery (PODs);
• Rate confirmations;
• CDL documents and DOT medical-card documents;
• Other documents a customer chooses to upload.

Fleet & operations data

• Trucks, unit numbers, and VINs;
• Loads, routes, brokers, and pickup/delivery details;
• Repairs and expenses.

Financial & business data (admin-restricted)

• Freight rates and broker payment information;
• Settlement information and deductions for contractors/owner-operators;
• Company revenue and settlement calculations;
• Customer and vendor records, which can include a tax identification number field.

Tax identification numbers and similar identifiers are stored as entered and are not separately encrypted beyond the database and storage encryption our infrastructure providers apply. [CONFIRM BEFORE LAUNCH.] We do not ask for Social Security numbers, but documents you upload (for example, driver paperwork) may contain them. Redact or avoid uploading identifiers your business does not need to keep.

Technical data

• Standard server and security logs (which typically include IP address, timestamps, and browser/device identifiers) generated when the Service is used;
• Authentication and security events used to protect accounts and investigate abuse.

We do not run advertising trackers or third-party analytics on the Service, and we do not collect information about your activity on other websites. See the Cookie Policy for the full, short list of cookies and browser storage we use and how to change your cookie choices.

5. How Information Is Collected

• Directly from you — when you register, sign in, enter records, or upload documents.
• From your company — when an Admin adds team members or enters driver, contractor, or load information.
• Automatically — standard technical logs created by the hosting and database infrastructure when the Service is used.

6. Why We Use Information

• Provide and operate the Service (dispatch records, fleet and driver management, document storage and retrieval, settlements, exports);
• Authenticate users and manage sessions;
• Keep each company’s data isolated from other tenants;
• Administer accounts, roles, and company workspaces;
• Suggest fields from rate-confirmation documents when an authorized user requests the optional AI parsing feature;
• Secure the platform and prevent fraud and abuse;
• Troubleshoot problems and provide customer support;
• Meet legal, regulatory, tax, or accounting obligations; and
• Establish, exercise, or defend legal claims.

We do not sell personal information, and we do not use Customer Data for advertising or cross-context behavioral advertising.

7. Service Providers & Disclosures

We share information with a small number of service providers (sometimes called “subprocessors”) strictly to operate the Service:

[CONFIRM BEFORE LAUNCH: Supabase: Production project region; Vercel: Production deployment region; Resend: Email provider configured in production; Groq: Zero-data-retention terms with the provider; OpenRouter: Zero-data-retention routing.] Google sign-in is optional: if you choose it, Google authenticates you under its own terms and privacy policy. Stripe acts as our payment processor; card numbers are entered on Stripe-hosted pages and are never stored in HighwayTMS.

AI processing of rate confirmations. Parsing a rate confirmation with AI is optional and happens only when an authorized user requests it. In that case the document’s content or extracted text is sent to an AI provider we have configured (Groq as a fallback, and OpenRouter, in each case using zero-data-retention routes) so it can suggest fields such as load number, rate, and stops. Suggestions are shown for review and are not applied automatically. The provider processes the content to return the result. Manual and deterministic parsing do not send the document to an AI provider. [CONFIRM BEFORE LAUNCH: the enabled providers and their data-processing terms.]

We may also disclose information if required by law, subpoena, or valid legal process; to protect the rights, safety, and security of the Service, our customers, or others; or in connection with a merger, acquisition, or sale of assets (with notice where required).

Domain registration/DNS providers (for example, the registrar of the public domain) do not process Customer Data and are not listed as data processors.

8. Storage, Hosting & Tenant Isolation

The application is hosted on Vercel, and data is stored in Supabase (PostgreSQL database and file storage). Each company’s records are scoped to a company identifier, and access is enforced by PostgreSQL Row Level Security (RLS) policies, so one tenant’s users cannot read another tenant’s data through the application.

9. Document Access Controls

Uploaded documents live in private storage and require an authenticated, authorized session — there are no public, transferable file-sharing links. Access follows role-based rules within each workspace:

• Rate confirmations and financial information are restricted to Tenant Admins;
• CDL and medical-card documents are restricted to Tenant Admins;
• Operational BOL/POD documents may be handled by Employees as part of load workflows;
• The platform Sysadmin role operates the Service but does not, by itself, grant access to tenant documents or financial data.

10. Retention

We do not apply a fixed, automatic deletion schedule to ordinary business records. Retention depends on the context, including:

• whether your account and workspace remain active;
• the purpose of the record (operational, financial, credential, or security);
• your company’s own requirements and instructions;
• legal, regulatory, tax, and accounting obligations;
• disputes, investigations, or legal holds; and
• operational needs such as backups and reconciliation.

[CONFIRM BEFORE LAUNCH: the backup schedule and how long backups are kept, and how long after account closure customer data is deleted. State the actual figures here; until then this policy makes no promise about them.]

Transportation records often have mandatory retention periods under laws and regulations that apply to your business. You are responsible for establishing and meeting the retention obligations that apply to you; the Service is a storage tool, not a retention-schedule authority.

11. Deletion & Account Closure

Company Admins can remove individual users, and archived documents can be managed through the document lifecycle in the application. To close a company workspace entirely, contact us at support@highwaytms.com or support@highwaytms.com.

After closure, we may retain some information where needed for legal obligations, security, dispute resolution, or legitimate business records. Deletion from backups and logs is not immediate and happens as those systems cycle.

12. Security

Safeguards currently implemented in the Service include authenticated sessions, private file storage, PostgreSQL Row Level Security, tenant-scoped authorization, role-based access controls (Admin/Employee separation and a separate Sysadmin scope), HTTPS when the Service is deployed to production, and server-side handling of privileged credentials. See Security & Data Protection for details.

No method of transmission or storage is completely secure. We work to protect your information, but we cannot guarantee absolute security.

13. International Processing

The Service is operated from the United States, and the infrastructure providers named above may process data in other locations according to their own region configurations. [CONFIRM BEFORE LAUNCH: the hosting and database regions configured for production, and whether any customers or data subjects are located outside the United States.] If you use the Service from outside the United States, you understand that information will be transferred to and processed where the Service and its providers operate.

14. Your Privacy Rights

Depending on where you live, you may have rights such as accessing, correcting, deleting, or receiving a copy of your personal information, or objecting to or restricting certain processing. These rights vary by jurisdiction.

United States. Residents of California and of other states with consumer privacy laws have rights to know, delete, and correct personal information and to limit use of sensitive information, without discrimination for exercising them. We do not sell or share personal information for cross-context behavioral advertising. See our US State Privacy Notice for the categories, how to submit a request, and how we verify it.

EEA, UK, and similar regimes. The Service is operated from the United States for businesses. [CONFIRM BEFORE LAUNCH: whether any customers or data subjects are in the EEA or UK.] If those laws apply to you, our lawful bases are: performance of our contract with the customer (providing the Service); our legitimate interests in securing and improving the Service; compliance with legal obligations; and consent where we ask for it, which you can withdraw. You may also have the right to lodge a complaint with your local supervisory authority.

If your information sits inside a company workspace (for example, you are a driver or employee of a customer), please contact that company first — it controls what is stored there, and we support customers in honoring requests for their data. For Account & Platform Data we hold, or for anything else, contact support@highwaytms.com. We will not discriminate against you for exercising privacy rights. Cookie and browser-storage choices are described in the Cookie Policy.

15. Children's Privacy

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from children under 13 (or a higher age where local law requires). If you believe a child has provided us personal information, contact support@highwaytms.com.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always posted on this page with its “Last updated” date. For material changes, we will make reasonable efforts to notify customers (for example, by email or an in-app notice) before the change takes effect.

17. Contact

Highway TMS

Privacy questions and requests: support@highwaytms.com
General support: support@highwaytms.com