Privacy Policy

1. Introduction

Workbird LLC ("Company," "we," "our," or "us") operates the ConsentHaul platform ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service. This policy applies to all users, including motor carriers, designated employer representatives (DERs), commercial driver's license (CDL) holders, and website visitors.

By using ConsentHaul, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Account Information (Carriers/Employers)

• — Full name, email address, phone number
• — Company name, DOT number, MC number
• — Business address and contact information
• — Payment information (processed securely via Stripe; we do not store credit card numbers)

2.2 Driver Information

• — Full legal name, email address, phone number
• — CDL number and issuing state
• — Date of birth
• — Employer/carrier affiliation

2.3 Signature and Consent Data

• — Electronic signature image and stroke data
• — Date and time of signature (UTC timestamp)
• — IP address at time of signing
• — Device type, browser, and operating system
• — Geolocation data (when voluntarily provided by the device)

2.4 Automatically Collected Data

• — Log data (pages visited, access times, referral URLs)
• — Cookies and similar tracking technologies for authentication and analytics
• — Device identifiers and browser fingerprinting data

3. How We Use Your Information

• — Service delivery: To process consent forms, authenticate users, and manage accounts
• — Compliance: To maintain records required by FMCSA regulations (49 CFR Part 40)
• — Communication: To send consent form notifications, account updates, and service announcements
• — Payment processing: To process credit purchases and manage billing
• — Security: To detect fraud, prevent abuse, and ensure platform integrity
• — Improvement: To analyze usage patterns and improve the Service

4. Legal Basis for Processing

We process personal data based on the following legal grounds:

• — Contractual necessity: Processing required to provide the Service under our Terms of Service
• — Legal obligation: Processing required to comply with FMCSA record retention rules
• — Consent: Where you have explicitly consented (e.g., optional location data)
• — Legitimate interest: Fraud prevention, security monitoring, and Service improvement

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• — Your employer/carrier: Signed consent forms and associated metadata are shared with the carrier who requested them
• — Service providers: Supabase (database/auth), Stripe (payments), Resend (email delivery), Twilio (SMS/WhatsApp), and cloud hosting providers — all bound by data processing agreements
• — Law enforcement: When required by law, subpoena, court order, or regulatory inquiry
• — Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity

6. Data Retention

Signed consent documents and associated metadata are retained for a minimum of three (3) years from the date of signing, in compliance with FMCSA requirements under 49 CFR § 382.401. Account information is retained for as long as your account remains active and for a reasonable period thereafter to comply with legal obligations.

You may request deletion of your account data by contacting us. Certain data may be retained longer where required by law or for legitimate business purposes (e.g., dispute resolution, fraud prevention).

7. Data Security

We implement industry-standard security measures to protect your data, including:

• — Encryption at rest (AES-256) and in transit (TLS 1.2+)
• — Row-level security (RLS) ensuring multi-tenant data isolation
• — Regular security audits and access logging
• — SOC 2-compliant infrastructure providers
• — Secure authentication with PKCE flow and HTTP-only cookies

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security and are not responsible for unauthorized access resulting from events beyond our reasonable control.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• — Access: Request a copy of the personal data we hold about you
• — Correction: Request correction of inaccurate or incomplete data
• — Deletion: Request deletion of your data, subject to legal retention requirements
• — Portability: Request your data in a machine-readable format
• — Objection: Object to processing based on legitimate interests
• — Restriction: Request restriction of processing in certain circumstances

To exercise any of these rights, contact us at privacy@consenthaul.com. We will respond within 30 days.

9. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights, including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information.

To make a CCPA request, contact us at privacy@consenthaul.com or use the contact information in Section 14 below.

10. Cookies

We use cookies and similar technologies for authentication, session management, and analytics. Essential cookies are required for the Service to function (e.g., authentication tokens). Analytics cookies help us understand how users interact with the platform. You can manage cookie preferences through your browser settings, but disabling essential cookies will prevent you from using the Service.

11. Third-Party Links

The Service may contain links to third-party websites or services not operated by us. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a person under 18, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or by posting a notice on the platform. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after changes constitutes acceptance.

14. Contact Us

For questions, concerns, or requests related to this Privacy Policy: