Privacy Policy

• Account & sign-in — your name and email, managed by our authentication provider (Clerk).
• Business profile — your company name, EIN, USDOT/MC numbers, address, and operational details you enter to compute your obligations.
• Documents — files you upload (insurance, authority, driver-qualification, medical).
• Free-tool leads — if you ask for MCS-150 reminders, your email address. We store a one-way hashed value derived from your IP address (never the raw IP) solely to prevent abuse of the form.

To compute the compliance obligations and deadlines that apply to you, remind you before they're due, store your documents, and keep the service secure. We do not sell your data or use it for advertising.

Data is encrypted in transit (TLS) and at rest (AES-256). Each firm's data is isolated at the database layer (row-level security), and sensitive changes are recorded in an immutable audit log with your EIN redacted. We build toward SOC 2 / ISO 27001 practices.

We rely on SOC 2-attested providers to run the service: Clerk (authentication), Neon (database), Vercel and AWS (hosting/storage), Resend (email), Stripe (payments — we never see your card number), and Sentry (error monitoring). They process data only to provide their part of the service.

Your account data is retained while your account is active. Free-tool reminder leads are kept until their reminder purpose is fulfilled (60 days past the deadline you asked about), or 180 days when no deadline was computed. Immutable audit records are retained for compliance and accountability.

You can view and correct your business profile any time in Settings. You can permanently delete your account and all associated data from Settings → Danger zone (this erases your company, documents, and identity; the immutable record of the deletion is retained). For any data request, contact us.

Questions or requests: privacy@1kompliance.com.