Privacy Policy

1. Plain-language summary

MC Active is operated by Anduin Enterprises LLC (“we,” “us,” or “MC Active”). We collect only what the Service needs to monitor your public FMCSA records and to alert you about deadlines you supply. Driver and vehicle data live on EU-hosted infrastructure with GDPR-standard defaults. We never sell your data. You can delete it at any time.

2. What we collect

• Account data: your name, email address, USDOT number, and the password hash used to authenticate your account.
• Carrier public data: records we fetch from the FMCSA QCMobile API for your USDOT (legal name, safety rating, MCS-150 date, insurance filings, operating authority status).
• Driver and vehicle data you upload for paid tiers, including CDL number, driver name, date of birth, medical certificate fields, VIN, plate, and inspection records.
• Attestation logs: timestamps and confirmed values whenever you certify uploaded documents during the attestation flow.
• Payment metadata: the Stripe customer ID associated with your subscription and the subscription status. We do not see, store, or process payment card data — Stripe handles that directly.
• Operational logs: request paths, timestamps, and the IP address making the request, retained only for security and debugging.

3. What we do not collect

• Credit card numbers (handled by Stripe).
• GPS or vehicle location data.
• Telematics or ELD data.
• Driver biometric data.
• Third-party tracking cookies or behavioral analytics that share data with advertisers.

4. How we use what we collect

Account and payment data: to operate your subscription and to contact you about the Service. Carrier public data, driver data, and vehicle data: to run monitoring and fire deadline alerts. Attestation logs: to record that you (not we) confirmed the values our alerts fire against. Operational logs: to protect the Service from abuse and to debug failures.

We do not use any of this data to train AI models, and we do not share aggregated data with anyone outside the subprocessors listed below.

5. Subprocessors

The following vendors receive a portion of your data to operate the Service:

• Nhost — database, authentication, and file storage. Region: EU.
• Stripe — payment processing. Region: US / EU.
• Anthropic — document image extraction (Claude). Per Anthropic API terms, uploaded images are not retained to train models. Region: US.
• Vercel — hosting and edge delivery. Region: US / EU.

Material additions to this list will be announced by email to active subscribers before they go live.

6. Where your data lives

Primary storage is Nhost EU infrastructure with GDPR-standard defaults: encryption at rest, encryption in transit, and access controls scoped to your account. Public FMCSA data we fetch on your USDOT is the same data already in the public record at safer.fmcsa.dot.gov.

7. Retention and deletion

Active subscribers: data is retained for as long as your subscription is active. Cancelled accounts: a ninety (90) day grace window for reactivation, then full deletion. Attestation logs may be retained longer where required to defend against disputes; this period will not exceed seven (7) years.

You may request earlier deletion by emailing privacy@getmcactive.com. We will confirm and complete deletion within thirty (30) days.

8. Your rights

You have the right to access the data we hold on you, correct inaccuracies, request export in a portable format, and request deletion. Email privacy@getmcactive.com and we will respond within thirty (30) days. Users in the EU and UK have additional rights under GDPR and UK-GDPR — same email, same response time.

9. Cookies

We use a first-party session cookie for authenticated sessions (required for the dashboard to function) and remember your founding-rate timer locally in your browser. We do not use third-party tracking cookies, advertising cookies, or behavioral analytics.

10. Children

MC Active is a business-to-business service for motor carriers. We do not knowingly collect data from anyone under 18. If you believe a child has submitted data, email privacy@getmcactive.com and we will delete it.

11. International users

MC Active is operated from the United States with primary data storage in the EU. By using the Service, you consent to the transfer of your data to and processing in those jurisdictions. For EU and UK users, our standard contractual clauses with subprocessors and Nhost's EU-default storage form the legal basis for cross-border processing.

12. Changes to this Policy

Material changes will be announced by email to active subscribers at least fourteen (14) days before they take effect. The effective date at the top of this page always reflects the current version.

13. Contact

Questions about this Policy or your data? Email privacy@getmcactive.com or write to Anduin Enterprises LLC, [registered office address — to be completed before launch].