FleetScan Privacy Policy

Effective Date: May 4, 2026
Last Updated: May 4, 2026
Operator: HAN Transportation Inc., a California corporation
Principal Place of Business: San Bernardino County, California, USA
Contact: +1 949-295-3025 · association@atiaunion.org · atiaunion.com

Introduction

FleetScan ("the App") is operated by HAN Transportation Inc. ("HAN," "we," "us," or "our"). This Privacy Policy explains what information we collect, how we use it, and your rights as a user. The App is designed for trucking professionals located in the United States. We do not target or actively serve users outside the United States.

This Policy applies to two categories of users:

Self-Service Users — users who create an account to use FleetScan's free document management features without engaging HAN's paid compliance services.
Service Customers — users who additionally request HAN's compliance services (USDOT/MC filings, IFTA, IRP, COI, BOC-3, weight-distance permits, and similar services) through the App.

Both categories receive the same data protection rights under this Policy.

1. Information We Collect

1.1 Information You Provide Directly

Account identifier — Mobile phone number (required, used for one-time-code login) and/or email address (required, used as a secondary verification channel).
Bound carrier — One active USDOT number, and where applicable the associated MC number, that you bind to your account. Per FMCSA policy, USDOT numbers are non-transferable and assigned permanently to one legal person; accordingly, each FleetScan account is tied to one active USDOT.
Compliance documents — PDFs and images you upload, including but not limited to insurance certificates (COI), IRP cards, IFTA decals, MCS-150 confirmations, BOC-3 designations, UCR receipts, state weight-distance permits, drug & alcohol program records, and similar carrier compliance materials. You may include optional metadata such as expiry date, issuing agency, document number, and notes.
Service requests — Free-form notes, requested service type, and contact preferences when you submit a request for HAN to handle a filing or renewal on your behalf.

1.2 Information Collected Automatically

Push notification token (Apple Push Notification Service / Google Firebase Cloud Messaging) — used solely to deliver document expiry reminders and account-related notifications you have opted into.
Device language and locale — used for UI translation.
Anonymous error reports — when the App encounters a runtime error, the error message and stack trace may be logged for debugging. These reports are scrubbed of personally identifying information.
Authentication session metadata — login timestamps, IP address at login, and device type. Used to detect anomalous access patterns and to enforce the security provisions described in Section 7.

1.3 Information Obtained from FMCSA Public Records

When you bind a USDOT number to your account, FleetScan queries publicly available FMCSA records (via the FMCSA QCMobile API and SAFER Company Snapshot) to:

(a) Display the carrier's safety profile, operating authority status, insurance status, MCS-150 currency, out-of-service rates, and crash history; and

(b) Retrieve the carrier's FMCSA-registered phone number and email address for the limited purpose of verifying that you are the legitimate holder or authorized representative of the bound USDOT (the "Two-Channel Verification").

The FMCSA-registered phone number and email address obtained for Two-Channel Verification are used only at the time of binding. We do not retain these values in our marketing or communications databases, and we do not use them for any subsequent communication with you. All ongoing communications use the contact information you provide directly to FleetScan under Section 1.1.

We do not store FMCSA safety record data on our servers; it is fetched live each time you view a carrier profile.

1.4 Documents Generated by HAN on Your Behalf

When you submit a Service Request and HAN's compliance team completes a filing or renewal for you, the resulting official document (e.g., a renewed COI, a newly issued IRP card, a filed MCS-150 confirmation) may be uploaded to your FleetScan account by HAN staff. You retain ownership of these documents; HAN acts solely as your authorized representative in producing them.

1.5 SMS Messaging Practices

FleetScan uses SMS messaging exclusively for one-time-code verification, specifically: (a) account login one-time codes; and (b) USDOT-binding verification codes sent to the FMCSA-registered phone number for the USDOT you are binding to your account.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and your mobile phone number are not sold, licensed, or shared with any third party for marketing. The only third-party processor that receives your mobile number is Twilio, Inc., which delivers the SMS on our behalf under contract; Twilio is not authorized to use your number for any purpose other than delivering FleetScan's verification SMS.

Message frequency: SMS is rate-limited to a maximum of one verification code per binding attempt (with a 60-second resend cooldown) and one optional confirmation message upon successful binding. We do not send recurring, marketing, or promotional SMS through this number.

Standard message and data rates may apply depending on your wireless carrier and plan.

Opt-in: You opt in by tapping the "Send Code" button on the dedicated SMS consent screen inside the FleetScan iOS app, after reviewing the four disclosure bullets and the explicit consent statement shown on that screen. No SMS is ever sent without this in-app tap.

Opt-out and revocation: Reply STOP to any FleetScan SMS to opt out immediately; reply HELP for help. You can also revoke SMS consent at any time by permanently deleting your FleetScan account in Account → Permanently Delete Account, or by contacting association@atiaunion.org.

Operator: SMS is sent from the U.S. long code +1 (949) 591-8952, registered to HAN Transportation Inc. and approved under The Campaign Registry (TCR) A2P 10DLC framework (Brand ID BUKNQ95).

2. How We Use Your Information

Purpose	Data Used	Legal Basis
Authenticate you at registration	Mobile phone, email, FMCSA-registered phone & email (one-time, verification only)	Performance of contract; legitimate interest in fraud prevention
Authenticate subsequent logins	Mobile phone or email + one-time code	Performance of contract
Display your bound carrier and uploaded documents	USDOT binding, uploaded files	Performance of contract
Process Service Requests	Service request content, contact info, relevant documents	Performance of contract
Deliver document expiry reminders	Push token, document expiry metadata	Consent
Deliver service recommendations relevant to your fleet	USDOT, document expiry metadata, contact info you directly provided to FleetScan	Legitimate interest, with opt-out available
Detect and prevent unauthorized access	Authentication session metadata	Legitimate interest in security
Improve the App	Anonymous error reports	Legitimate interest

We do not sell your personal information.

We do not use your information for cross-context behavioral advertising or third-party advertising profiling.

We do not use FMCSA-sourced contact data for marketing purposes; marketing communications are sent only to the contact channels you have directly provided to FleetScan.

3. Sharing and Disclosure

We share your information only with the following categories of recipients:

Supabase, Inc. — provides hosting, database, file storage, and authentication infrastructure. All data is stored on Supabase servers located in the United States.
Tawk.to Ltd. — provides the in-app live chat feature. Messages you send through live chat are stored on Tawk.to's servers under their privacy policy. Do not include sensitive information in live chat messages.
Apple Push Notification Service (Apple Inc.) and Google Firebase Cloud Messaging (Google LLC) — receive only your push notification token and the content of notifications you have opted into.
FMCSA / U.S. Department of Transportation — when you submit a Service Request that requires a regulatory filing, HAN will submit your information and supporting documents to the relevant federal or state agency on your behalf, with your authorization.
HAN Transportation Inc. staff — only employees specifically authorized in our internal access control list (the staff_users allowlist) may view your information, and only when you submit a Service Request or otherwise request HAN's assistance. HAN staff do not access Self-Service Users' files unless and until a Service Request is submitted.

We do not share your information with any other third party except when required by law (subpoena, court order, government investigation) or to protect the rights, property, or safety of HAN, our users, or the public.

4. Data Retention

Data Category	Retention Period
Account identifiers (phone, email)	Until you delete your account
Uploaded compliance documents	Until you delete the document or your account
HAN-generated documents	Until you delete the document or your account
Service Requests (completed)	3 years from completion date, aligned with FMCSA accident-record retention norms
Service Requests (cancelled or unfulfilled)	1 year from cancellation date
Aggregated, anonymized service metrics	Indefinitely; contains no PII
Authentication session logs	90 days
Anonymous error logs	30 days
FMCSA-sourced verification data	Used at registration only; not stored

Upon account deletion, all data tied to your identity is permanently removed from our active systems within 30 days, except where (a) retention is legally required, (b) the data has been anonymized and cannot be re-associated with you, or (c) the data is held in routine encrypted backups, which are purged on their normal rotation schedule (no later than 90 days).

5. Your Rights

5.1 Rights Available to All Users

Access your data — use "Export My Data" in Account → Privacy.
Correct your data — update phone or email through Account; correct binding or documents by re-upload or customer support.
Delete your account — Account → Permanently Delete Account.
Opt out of push notifications — iOS Settings → Notifications → FleetScan, or Android system settings.
Opt out of marketing communications — disable "Service Recommendations" in Account → Notifications, or use unsubscribe in any marketing email.
Restrict or object — email association@atiaunion.org.

5.2 Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have the rights described in Section 5.1, plus:

Right to know what personal information we have collected, the categories of sources, the business purposes for collection, and the categories of third parties to whom we disclose it. Sections 1, 2, and 3 of this Policy describe our practices.
Right to opt out of sale or sharing of personal information. We do not sell your personal information and we do not share it for cross-context behavioral advertising. No opt-out is required for activities we do not engage in.
Right to limit use of sensitive personal information. FleetScan does not collect sensitive personal information as defined under CPRA.
Right to non-discrimination — we will not deny service, charge a different price, or provide a different quality of service for exercising your privacy rights.

To exercise these rights, email association@atiaunion.org or call +1 949-295-3025. We will verify your identity using your registered phone and email before fulfilling the request.

5.3 No Sale of Personal Information

HAN Transportation Inc. has not sold the personal information of any user in the preceding 12 months and has no plans to do so. We do not authorize any third party to sell user personal information.

6. Children

FleetScan is intended exclusively for trucking professionals 18 years of age or older. We do not knowingly collect personal information from anyone under 13. If we discover that we have collected such information, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at association@atiaunion.org.

7. Security

Transport encryption — all communications use HTTPS / TLS 1.2 or higher.
At-rest encryption — uploaded files stored in private object-storage buckets with encryption at rest.
Row-level security — database access governed by RLS; you can only access rows tied to your own user identity.
No password storage — authentication is exclusively via one-time codes (OTP) sent to your registered phone or email.
Device-level credential storage — authentication tokens stored in iOS Keychain or Android Keystore via Expo SecureStore.
HAN staff access controls — staff can access user data only when (a) you submitted a Service Request, or (b) you explicitly requested HAN's assistance, or (c) required by law. Access is logged.

Important user responsibility: Because FleetScan authenticates via one-time codes sent to your registered phone and email, the security of your account is directly tied to the security of those communication channels. Anyone in possession of your registered phone number or email address can complete the OTP login flow and access your account. You are responsible for maintaining the security of your phone, your phone number (including protecting against SIM-swap attacks), and your email account. HAN staff will never ask for your verification code; do not share it with anyone.

8. Data Location and International Users

All FleetScan servers and data storage are located within the United States. By using FleetScan, you consent to the processing of your information in the United States, which may have data protection laws different from those of your country of residence. FleetScan is not designed for, marketed to, or actively offered to users outside the United States. If you are located outside the United States, please do not use FleetScan.

9. Third-Party Links and FMCSA References

The App may display links or references to FMCSA websites (such as safer.fmcsa.dot.gov) and other third-party regulatory websites. We are not responsible for the privacy practices or content of those websites. You should review their privacy policies before providing any information to them.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last Updated" date;
Display an in-app notice at your next launch;
For changes that materially expand our use of your information, request your renewed consent before applying them to your account.

Continued use of the App after the effective date of an update constitutes acceptance of the updated Policy.

11. Contact Us

For privacy-related questions, requests, or complaints:

HAN Transportation Inc.
San Bernardino County, California, USA
Phone: +1 949-295-3025
Email: association@atiaunion.org
Website: https://www.atiaunion.com

If you are not satisfied with our response, you have the right to lodge a complaint with the California Attorney General's Office or the relevant data protection authority in your jurisdiction.