BoxMaster Privacy Policy

1. Which part of this policy applies to you

BoxMaster is used by three kinds of people, and the answer to "what happens to my data" is different for each.

If you are a fleet administrator or a dispatcher, you or your company signed up for BoxMaster. The records your company creates on the platform belong to your company. We hold them on your behalf.

If you are a driver, your employer gave you access to BoxMaster. Your personal profile is yours. The operating records you generate while working — routes, deliveries, hours-of-service logs, inspections, fuel purchases — belong to the motor carrier you work for, not to us and not to you. We cannot remove them at your request, because they are not ours to remove and your employer is often legally required to keep them.

If you are visiting our website, we only handle what you type into the contact form or the account deletion form.

2. Our role: who decides what happens to your data

This distinction matters, so we are stating it plainly.

For everything a motor carrier puts into BoxMaster — its drivers, its trucks, its routes, its documents — the carrier decides, and we act on its instructions. In the language of U.S. privacy law, the carrier is the business or controller, and we are the service provider or processor. We do not use that information for our own purposes. We do not sell it. We do not share it with anyone except the providers listed in Section 7, and only so that the platform can work.

For our own business — your account with us, our billing, and the outreach we send to prospective customers — we decide, and we are the controller.

If you are a driver or a dispatcher and you want your operating records corrected or removed, the person to ask is your employer, not us. If your employer asks us to act, we act.

3. What we collect

3.1 Account information

• Name, email address, and phone number
• Role (administrator, dispatcher, or driver) and the company you belong to
• Password (stored only as a cryptographic hash — we never see it)
• Multi-factor authentication settings, for administrator, dispatcher, and driver accounts

3.2 Driver identity and qualification records

Collected because motor carriers are required to verify who is operating their vehicles.

• A photograph of your face
• Photographs of the front and back of your driver's license
• Driver's license number and issuing state
• Documents your employer uploads about you — medical certificates, qualification records, and similar — together with any notes your employer writes on them
• Signed driver contracts, including the image of your signature, the date and time you signed, and the IP address and browser you signed from

3.3 Operating records

• Routes, stops, pickup and delivery addresses, appointment times, and status
• Names and phone numbers of contacts at pickup and delivery locations. These are people at other companies; the carrier that entered them is responsible for having the right to do so.
• Proof-of-delivery photographs and documents
• Vehicle inspections, mileage readings, and maintenance records
• Fuel purchases, including a photograph of the pump display, gallons, price, and the state where the purchase was made
• Incident reports and their photographs

3.4 Hours-of-service and electronic logging records

Required by the Federal Motor Carrier Safety Administration.

• Duty status changes and driving time
• Daily certification of logs, including the image of your signature
• Edits and annotations to logs, and who made them
• Records of driving time not attributed to an identified driver, including the geographic coordinates where it occurred
• Electronic logging device identifiers, pairings, and malfunction events

3.5 Financial records

• Driver pay per route, payment batches, and deductions
• Invoices, invoice line items, and the clients they were issued to
• Company overhead and cost-per-mile figures
• Subscription and billing status

We do not store payment card numbers or bank account details. Those go directly to Stripe (Section 7).

3.6 Technical information, cookies, and local storage

• IP address, approximate city and region derived from it, browser, and device identifier, recorded when you sign in
• Which pages you use and when

We do not use advertising cookies, analytics cookies, or third-party trackers. What we do use is the minimum needed for the platform to function:

• Local storage in your browser holds your sign-in session so you do not have to log in on every page. Clearing it signs you out.
• Google Fonts serves the typefaces on our website. Google receives your IP address as part of that request, as it does for any site that loads a font from its servers.

Because none of this is used for advertising or tracking, we do not show a cookie consent banner.

4. Location data — what we do and do not do

We are being specific here because it is the question people ask first.

We do not ask your phone or your browser for your location. BoxMaster does not request location permission and does not track where you are.

Location reaches the platform in three ways, and only three:

1. From the electronic logging device attached to the truck. Federal rules require an ELD to record the vehicle's position at duty status changes and at regular intervals while driving. That reading describes where the truck was, and it exists because the law requires it, not because we chose to collect it.
2. From addresses that people type in. When a dispatcher enters a pickup or delivery address, we send it to Google's routing service to calculate mileage (Section 7). That is an address on a form, not your position.
3. From your IP address when you sign in. This gives an approximate city and region. It is not precise, and we use it only to show account owners where their sessions are being opened from.

5. How we use it

• To run the platform: dispatch routes, record deliveries, track vehicles, and produce the reports carriers need
• To meet regulatory requirements — hours-of-service compliance, IFTA fuel tax reporting, and driver qualification files
• To calculate pay, issue invoices, and process subscription billing
• To keep accounts secure and detect unauthorized access
• To answer your questions and provide support
• To send transactional messages: invoices, password resets, and notices about your account

We use the information in Section 3 for the purposes above and for nothing else. We do not build advertising profiles. We do not sell personal information, and we have never sold it.

6. Artificial intelligence

BoxMaster uses AI to read documents and photographs so that people do not have to type their contents by hand. We are telling you exactly what leaves the platform and where it goes.

What we send to OpenAI:

What this means for your data. OpenAI does not use data submitted through its API to train its models. It retains inputs and outputs for up to 30 days to detect abuse, and then deletes them. We do not opt in to any program that would allow training on your data.

What we do not send. We do not send driver license photographs, face photographs, signature images, or driver qualification documents to any AI service.

The assistant tells you it is AI. The in-app assistant is labeled as such. It is not a person and it does not give legal, medical, or financial advice.

7. Who else handles your information

These are the companies that make BoxMaster work. Each one receives only what it needs, and each is bound by its own agreement with us.

All processing takes place in the United States. We do not transfer personal information outside the country.

We also disclose information when the law requires it — a subpoena, a court order, a lawful request from the Federal Motor Carrier Safety Administration or another regulator — or when we believe in good faith that disclosure is necessary to prevent serious harm.

Business contact information

Separately from the platform, we keep business contact details for companies we approach or that contact us: a name, a work email address, a phone number, a company name, and fleet size. This information comes from public records — including the Federal Motor Carrier Safety Administration's public carrier registry — or from our website's contact form.

If you received an email from us and do not want to hear from us again, use the unsubscribe link in that message or write to the address in Section 14, and we will remove you. You can also ask us what we hold about you and we will tell you.

8. How long we keep it

When a carrier closes its account, access ends immediately and the company's records are retained for the period above. After that period they are deleted permanently — there is no backup and no recovery. Deletion is performed manually, so it may take place some time after the six months have elapsed, but never before.

Before you close an account, export what you need. Fleet administrators can download their records from the Data Center at any time while the account is active. After closure you no longer have access, and obtaining a copy means writing to us and waiting up to 20 business days.

9. Your choices

Access your information. Fleet administrators can export routes, driver payroll, fleet and maintenance, billing, contracts, and incident records from the Data Center at any time. For anything not covered by that export, write to us and we will provide it within 20 business days.

Correct your information. You can edit your own profile from My Account. If something is wrong in a record your employer controls, ask your employer.

Delete your account. From My Account inside the app, or from boxmasterapp.com/delete-account on our website. Section 8 explains what is deleted and what is retained.

Stop marketing email. Every marketing message we send has an unsubscribe link. Transactional messages — invoices, password resets, account notices — are part of the service and cannot be turned off while your account is active.

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information is collected about you, to request its deletion, to request correction, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising. To make a request, write to the address in Section 14. Where your information belongs to a motor carrier that uses BoxMaster, we will pass your request to that carrier and support them in answering it.

We are not subject to the Utah Consumer Privacy Act. That law applies to businesses with at least $25 million in annual revenue that also meet a data volume threshold. We meet neither. We are telling you this rather than claiming compliance with a law that does not apply to us.

10. Security

• All data is encrypted in transit and at rest.
• Access to a company's records is enforced by the database itself, so one carrier cannot reach another carrier's data. A small number of server-side operations — exports and administrative tasks — run with elevated privileges and enforce that same separation in code rather than in the database.
• Files that contain personal information — photographs, documents, signed contracts, proof of delivery — are stored in private buckets and served through links that expire after one hour. Two categories of file are public by design and their links do not expire: the QR code printed on a truck, which encodes only a unit number, and a company's own invoice logo.
• Multi-factor authentication is available for administrator, dispatcher, and driver accounts, and we recommend turning it on.
• Sign-in attempts are rate limited by our authentication provider, and account sessions are recorded so owners can see where their account is being used.

No system is perfectly secure. If we discover a breach of security affecting your personal information, we will notify you without unreasonable delay, and in any event within 72 hours of confirming it, and we will tell you what happened, what information was involved, and what we are doing about it. We will also notify regulators as required by Utah's Protection of Personal Information Act and any other law that applies.

11. Children

BoxMaster is a business tool for commercial motor carriers. It is not directed at children and we do not knowingly collect information from anyone under 18. If you believe a minor has an account, write to us and we will remove it.

12. If our business changes hands

If BoxMaster is sold, merged into another company, or acquires an investor who takes control of the business, the information described in this policy may transfer to the new owner as part of that transaction.

If that happens, the information stays subject to this policy until you are notified otherwise. We will tell account holders before any transfer takes effect, and a new owner that wants to handle your information differently has to tell you and give you the chance to close your account first.

13. Changes to this policy

If we change this policy in a way that affects how we handle your information, we will post the new version here with a new version number and effective date, and we will notify account holders. Continuing to use BoxMaster after a change means you accept the updated policy.

We keep a record of which version of this policy each account holder accepted and when. If you want to know which version applies to you, or to see the text of an earlier version, write to us and we will send it.

14. Contact us

Herrera Master Solutions LLC
3372 W Sanctuary Ct
Taylorsville, UT 84129
United States

Email: angelo@boxmaster2608.com

Write to us about anything in this policy — a question, a request for your data, a correction, or a complaint. We answer within 20 business days.