PRIVACY BY DESIGN
Privacy Policy
Effective September 7, 2026
Bobhaul is designed to create value from better logistics decisions, not from selling a person's identity, individual location or vulnerability. This policy describes how we handle information across the Bobhaul website and the Bobhaul mobile applications.
1. Scope
This Privacy Policy explains how Bobhaul, LLC (“Bobhaul,” “we,” “us,” or “our”) handles personal information when drivers, facilities, carriers, dispatchers, logistics providers and other authorized users access our websites, mobile applications, products and services (collectively, the “Services”).
It covers the Bobhaul Driver App for iOS (com.bobhaul.driver) and Android (com.bobhaul.mobile). Where a practice applies only to that app, we say so.
A word about who sees a driver's work. A driver normally receives access to the Driver App because a motor carrier, either the driver's employer or the company the driver contracts with, uses Bobhaul to run its loads. Loads assigned, appointments attended, arrivals and departures at facilities, documents captured and messages sent through the app are visible to that carrier's dispatchers and administrators, and the carrier decides what to do with that information under its own policies, which we do not control. A facility on a load sees what it needs to receive the driver: name, load, appointment, arrival status and the messages in that facility's thread. It does not see the driver's profile, other loads, or work for other carriers. Visibility follows participation in a load.
2. Information we may collect
- Account and profile information: name, email, telephone number, role, company, driver or vehicle identifiers, professional credentials and preferences. In the Driver App this includes the commercial driver's license (CDL) number, the truck and trailer assigned, a profile photograph and the preferred language (English or Spanish).
- Sign-in identifiers: the account identifier, name and email address issued by the sign-in method chosen: Apple, Google, Facebook or a Bobhaul email account. We never receive or store a password.
- Operational information: appointment, shipment, facility, gate, yard, dock, queue, arrival, departure, dwell and exception data.
- Location information: precise device location while the app is open, when you grant permission and when needed for features such as arrival detection, navigation context, check-in and check-out, and the nearby-drivers feature. The app does not request background location. See section 4.
- Documents and communications: bills of lading, purchase orders, delivery records, proof of delivery, seal and damage photographs, signatures, messages and support requests that users choose or are authorized to provide. Shipment documents often show information about other people and businesses, including names, addresses and telephone numbers of shippers, consignees, carriers and facility staff. We read that text to process the shipment (see section 7) and use it for nothing else.
- Device and usage information: device type and operating system version, application version, language and region settings, push notification token, a device identifier we generate for notifications (on iOS it is stored in the Keychain and survives reinstalling the app), IP address, server-side logs and interactions with the Services.
Permissions the Driver App requests. The app asks only for what a feature needs, at the moment it needs it, and each can be refused or withdrawn in device settings.
| Permission | Used for |
|---|---|
| Location, while using the app | Showing position on the map, nearby fuel, food and amenities, personalizing the home feed, confirming presence at a facility on check-in, and the nearby-drivers feature. Nothing is collected while the app is closed or in the background |
| Camera | Photographing bills of lading, proof of delivery, seals, damage and signatures |
| Photo library | Uploading those same documents from images already on the device. The app does not scan the photo library; it receives only the images selected |
| Notifications | Load assignments, appointment changes, messages and reminders |
What the Driver App does not collect. It never requests access to contacts, calendar or microphone. It does not read Apple Health, Health Connect, Google Fit or any wearable, and collects no biometric data. Wellness reminders in the app are timers and prompts we generate. It does not request background (“Always”) location. It collects no advertising identifier and contains no advertising software and no third-party analytics or attribution SDK. The app itself does not currently send crash reports or usage analytics to us or to anyone else. The server-side logs described above are records our own systems keep, for the periods in section 8. It does not process payment card details.
3. How we use information
We use information to provide and secure the Services; coordinate arrivals, queues, docks and documents; communicate with authorized participants; provide the Services in English and Spanish; read uploaded shipment documents with automated tools; answer questions through the in-app assistant where that feature is available; personalize relevant instructions; verify operational events; troubleshoot and support users; improve reliability and usability; develop privacy-protective analytics; comply with law; and prevent fraud, abuse or security incidents.
We do not use information for advertising, and we do not use it to score anyone for credit, insurance or employment.
4. Location choices
Location features require device permission. Users can change location permissions in device settings, although some arrival and check-in features may then be unavailable. Bobhaul does not intend to continuously disclose a driver's individual location to unrelated third parties or use it for unrelated advertising.
Concretely, and so that the commitment above is capable of being checked:
- Location is collected in connection with a trip. Outside an active, assigned load, we do not build a continuous record of where a driver is.
- What we retain are discrete events: arrived, departed and dwell, not a permanent breadcrumb trail of movement.
- Location is not used to observe anyone outside their work, on days off, or between loads, and is not used to infer anything about health, religion, union activity or personal life.
- We do not sell location information, and do not share it with data brokers, advertisers or location-data marketplaces.
- Nearby drivers. While the app is open, the nearby-drivers feature shows your current position to other drivers who are using it, and theirs to you. Turning off location permission turns this off.
- Location events reach the carrier whose load it is, and the facility at the current stop. Maps, routing and place lookups send the device's coordinates to Google Maps Platform and to Azure Maps (see section 6). Beyond that, location reaches only the service providers named in section 6 that host our systems.
Precise location is “sensitive personal information” under California law. We use it only for the purposes above, which the law permits without a separate opt-out.
To withdraw the permission: on iOS, Settings → Privacy & Security → Location Services → Bobhaul; on Android, Settings → Apps → Bobhaul → Permissions → Location. Mapping, nearby-amenity and nearby-driver features then stop working and check-in becomes manual; the rest of the app continues to work.
5. Notifications, messages and text messages
- Push notifications. With permission, we send notifications about load assignments, appointment changes, messages and reminders, delivered through Apple Push Notification service and Firebase Cloud Messaging. They can be turned off in device settings or in the app's notification settings.
- In-app messages. Messages exchanged with dispatch, facilities and other drivers are stored on our systems and are visible to the people they are addressed to. Blocking a user stops their messages from reaching you; the person is not notified. When you report a message, we keep a copy of it and any attachment for moderation even if the sender later deletes it.
- Text messages. The Driver App does not currently send text messages. If we introduce them, we will send them only to a number whose owner has agreed to receive them (see section 3 of the Terms of Use), through our messaging provider. Message and data rates may apply. Replying STOP to any message ends them; replying HELP returns our contact information. We keep a record of each STOP request so that the number is not texted again; that record is kept for at least five years and survives the deletion of an account. Mobile numbers and text-message consent are never shared with third parties for their marketing.
- Email. Sign-in and account emails are sent by our identity provider, Microsoft Entra, on our behalf. We do not send marketing email through the Driver App.
6. How information may be shared
We may share information with participants in an authorized logistics interaction when needed to complete that interaction; with service providers acting under contract on our behalf; at a user's direction or with consent; in connection with a corporate transaction subject to appropriate safeguards; or when reasonably necessary to comply with law, protect rights and safety, or secure the Services.
In the Driver App, the participants are the carrier whose load it is and the facility at each stop, as described in section 1. Where a load involves a broker, shipper or other customer, delivery documents for that freight are shared with them as parties to that shipment.
The service providers that process information on our behalf, or receive it to perform their own service, include:
| Provider | What reaches them |
|---|---|
| Microsoft: Azure (Container Apps hosting, PostgreSQL database, Blob Storage, Service Bus, SignalR real-time messaging, Notification Hubs, Azure Maps, Azure AI Document Intelligence, Application Insights), Entra External ID | Everything we store, as our hosting provider; identity and sign-in; push delivery; coordinates for routing; document images for text recognition; server logs |
| Anthropic: Claude API | Only once the AI features in section 7 are switched on: text extracted from shipment documents, for field extraction; the questions you ask the in-app assistant, with the conversation and the load, facility or account details needed to answer |
| Google: Firebase Cloud Messaging, Google Maps Platform (Maps SDK, Static Maps, Places) | Push tokens; map images, place lookups and nearby-food searches, which send the device's coordinates to Google |
| Apple: Sign in with Apple, Apple Push Notification service | Sign-in tokens, push tokens |
| Meta: Facebook Login | Only where a user chooses to sign in with Facebook |
| Expo | Application build and update delivery |
| Vercel | Hosting for bobhaul.com; the website server logs described in section 15 |
| Engineering and support contractors | Access to production data only where needed to operate, support and secure the Services, under confidentiality obligations and the access controls in section 9 |
Apple, Google and Meta act as independent controllers for the sign-in information they receive when you choose those sign-in methods, and Google for the coordinates sent to Google Maps Platform; their own privacy notices apply. Microsoft and Anthropic process information on our behalf under our agreements with them.
We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws, and we have not done so in the preceding twelve months. This includes the personal information of anyone we know to be under sixteen.
7. Artificial intelligence in the Services
Bobhaul is introducing artificial intelligence in two places. Until these features are switched on, the only automated processing of your content is text recognition on uploaded documents by Azure AI Document Intelligence (Microsoft).
- Reading documents. When a bill of lading or similar document is uploaded, Azure AI Document Intelligence extracts the text and, once the feature is enabled, Anthropic's Claude models turn that text into structured fields such as document number, consignee, pickup identifier, weight and pallet count. Low-confidence results are flagged for a person to check. The text sent to Anthropic can include the information about other people and businesses described in section 2.
- In-app assistant. Once available, the assistant answers drivers' questions. What you type, the conversation so far and the load, facility or account details needed to answer are sent to Anthropic's API to generate the reply.
- Under Anthropic's commercial terms, content sent to its API is not used to train Anthropic's models and is deleted from Anthropic's systems within 30 days unless it must be kept to enforce Anthropic's usage policies or by law; Microsoft does not use Document Intelligence inputs to train its models. Bobhaul does not use message content, documents or other user content to train artificial-intelligence models, and trains no models of its own.
- Outputs are suggestions. No decision that produces a legal or similarly significant effect on a person is made solely by an automated system. Load assignment, discipline, pay and employment decisions are made by carriers, by people.
8. Data minimization, aggregation and retention
We seek to collect only information reasonably needed for defined operational purposes. Where feasible, analytics and benchmarks are aggregated, de-identified or placed into sufficiently large cohorts. We retain personal information only as long as reasonably needed for the purposes described here, contractual requirements, dispute resolution, security and legal obligations, then delete or de-identify it under our retention practices.
The periods we work to:
| Information | Retention |
|---|---|
| Account and profile | While the account is active, then de-identified as described in section 11 |
| Contact details: telephone and email | With the account. STOP records are kept for at least five years after the request, so the number is not texted again |
| Trip and location events | Raw events for 24 months; after that, aggregated statistics that do not identify anyone |
| Trip documents: bills of lading, proof of delivery, signatures and seal photographs | Up to 7 years, matching the record-keeping periods that apply to our carrier customers and to tax and shipping records |
| Messages | 24 months after the last message in a thread; messages that form part of a shipment's record are kept with that record |
| Technical, audit and access logs | 12 months |
| Backup copies | Up to 7 years for annual copies; a deletion request is applied to backups as they cycle |
Where law requires us to keep something longer for tax, safety, transportation or litigation-hold obligations, we keep it for that period and only for that purpose.
9. Security
We use administrative, technical and organizational safeguards intended to protect information. In practice that means encryption in transit and at rest; sign-in tokens held in the iOS Keychain and the Android Keystore rather than ordinary application storage; documents and photographs served through signed links that expire within an hour (chat attachments, within 24 hours) rather than public addresses; server-side credentials and keys held in a managed secret store; role-based access to production data; and separate development and production environments. Passwords are handled by the identity provider and are never visible to us. Other app data, including your profile, messages and settings, is kept in the app's normal storage on your device and, on iOS, is included in your device backups.
No system is completely secure, and users should protect their credentials and promptly report suspected unauthorized access. Where a breach affects personal information, we will notify affected people and the authorities as law requires.
10. Your choices and requests
Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection or withdrawal of consent; to know what we have collected, where it came from and who received it; to limit the use of sensitive personal information; and to opt out of sale or of sharing for targeted advertising. We do neither, so there is nothing to opt out of. You may not be discriminated or retaliated against for exercising these rights.
These rights come from California's CCPA and CPRA and from comparable laws in Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island and other states as they take effect. Which of them applies to you depends on your state and on whether a particular law applies to Bobhaul; several of these laws do not cover information about people acting in a work or business capacity. We honor the requests described here from any user of the Services, whether or not a particular law requires it.
How to make a request. Email privacy@bobhaul.com with “Privacy request” in the subject line. We may verify identity and authority before fulfilling a request, usually by asking you to confirm from the email address on the account. An authorized agent may act for you with written proof.
Timing. We respond within 45 days, and may extend by a further 45 days where law allows, with notice to you.
Appeals. If we decline a request, you may appeal by replying to our decision or writing to privacy@bobhaul.com with “Appeal” in the subject line. We will respond within 45 days, or sooner where the law of your state requires. If we deny the appeal, you may complain to your state attorney general.
Where a request belongs elsewhere. Where a carrier or facility is the party that decides how information about a person's work is used, a request about that information may need to go to them. Tell us and we will point you to the right place.
11. Deleting your account
In the Driver App: Profile → Driver account → Delete account. The app will not delete the account while you have an active load or a vehicle assigned to you: complete or cancel the load, or ask your dispatcher to unassign the vehicle, then try again.
On the web: bobhaul.com/support. Email privacy@bobhaul.com from the address on your account with the subject “Account deletion request”. This works even after the app has been uninstalled. We confirm receipt within two business days and complete the deletion within 30 days.
What happens. Sign-in is disabled immediately. A background process then de-identifies the account, and the sign-in identity is deleted from our identity provider, which keeps it recoverable for 30 days before removing it permanently; the whole process completes within 30 days. We de-identify rather than shred. We erase the information that identifies a person, including name, email, telephone number, CDL number, photograph and the link to the sign-in identity, and retain the operational record that the business record of a completed shipment requires: the trips, visits and aggregate statistics, without the fields that identify the driver. Signed trip documents are kept as described below and may still show the driver's name or signature; they are held under the same access controls as any other business record and are not used to rebuild a profile.
What is kept, and why. Signed trip documents, including bills of lading, proof of delivery, seal photographs and signatures, are legal and financial records of a completed shipment, and they also protect the driver in a dispute. Records of STOP requests for a telephone number are kept so that the number is never texted again. Records under a legal hold or a tax, audit or safety obligation are kept for the period law requires. Backup copies are removed as backups cycle through their retention window.
A carrier's own copy. Deleting a Bobhaul account does not delete records a carrier holds in its own systems. Those requests go to the carrier.
12. Children
The Services are intended for business and professional use and are not directed to children under 18. We do not knowingly collect personal information from children. If we learn that we have, we delete it. Write to privacy@bobhaul.com if you believe a minor holds an account.
13. Where we operate
Bobhaul, LLC is a Texas limited liability company. The Services are currently offered in the United States and are not directed to individuals in the European Economic Area or the United Kingdom. Information is stored in Microsoft Azure data centers in the United States (Central US) and may be accessed or processed in other countries where Bobhaul or its providers operate, subject to appropriate protections and applicable law. This policy will be updated before the Services are offered in a new region.
14. Changes and language
We may update this policy as the Services evolve. We will post the updated policy with a new effective date and provide additional notice when required, including in the Driver App where the change is material.
This policy is written in English. Translations are provided for convenience; if they differ, the English version governs.
15. Website, cookies and Do Not Track
Our website, bobhaul.com, is an informational site. It does not use advertising or analytics cookies, and it does not set cookies to track you across other sites. Our hosting provider, Vercel, records standard server logs on our behalf to deliver and protect the site. These logs include the IP address, browser type, pages requested and the time of the request. Vercel keeps them as described in section 8. The legal pages on the site load the Geist typeface from Google Fonts. When one of those pages opens, your browser requests the font files from Google, and that request carries your IP address; Google handles it under its own privacy policy. Because we do not track visitors across third-party sites or services, we do not respond differently to “Do Not Track” or Global Privacy Control browser signals; there is no tracking to turn off. If we add analytics or other cookies to the website, we will update this policy first.
16. Contact
Bobhaul, LLC
1102 Santo Tomas St.
Laredo, Texas 78045
United States
Telephone: (956) 625-2200
Email: privacy@bobhaul.com
Account deletion: bobhaul.com/support (or email privacy@bobhaul.com with the subject “Account deletion request”)
Reporting a message or a user: abuse@bobhaul.com