Privacy Policy

• Account & sign-in — your name and email, managed by our authentication provider (Clerk).
• Business profile — your company name, EIN, USDOT/MC numbers, address, and operational details you enter to compute your obligations.
• Documents — files you upload (insurance, authority, driver-qualification, medical).
• Free-tool leads — if you ask for MCS-150 reminders, your email address. We store a one-way hashed value derived from your IP address (never the raw IP) solely to prevent abuse of the form.

To compute the compliance obligations and deadlines that apply to you, remind you before they're due, store your documents, and keep the service secure. We do not sell your data or use it for advertising.

Data is encrypted in transit (TLS) and at rest (AES-256). Each firm's data is isolated at the database layer (row-level security), and sensitive changes are recorded in an immutable audit log with your EIN redacted.

We rely on SOC 2-attested providers to run the service: Clerk (authentication), Neon (database), Vercel (hosting and private document storage), Resend (email), Stripe (payments — we never see your card number), and Sentry (error monitoring). They process data only to provide their part of the service.

Your account data is retained while your account is active. Free-tool reminder leads are kept until their reminder purpose is fulfilled (60 days past the deadline you asked about), or 180 days when no deadline was computed. Immutable audit records are retained for compliance and accountability.

We use only the cookies required to keep you signed in (set by Clerk). No advertising trackers, no cross-site anything. Product analytics are first-party event counts (e.g. "a document was uploaded") stored in our own database without personal identifiers. We also use Vercel's cookieless, aggregate page analytics (page views and referrers only — no cookies, no fingerprinting, no individual profiles). If you arrive from a link with campaign tags, your browser remembers that first source locally on your device so we can credit where sign-ups come from; it never identifies you and you can clear it any time by clearing site data.

To understand which pages actually help people, we also record anonymous page journeys on our own servers: which pages a visit viewed and roughly how long each was on screen. The visit identifier is random, lives only in your browser tab, and is discarded when the tab closes — so visits can never be connected to each other or to you. No IP address is stored with it, there is no fingerprinting, no third party receives it, we honor your browser's Do Not Track setting, and these records are automatically deleted after 60 days.

• Access & correction — view and edit your business profile any time in Settings.
• Deletion — permanently delete your account and all associated data from Settings → Danger zone. This erases your company, documents, and identity, and cancels any subscription; the immutable record of the deletion itself is retained.
• Email opt-out — every email we send includes a working one-click unsubscribe.
• Anything else— email us and we'll handle it like we'd want it handled.

Some guides may include clearly marked affiliate links to services we'd recommend anyway (for example, forming an LLC). They never affect what we recommend, and we say so wherever they appear — see our disclosures.

Questions or requests: support@1kompliance.com.