Privacy Policy

DQTrack is operated by Pipim Ltd, a company registered in England and Wales (company number 16852516), registered office 128 City Road, London, EC1V 2NX, United Kingdom.

For questions about this policy or your data, contact [email protected].

Pipim Ltd is subject to UK data protection law. You may complain to the UK Information Commissioner's Office at ico.org.uk. An ICO registration number will be added here once issued.

Account data — we are the controller. Information about the person and company who subscribe to DQTrack: name, work email, company name, USDOT number, billing details. We decide how this is used, and this policy governs it.

Driver and vehicle data — we are the processor. Information about your drivers and vehicles that you upload or enter: names, licence details, medical examiner's certificates, motor vehicle records, drug and alcohol testing records, vehicle inspection records.

We do not decide what happens to this data. You do. Your company is the data controller. We process it only on your documented instructions, under the Data Processing Agreement that forms part of our Terms.

If you are a driver and want to see, correct, or delete information held about you in DQTrack, contact your employer. They control that record. We will help them respond, but we cannot act on it without their instruction.

We do not sell your data. We do not share it with advertisers. We do not use your data, or your drivers' data, to train machine learning models.

Card details are handled entirely by Stripe. We never see or store your full card number.

We know this is sensitive. Medical examiner's certificates are health information. Drug and alcohol records are more sensitive still.

What we do:

• Store documents in private storage. There is no public link to any file.
• Serve files only through short-lived signed links, to signed-in users of your carrier account.
• Isolate every carrier's data at the database level, so one customer's account can never read another's.
• Encrypt data in transit (TLS) and at rest.
• Record every change to a compliance record or date, and every document upload or verification, in an append-only audit trail.
• Retain records according to the FMCSA rules described in section 6, not according to what is convenient for us.

What we deliberately do not do:

• We never ask for, extract, or index Social Security numbers. If a document you upload contains one, it stays inside that document and is never read into a field or a search index.
• We do not read your documents for any purpose other than providing the service to you.
• We do not use driver data for analytics, marketing, benchmarking, or product research.

Your data is stored in the United States, in data centres operated by our infrastructure providers (see section 7).

Pipim Ltd is a UK company. A small number of authorised personnel may access your data in order to operate the service and answer support requests. Access is limited to what is necessary, protected by multi-factor authentication, and logged. Where that access takes place outside the United States, it is covered by the transfer safeguards below.

Where personal data is transferred out of the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another approved transfer mechanism. Customers are told the specific countries involved in our Data Processing Agreement (Schedule A of the Terms), which forms part of your contract with us.

Driver and vehicle records are retained according to the federal rules your own compliance depends on:

• Driver qualification records: for as long as the driver is employed by you, and three years afterwards.
• Records that federal rules allow to be discarded — annual motor vehicle records, annual review notes, medical certificates and variances — remain available for three years after execution.
• Vehicle maintenance records: one year, and six months after a vehicle leaves your fleet.

We will not delete these records early, even if you ask us to, while they are within a federal retention period, because deleting them could put you out of compliance. You can always export everything.

Account data is kept while your subscription is active and for 12 months after it ends, then deleted. Billing records are kept for 7 years, as UK company law requires.

On cancellation, you keep read and export access to your documents. Tell us to delete your account and we will delete all of it within 30 days, apart from billing records we are legally required to keep — and it is then gone from backups within a further 30 days.

We use these sub-processors. We remain responsible for what they do with your data.

We will tell you before we add or change a sub-processor, and you may object. The current list always lives at dqtrack.com/subprocessors.

If you are in the UK or EU you have the right to access, correct, delete, restrict, port, or object to our processing of your account data, and to withdraw consent where we rely on it. Email [email protected] and we will respond within one month.

If you are a California resident, the CCPA as amended by the CPRA applies to personal information about employees and job applicants. You have the right to know what we hold, to correct or delete it, and to know whether it is sold or shared — we do not sell or share personal information. For driver data, we act as a service provider to your employer; direct your request to them.

You may complain to the UK Information Commissioner's Office at ico.org.uk.

If personal data we hold is breached, we will notify the affected customer without undue delay and, where we are the controller, the ICO within 72 hours where required. We will tell you what happened, what data was involved, and what we are doing about it. We would rather tell you early and imperfectly than late and neatly.

We use a session cookie to keep you signed in, and cookies required for security checks (including Cloudflare Turnstile when enabled). We also use Vercel Analytics and Vercel Speed Insights to understand page traffic and performance. Those tools are first-party to our hosting provider and are not used for advertising. We use no advertising cookies and no third-party ad trackers. If we later add other analytics tools, this section will be updated and a cookie notice added where required.

DQTrack is a business tool. It is not intended for anyone under 18, and we do not knowingly collect data from children.

If we change this policy in a way that materially affects you, we will email you at least 30 days before it takes effect. The date at the top always shows the current version.