TruckTabs Privacy Policy

1.What this policy covers

This policy explains what TruckTabs ("TruckTabs," "we," "us") collects when you use trucktabs.com and our permit services, why we collect it, who we share it with, and what you can do about it. It applies to the website, the quote and ordering tools, your account, our phone line and text messages, our AI assistant Allison, our email to you, and the permit work we do on your behalf.

TruckTabs sells trip, fuel, and oversize/overweight permits to motor carriers. Most of what we collect is business information about a company, a truck, and a trip. Some of it is personal — your name and contact details, and your driver's name and license number — and that is what this policy is mainly about.

This policy is a notice, not a contract. The agreement governing your use of the Services is our Terms of Service.

2.Information we collect from you

Ordering happens in two parts. You get a quote and pay using your route, vehicle configuration, and load. You then sign in and give us the specific truck, trailer, and driver we file with. The lists below say which part each item belongs to, because until you reach the second part we do not hold it.

When you build a quote and pay

• The trip: origin and destination, and the states on the route with the miles in each.
• The vehicle configuration: vehicle type, combined length, trailer type and length, and axle counts.
• The load: category, description, gross weight, and length, width, and height.
• Your company: legal name, DBA, MC and USDOT numbers, tax identification number, physical address, phone, email, and whether you hold active operating authority.
• You: first and last name, email address, phone number, and your time zone.
• Your payment: see the payment section below. We never receive your card number.

We save your progress from the point you name the states on your route, so you can leave and come back. If you ask us to email you a link to finish later, we store that request and send it. An unfinished quote stays with us as a draft order.

When you complete the order, and as those features ship

The second part of the order collects what a state actually needs on the application. Some of this is still being built; we list it here so the policy describes the finished service rather than being amended around you.

• The trip: start date and time.
• The equipment: unit numbers, year, make, model, plate and plate state, VIN, fuel type, and trailer kingpin setting.
• The load: per-axle weights on heavy loads.
• Your driver: name, phone, email, and driver's license number, state, class, and expiration — because state permit applications require them.
• Documents you or we attach to an order: permits, receipts, invoices, and anything a state asks for.

When you create an account

Your email address, name, phone, a hashed password (never the password itself), and your time zone. Each time you sign in we record the time, your IP address, and your browser's user agent, along with a count of sign-ins and of failed attempts, so we can detect and slow down attacks on your account. Saved trucks, trailers, and drivers live on your account so you can reuse them.

When you contact us

What you write to us and what we write back, by email, text, or phone, along with your contact details, so the next person who picks up your order knows what has already been said. Calls and texts are covered in more detail below.

Automatically, when you use the site

• Which pages you visit on this site. We keep our own record, tied to the tt_visitor cookie: the page you arrived on, the site that referred you, any campaign codes in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), your IP address and browser user agent, and the list of pages you view with the time of each, plus a score from Google reCAPTCHA saying how automated the visit looks. If you go on to place an order we mark that the visit converted, and link it to the order. We record the page path only — never the query string, and we do not track your account pages, the console, sign-in pages, or the pay-by-link pages at all.
• Partner attribution: if you reach our quote page through a partner link (/permits?ref=…), we record that partner code on the order so we can credit the referral.
• Activity on your orders: we keep an event log of what happened to each order — steps saved, quotes priced, payment outcomes, emails sent — which includes the contact email and card brand and last four associated with those events.
• Server and delivery logs: ordinary request logs kept by our hosting provider, which include IP addresses, and records of the emails we sent you — including the message content — and whether they were delivered, bounced, or were marked as spam.

3.Information we get from other sources

• FMCSA. When you enter an MC or USDOT number, we query the Federal Motor Carrier Safety Administration's public carrier database and receive your legal name, DBA, physical address, phone, authority status, and tax identification number, so you do not have to type them.
• Our payment processor. The result of your payment: approved or declined, the card brand and last four digits, a reference number, a receipt link, and the reason for any decline. See below.
• Email verification. A verification service tells us whether an email address you entered appears valid and deliverable. Its answer can also include a first and last name and the mail provider associated with the address, and we store the response so an address is only checked once.
• Affiliates and referral partners. If you arrived through a partner link, we record which partner sent you.
• State permitting agencies. The permits themselves, plus status, conditions, and correspondence about your applications.

4.How we use information

We use what we collect to:

• Price your trip against each state's fee schedule and determine which permits it needs.
• Compare your load against each state's legal limits so we can tell you when an oversize/overweight permit is required.
• Prepare and file permit applications with state agencies on your behalf — the core of what we do, and the reason we need carrier, equipment, load, and driver details.
• Take payment, issue invoices and receipts, apply credits, and handle refunds and disputes.
• Send you transactional email: quotes, resume links, receipts, permits, invoices, account and security notices, and requests for information a state needs.
• Provide your account, keep you signed in, and let you reorder from saved equipment and drivers.
• Answer your questions and support your orders, including answering your calls through Allison.
• Keep the service secure and honest: detecting account attacks, fraud and chargeback prevention, and investigating misuse.
• Understand which partners, campaigns and pages bring carriers to us, measure the funnel, and improve pricing accuracy and the site. This is our own measurement, for our own decisions — we do not sell it, share it, or use it to advertise to you elsewhere.
• Tell automated traffic from real visitors, so our numbers mean something and our forms stay usable.
• Comply with law, tax and accounting requirements, and to establish or defend legal claims.

We do not send marketing email today. Everything we send relates to an order you placed or an account you hold. If we start sending marketing messages, every one will carry an unsubscribe link and we will honor it.

5.Payment information

We never receive your card number. Card details are entered into fields hosted by our payment processor, Square, and are sent directly to Square from your browser. Square returns a single-use token that our server uses to take payment. The name on the card goes to Square and is not stored by us. What we store is the outcome: amount and currency, status, card brand and last four digits, Square's payment, receipt, and receipt-URL identifiers, any refunded amount, the reason for a decline if one occurs, and the email address you gave for the receipt. Square handles your card data under its own privacy policy and PCI obligations. The legacy TruckTabs system stored card records; this one does not, and never will.

6.Allison and our AI providers

Our phone line is answered by Allison, an artificial-intelligence assistant. When you talk to her, what you say and the details you give her are processed by the providers below so she can understand you, answer, and do what you ask.

• Allison Voice is the platform Allison runs on. It connects the services below and stores the recording, transcript, and written summary of each call.
• Twilio carries the call, and Deepgram turns your voice into text and Allison's replies into speech.
• Anthropic (Claude) generates Allison's replies during the call, through Deepgram's service, and writes the summary afterwards.
• Google (Gemini) is a backup model, used when a request to Anthropic fails.
• OpenAI processes the words Allison searches with, which can include your question, so she can find answers in the reference information she holds.

When Allison prices a trip for you, the quote is saved as an unfinished order, the same as a quote you start on the website, and kept like one (see how long we keep information). If you ask, she emails you a link to it. We also log what she passed to our systems to do that, and we remove those details from the log after 30 days.

We do not use your calls or messages to train AI models. AI output is generated automatically and can contain errors; our Terms of Service explain how that affects a quote or an answer you get from Allison.

7.Phone calls

Calls to our phone line are recorded, transcribed, and processed by the providers described above. The call tells you it may be recorded at the start; by continuing after that notice, you consent to the recording. Allison Voice keeps the recording, a transcript, a short written summary, and the number you called from, and when a call leaves a message, needs follow-up, or places an order, a summary is emailed to our team, so we can do what you asked, resolve any question about what was said, and improve the service. If you call again, Allison may use what was said on your earlier calls to help you. If you would rather not be recorded, email team@trucktabs.com or use the website instead.

8.Text messages

When you text our line, we keep the conversation: your messages, our replies, links to any pictures you send, and whether each text we send was delivered, along with your phone number. If the number matches an account, we link the conversation to it. When a new text comes in, our team is emailed the start of it so someone sees it quickly. Our team reads and answers texts during business hours. If you ask Allison on a call to text you a link to your quote, she can send it only to the number you are calling from.

We text you only about your quotes, orders, permits, and account, and we do not send marketing texts. Message frequency varies, and message and data rates may apply. Reply STOP to stop receiving texts from us, START to allow them again, or HELP for help. We keep a record of a STOP, and don't text that number, until it texts START.

Mobile numbers and text opt-in information are not shared with third parties or affiliates for marketing or promotional purposes.

9.AI assistants that use our tools

Our site publishes tools that an AI assistant running in your own browser, such as ChatGPT, can use to look up a state's legal limits or price a trip for you. When one does, we log which tool it used and when, what it asked for, whether it worked, the page and browser it ran in, and our visitor cookie for that browser. What it asked for can include pickup and delivery locations, so we remove it from the log after 30 days. If the assistant prices a trip, the quote is saved as an unfinished order, the same as one started on the website. What our tool sends back, which can include a link to your quote, goes to the assistant and its provider. Your conversation with the assistant is handled by that provider under its own policies; we receive only the tool request.

10.Who we share information with

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not rent or trade customer lists. We disclose it in these situations:

State permitting agencies

To get you a permit we submit your application to the issuing agency — through its online portal, by email, or by phone. That application contains your company details, MC/USDOT number, the vehicle and load, the route, and in most states the driver's name and license number. Some states publish permit records or make them available on request under public records law. Once information is with a state agency, that agency's rules govern it, not ours. This disclosure is not optional; it is the service.

Service providers who work for us

Providers marked "through Allison Voice" work for Allison Voice, which answers our line, under its agreements with them. There is one exception worth naming. Google reCAPTCHA runs in your browser rather than on our servers, so Google receives your IP address and technical information about your device directly from you, and uses it to improve the reCAPTCHA service as well as to answer our question. Google's privacy policy and terms govern that. We use it only to tell automated traffic from real visitors, never to profile you or to decide anything about your order.

Other disclosures

• Affiliates and referral partners: if you came through a partner link, that partner is told that a referred order was placed and its value, so we can pay commission. Partners do not receive your contact details, your driver's information, or your load details.
• Professional advisers: accountants, auditors, and lawyers, under a duty of confidentiality.
• Legal: when required by law, subpoena, or legal process; to enforce our Terms; to protect our rights, property, or safety, or those of our customers or the public; or to investigate fraud or a security incident.
• Business transfers: in a merger, acquisition, financing, or sale of assets, with the same protections carried forward.
• With your direction: anywhere else you ask us to send it.

11.Cookies and browser storage

We use a small number of cookies and browser storage items — for running the service, and for our own measurement of which pages bring carriers to us. There are no advertising cookies on this site, and nothing here is used to follow you around the web. Our analytics are our own: the data stays with us and is never sold or shared. The one third party your browser contacts is Google reCAPTCHA, described above, which is there to tell automated traffic from real people.

If you arrive through a partner link, the partner code in that link is carried along with the quote you are building and recorded on the order you place.

Clearing tt_visitor, or browsing privately, means we count your next visit as a new one. Nothing on the site behaves differently either way.

You can block or delete cookies in your browser. If you block ours, you will not be able to stay signed in, and a quote in progress may not survive a refresh.

We honor the Global Privacy Control signal where it applies. Because we do not sell or share personal information for advertising, there is nothing for it to switch off, but we treat it as an opt-out request all the same.

12.Information about your drivers and employees

When you enter a driver's name, contact details, or license number, you are giving us personal information about someone else. You confirm that you are entitled to do so and that the driver has been told that their details are submitted to state permitting agencies to obtain permits for the trips they run. We use driver information only to prepare and file permits, to identify the driver on an order, and to contact them about a permit if you ask us to. If a driver contacts us directly about their information, we will refer them to you and cooperate with you in responding.

13.How long we keep information

• Orders, permits, invoices, and payment records: at least seven years after the order, because they are business and tax records and because states audit permit records.
• Account and saved equipment or drivers: for as long as your account is open, and for a reasonable period after you close it so we can honor the retention above.
• Unfinished quotes, email logs, sign-in records and visit records: we review these periodically and remove or reduce older records to non-identifying totals once they no longer serve the purpose they were collected for.
• Call recordings, transcripts, and summaries: stored by Allison Voice. There is no fixed deletion period today; ask us about a recording and we will tell you what is held.
• Text conversations: kept as correspondence. A STOP is kept until that number texts START.
• Logs of AI tool use: the details Allison or an outside AI assistant passed to our tools are removed after 30 days; we keep the rest of the record (which tool, when, whether it worked, and the browser or call it came from).
• Server logs: for the short period our hosting provider retains them.
• Suppression list: if an address hard-bounces or reports us as spam, we keep it on a do-not-email list indefinitely, because forgetting it would mean emailing it again.

If you ask us to delete your information, we do so as described below (with the exceptions listed there) rather than waiting for these periods to run.

14.How we protect information

We hold carrier, driver, and payment information, so security is part of the product rather than a policy statement. Practically, this means:

• Everything travels over TLS, and the database is encrypted at rest.
• Passwords are stored as one-way hashes; we cannot read them, and neither can anyone who steals the file.
• Session tokens are stored as hashes, never in the form your browser holds.
• Card numbers never touch our systems. We do not store cardholder data, which is a deliberate change from the older TruckTabs system.
• The application connects to the database with a least-privilege account. Every signed-in page and every endpoint that returns account data checks who is asking before it returns anything; the anonymous quote endpoints are authorized by a token tied to the single order they act on.
• Staff sign in with a separate identity from customers; a customer login can never reach staff tools, and a staff login cannot pose as a customer. Staff access is governed by role.

One thing worth knowing: a "save for later" link contains the only credential needed to reopen that quote. Anyone you forward it to can see and continue the order, so treat it like a password.

No system is perfectly secure. If a breach affects your personal information, we will notify you and any regulator as the law requires.

15.Your choices and rights

• Access and portability. Ask us for a copy of the personal information we hold about you. You can see your orders, invoices, and permits in your account.
• Correction. Fix your details in your account, or ask us. Tell us quickly if something on an order is wrong — a permit is filed against it.
• Deletion. Ask us to delete your account and personal information. We will, except where we must keep records of orders, permits, and payments for tax, audit, or legal reasons. Call recordings and transcripts are held by our voice platform, Allison Voice, and can't yet be deleted one call at a time; ask us and we will tell you what is held.
• Email. We send only transactional messages about your orders and account today, and those continue while an order is open. If we begin sending marketing email, you will be able to unsubscribe from it in any message.
• Cookies. Manage them in your browser, as described above.

To exercise any of these, email team@trucktabs.com or call 503-212-0295. We will verify that the request comes from you — usually by confirming control of the account email — and respond within 45 days, extending once if we need to and telling you why. We will not treat you differently for exercising a right.

16.State privacy rights

Residents of California, Colorado, Connecticut, Oregon, Texas, Virginia, and other states with comprehensive privacy laws have specific rights: to know what is collected and why, to access and correct it, to delete it, to obtain a portable copy, to opt out of sale, sharing, targeted advertising, and certain profiling, and to appeal a decision we make about a request. The choices above are how you exercise them.

We do not sell personal information and we do not share it for targeted advertising or cross-context behavioral advertising, and we have not in the last 12 months. We do not use personal information for automated decisions that produce legal or similarly significant effects about a person.

Sensitive information. The only sensitive personal information we handle is a driver's license number and, where a carrier's tax identification number is a Social Security number, that identifier. We collect them deliberately, because state permit applications require them; we use them only to prepare and file those applications; and we disclose them only to the issuing agency, which may in turn make permit records public. Because we use them solely for purposes permitted under California Civil Code section 1798.121(d), the right to limit their use does not apply and we offer no such link.

An authorized agent may make a request for you with written proof of authorization. If we deny a request, you may appeal by replying to our response, and we will answer the appeal within 45 days. If we deny the appeal, you may contact your state attorney general.

Much of what we hold is business contact and commercial information about a company. Colorado, Connecticut, Oregon, Texas, and Virginia treat that differently from consumer data; California does not, and has covered business contact data since January 2023. We apply the choices above regardless of the distinction.

17.Children

The Services are for commercial motor carriers and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email team@trucktabs.com and we will delete it.

18.Links to other sites

We link to state permitting portals, agency pages, and other outside sites. We do not control them and are not responsible for their content or their privacy practices. Read the policy of any site you follow a link to, particularly a state portal you sign in to.

19.Where information is processed

We operate in the United States and our providers store and process information mainly in the United States. If you access the Services from elsewhere — including Canadian carriers buying United States trip and fuel permits — you understand that your information is transferred to and processed in the United States, under United States law, which may not provide the same protections as the law where you are.

20.Changes to this policy

We update this policy as the service changes. The effective date at the top of the page always reflects the current version, and this one replaces the policy dated September 5, 2026. If a change is material we will tell you by email or with a notice on the site before it takes effect. Check back from time to time.