Data Processing Addendum
Last updated: October 28, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service or, if you signed one, the Master Service Agreement (the "Agreement") between BlueCollar Fleet ("Processor", "we") and the customer ("Customer", "you"). It applies when we process Personal Data on your behalf through the Service. It takes effect automatically when you accept the Agreement. If you need a signed copy, email [email protected].
1. Definitions
"Personal Data" means information about an identified or identifiable person that you put into the Service (for example, names, emails and phone numbers of you and your drivers, driver pay, and truck locations recorded during trip tracking). "Data Protection Laws" means U.S. federal and state privacy laws that apply to the processing (such as the California Consumer Privacy Act as amended, and similar state laws), and, if they apply, the GDPR and UK GDPR. "Subprocessor" means a third party we use to process Personal Data. "Security Incident" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
2. Roles
You are the controller (or "business") of Personal Data in your account. We are the processor (or "service provider" / "contractor"). We process it only to provide the Service. For our own account and billing records, website analytics and marketing, we act as an independent controller under our Privacy Policy.
3. Your instructions
We process Personal Data only on your documented instructions. The Agreement, your use and settings in the Service, and this DPA are your instructions. If we believe an instruction breaks Data Protection Laws, we'll tell you. You're responsible for having a lawful basis and giving any notices (for example, telling drivers their trips are tracked) required to put Personal Data in the Service.
4. Details of processing
| Subject matter and duration | Providing the Service for the term of the Agreement, plus the deletion period in section 11 |
|---|---|
| Nature and purpose | Hosting, storing, syncing, reading scanned documents, calculating miles and reports, sending emails you trigger, support |
| Types of Personal Data | Names, email addresses, phone numbers, driver pay and settlement details, location points during trip tracking, contents of documents and photos you upload |
| Data subjects | Your owners, staff, drivers, dispatchers, accountants, and contacts (such as brokers) you record |
| Sensitive data | Not intended. Don't upload Social Security numbers, bank account numbers or health information unless a feature asks for it. |
5. Our commitments (U.S. state laws)
We won't: sell or share Personal Data (as those terms are defined in the CCPA); keep, use or disclose it for any purpose other than providing the Service, including any commercial purpose other than the Service; use it outside our direct business relationship with you; or combine it with personal information we get from others, except as Data Protection Laws allow. We'll comply with applicable Data Protection Laws, give the same level of protection they require, and tell you if we can no longer meet our obligations. You may take reasonable steps to stop and fix unauthorized use.
6. Confidentiality
Everyone we authorize to process Personal Data is bound by confidentiality.
7. Security
We maintain appropriate technical and organizational measures, including: encryption in transit (TLS) and at rest; separation of each company's records with database row-level security; private file storage with access-controlled links; email-code sign-in; least-privilege access to production systems; logging; and backups. We may update these measures as long as protection isn't reduced.
8. Subprocessors
You authorize us to use the Subprocessors listed below. We bind each by written terms with data protection obligations at least as protective as this DPA, and we're responsible for their compliance. We'll give at least 15 days' notice (by email or an update to this page) before adding or replacing a Subprocessor. If you object on reasonable data-protection grounds and we can't resolve it, you may end the affected Service and get a refund of prepaid, unused fees.
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, server functions | United States |
| Cloudflare, Inc. | Hosting, content delivery, security | United States / global edge |
| Anthropic, PBC | AI reading of documents, photos and pasted load text | United States |
| Stripe, Inc. | Payment processing and billing | United States |
| Resend (Plus Five Five, Inc.) | Transactional email | United States |
| Heidelberg Institute for Geoinformation Technology (openrouteservice) | Road-mile routing; receives place names or coordinates only | Germany (EU) |
9. Requests from people
If someone asks us directly to access, correct or delete their data in your account, we'll pass it to you and won't answer it ourselves unless you tell us to or the law requires. We'll give reasonable help, including the in-app export and delete tools, so you can respond.
10. Security Incidents
We'll notify you without undue delay, and within 72 hours, after confirming a Security Incident affecting your Personal Data. We'll tell you what we know, what we're doing about it, and update you as we learn more. Our notice isn't an admission of fault.
11. Return and deletion
You can export your data at any time. When the Agreement ends or you close your account, we delete Personal Data within 90 days (backups within a further 30 days), unless the law requires us to keep some of it, in which case we keep it protected and only for that purpose.
12. Audits and help
On written request (no more than once a year, unless required by a regulator or after a Security Incident), we'll provide information reasonably needed to show compliance with this DPA, including written answers to a security questionnaire. We'll give reasonable help with data protection impact assessments and consultations with regulators, relating to our processing.
13. International transfers
We store data in the United States. If GDPR or UK GDPR applies and Personal Data is transferred out of the EEA or UK, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum, which are incorporated by reference, with this DPA providing the required details. Routing requests to openrouteservice in the EU contain only place names or coordinates.
14. Liability and order
Each side's liability under this DPA is subject to the limits in the Agreement. If this DPA conflicts with the Agreement about Personal Data, this DPA controls.