Privacy Policy

1. Who we are and what this covers

Freighthub is operated by [LEGAL ENTITY NAME] trading as BA Fast Freight (“Freighthub”, “we”, “us”), a logistics-technology company headquartered in California. We run a freight marketplace and logistics platform for motor carriers, freight brokers, shippers and their drivers.

This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the rights you have. It covers our website, our iOS and Android apps, our APIs, and our support channels (together, the “Platform”).

Freighthub is a business-to-business service. Most information we handle is business information. Some of it — names, work emails, phone numbers, driver location — is personal information, and this policy is about that.

Privacy questions: privacy@bafastfreight.com

2. The short version

3. Information we collect

3.1 Information you give us

Account and identity. Name, work email address, phone number, password (we store only a salted bcrypt hash, never the password itself), role (carrier, broker, shipper, driver, admin), organisation, and profile details you choose to add.

Company and regulatory. Legal business name, MC number, USDOT number, addresses, and the company preferences and settings you configure.

Compliance documents. Certificates of insurance (including certificate-holder details), carrier qualification and onboarding packets, W-9s and other documents you upload. We record who views or downloads insurance documents and when.

Freight and transaction data. Loads and trucks you post, lanes, equipment, commodities, rates, bids, bookings, RFP submissions, rate confirmations and the electronic signatures applied to them.

Proof of delivery. Photographs drivers capture at delivery, stored as image data and linked to the booking, load and driver.

Communications. Messages you send through in-app chat, support tickets and support chat (including conversations with our AI assistant), contact and demo requests, and ratings or reviews you leave about other users.

Payment information. Subscription plan, billing status and history. Card details go directly to Stripe — we receive only a token and limited metadata such as card brand, last four digits and expiry.

3.2 Information other people give us about you

Similarly, brokers and shippers may record your company as a counterparty, and team administrators may invite you and set your role.

3.3 Information we collect automatically

• Precise geolocation (drivers only). See section 4 — it has its own section because it is sensitive.
• Device and app information. Device identifier, platform (iOS/Android), app version and push notification token, so we can deliver dispatch alerts.
• Usage and technical data. IP address, browser and device type, pages and features used, timestamps, referring pages, session identifiers, and aggregate daily visit counts.
• Diagnostics. Crash reports, error traces and performance data, collected through Sentry so we can find and fix faults.
• Cookies. See section 9.

3.4 Information from third parties

• FMCSA and safety data. Carrier authority, insurance, safety and inspection data from FMCSA sources (QCMobile, SAFER, Licensing & Insurance) using the MC/USDOT numbers provided.
• Fraud and verification signals. Indicators we generate or obtain to assess the risk of an account or transaction.
• Container, rail and terminal data. Milestones and availability retrieved from ocean carriers, railroads and marine terminals for Track & Trace.
• Payment status. Subscription and payment outcomes from Stripe.

4. Driver location — how it works and what limits it

Precise geolocation is sensitive personal information under California law and we treat it that way.

What we collect. Latitude and longitude, speed, heading, GPS accuracy, device battery level, and the time each position was recorded — sampled roughly every 45 seconds or 400 metres, whichever comes first.

• Only with consent. The app never shares location until the driver both turns sharing on inside Freighthub and grants their phone’s location permission. It is never enabled silently, and never enabled remotely by a carrier.
• Only during an active trip. Sharing is bound to one trip and runs only between “en route to pickup” and delivery. Outside that window the app reports nothing and our servers reject location data for that trip. Delivery ends collection automatically.
• Who can see it. Only the carrier that booked the load, the broker or shipper on that load, and Freighthub administrators. It is not shown to other users, not sold, and not shared for advertising.
• Turning it off. A driver can stop sharing at any time from the app or their phone’s settings. Doing so does not prevent them completing the trip or using the rest of the app — it only means dispatch has to call for updates.
• Retention. Recorded positions are automatically deleted after 90 days.

Background collection. If the driver grants “Always” location permission, the app can report while backgrounded or the phone is locked — because a phone in a truck mount is locked. Android shows a persistent notification and iOS shows its location indicator throughout. With “While using the app” permission, collection pauses whenever the app is not open.

What we do not do. We do not build a background history of where drivers go, and we do not track anyone off duty. Location is never collected from carrier, broker or shipper accounts on the web app.

Why we keep it at all. So carriers, brokers and shippers can see load progress and ETA, and so there is a record of the route driven if a delivery, detention or service failure is later disputed.

Carriers: monitoring your drivers’ location may trigger employee-monitoring and notice obligations under state law. That responsibility is yours, not ours.

5. How we use information

We use personal information to:

• create and administer accounts, authenticate users and maintain sessions;
• verify carrier identity, operating authority, insurance and safety status;
• operate the marketplace — matching, posting, searching, bidding, booking;
• support dispatch, driver assignment and proof of delivery;
• provide location tracking and ETAs as described in section 4;
• deliver messaging, notifications and email/SMS alerts you have configured;
• process subscriptions, billing and collections;
• provide customer support, including AI-assisted support and escalation to a human agent;
• detect, investigate and prevent fraud, double-brokering, abuse and security incidents;
• meet legal, tax, audit and regulatory obligations, and enforce our Terms;
• monitor reliability, diagnose faults and improve the Platform;
• produce aggregated, de-identified market analytics (lane rates, capacity trends, indices) that do not identify any person or individual transaction.

We do not use your personal information for automated decisions producing legal or similarly significant effects without human involvement.

6. How we share information

6.1 With other users

The Platform’s purpose is to connect counterparties, so some information is visible by design:

• Your company name, MC/USDOT number, verification status and ratings are visible to users you transact or negotiate with.
• Loads and trucks you post are visible to users entitled to that board.
• Your contact details become visible to a counterparty when you engage in a transaction with them.
• Insurance documents are shown to brokers or shippers who request them — and we log every view and download.
• Driver name and trip status are visible to the carrier that dispatched the load and to the broker or shipper on that load; location is shared as described in section 4.

6.2 With service providers

We share information with vendors who process it on our behalf, under contract, only for these purposes:

6.3 AI support specifically

When you use support chat, your messages and the conversation context are sent to Anthropic to generate a reply. We do not permit Anthropic to use your conversations to train its models. If a conversation is escalated, an automated summary is created for the human agent who takes over. Please do not put payment card numbers, passwords or other secrets into support chat.

6.4 Other disclosures

• Legal and safety. Where required by law, subpoena, court order or regulator; to investigate fraud or security incidents; or to protect the rights, property or safety of Freighthub, our users or the public.
• Business transfers. In a merger, acquisition, financing, reorganisation or sale of assets — with notice to you if a transfer materially changes how your information is handled.
• Your organisation. Administrators of your company account can see account activity, entitlements and usage of the users they manage.
• With your direction. Where you connect a TMS or third-party integration, or otherwise tell us to share.

6.5 What we do not do

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not run third-party advertising trackers on the Platform.

7. Security

We protect information with measures including:

• passwords stored as salted bcrypt hashes, never in plain text;
• encryption in transit (TLS) between clients, our servers and our database;
• HttpOnly, SameSite and — in production — Secure session cookies;
• CSRF protection on state-changing requests;
• PostgreSQL row-level security and least-privilege database roles;
• rate limiting on authentication, search, messaging and expensive endpoints;
• third-party credentials encrypted at rest with AES-256-GCM, under a master key held outside the application database;
• access logging for sensitive documents, and an administrative audit trail;
• automated error monitoring.

No system is perfectly secure, and we cannot guarantee absolute security. Tell us immediately at security@bafastfreight.com if you believe your account has been compromised or you have found a vulnerability.

8. How long we keep information

After you delete your account we may retain limited information where we must — for legal, tax, audit, fraud-prevention or dispute-resolution purposes — and we retain records of transactions you were party to, because your counterparties have their own legal need for them.

9. Cookies and similar technologies

We run two categories, and no others. There is no advertising category because we do not run advertising.

9.1 Strictly necessary — always on

These make the Platform work. Switching them off would stop you signing in, so they are not optional and we do not ask consent for them.

9.2 Error and performance monitoring — optional

With your permission we send crash reports and page-performance traces to Sentry, our monitoring provider, so we can find and fix faults. It carries technical details and a limited identifier — never your freight, rates or messages.

This is off until you accept it. If you decline, or have not answered yet, monitoring does not start. Declining means we may not hear about a bug that affects you; it does not limit any feature.

9.3 Changing your mind

Use the Cookies link in the footer of any page, or the button below, to change your choice at any time. Your choice is stored for 12 months.

Cookie preferences

9.4 Do Not Track and Global Privacy Control

We honour Global Privacy Control: if your browser sends a GPC signal, optional monitoring starts switched off. You can still turn it on yourself. Because we do not sell or share personal information for behavioural advertising, there is nothing further for an opt-out signal to switch off.

You can also block cookies in your browser, but authentication cookies are required to sign in.

10. Your privacy rights

10.1 Rights available to everyone

• Access the personal information we hold about you;
• Correct inaccurate information — most of it directly in your profile and company settings;
• Delete your account, from account settings. Deleting revokes your sessions and any paired driver devices, and removes your user record, subject to section 8;
• Turn off location sharing at any time (drivers);
• Opt out of marketing email using the unsubscribe link. Operational messages — dispatch alerts, billing notices, security notices — are part of the service and cannot be switched off while your account is active;
• Manage notifications in your notification settings.

10.2 California residents (CCPA/CPRA)

Categories collected in the past 12 months: identifiers; personal information under Cal. Civ. Code § 1798.80; commercial information; internet or network activity; precise geolocation; audio, electronic or visual information (proof-of-delivery photographs, electronic signatures); professional or employment-related information; and inferences drawn for fraud and risk scoring.

Sensitive personal information. We collect precise geolocation (drivers, during active trips) and account credentials. We use it only to provide the service, secure the Platform and meet legal obligations — never to infer characteristics about you. Under CPRA you may limit the use of sensitive personal information; contact privacy@bafastfreight.com.

We have not sold or shared personal information for monetary or other valuable consideration, or for cross-context behavioural advertising, in the past 12 months. We do not knowingly collect or sell the personal information of anyone under 16.

Your California rights: to know, access and receive a portable copy; to delete; to correct; to opt out of sale or sharing (not applicable — we do neither); to limit sensitive personal information; and to be free from discrimination for exercising these rights. We will not deny service, charge a different price or provide a lower quality of service because you exercised a privacy right.

10.3 Other US state privacy laws

If you live in Virginia, Colorado, Connecticut, Utah or another state with a comprehensive privacy law, you have broadly equivalent rights to access, correct, delete and obtain a copy of your personal information, and to opt out of targeted advertising, sale and certain profiling — none of which we do. You may also appeal a decision we make on your request; appeal instructions will be included in our response.

10.4 How to exercise your rights

Use your account settings where the control exists, or contact privacy@bafastfreight.com with enough detail to identify your account.

• We verify your identity before acting, usually by confirming control of the account email.
• We respond within 45 days, and may extend once by a further 45 days with notice.
• An authorised agent may act for you with written permission; we may still verify with you directly.
• There is no charge unless a request is manifestly unfounded or excessive.

10.5 If you are a driver

Your carrier added you to its roster and controls your dispatch record. For questions about why you are being tracked, or to have your roster record removed, contact your carrier first — they decide who is on their roster. You may still contact us directly at privacy@bafastfreight.com to exercise your rights over information we hold, and you can turn off location sharing yourself at any time.

11. Children

The Platform is for business use by adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact privacy@bafastfreight.com and we will delete it.

12. International users

We operate in the United States and store and process information there. If you access the Platform from outside the US, you understand your information will be transferred to and processed in the US, where data-protection law may differ from your own.

13. Changes to this policy

We may update this policy. We will change the “Last updated” date and, for material changes, give notice through the Platform or by email before they take effect. Continuing to use the Platform after the effective date means you accept the updated policy.

14. Contact us