Privacy Policy

Live chat

The chat window on our site is provided by Crisp. Crisp stores the messages you send, the email address you give it, and a browser identifier so the conversation continues when you come back. We use these only to answer you. Crisp is not used for analytics or advertising. You can also reach us at support@verifycarrier.com.

Claude connector and ChatGPT and Codex plugin

When you use the VerifyCarrier plugin in ChatGPT or Codex, the plugin receives only the carrier-search terms or USDOT numbers needed to perform the carrier research you request. VerifyCarrier returns a curated subset of carrier evidence needed for that request, including source availability. The plugin does not request passwords, API keys, payment-card data, Social Security numbers, or other authentication secrets.

We may measure aggregate plugin reliability and adoption using bounded operational events such as tool name, success or failure category, duration, plugin version, and aggregate result counts. We do not send your ChatGPT or Codex prompt text, carrier names, USDOT or MC numbers, returned carrier evidence, email address, saved notes, or authentication secrets to PostHog as plugin analytics properties.

A link from the plugin to VerifyCarrier may identify ChatGPT or Codex as the referring product so we can measure aggregate acquisition. Account creation, monitoring, billing, and other activity after you choose to visit VerifyCarrier is governed by the applicable sections of this policy. Operational API records are retained as described under Data Retention; optional analytics are controlled through the analytics preferences described below.

Claude connector. The same Carrier Research service is available in Claude as a connector. Carrier search works without signing in; we use your network address to apply a search rate limit and store it only as a keyed hash. Requests from Claude's hosted apps arrive from Anthropic's network, so the address we see is Anthropic's, not yours. Single-carrier snapshot and evidence lookups require you to sign in to your VerifyCarrier account on verifycarrier.com and approve read-only access. We then issue Claude a 15-minute access token and a refresh token. The token identifies only your VerifyCarrier account number, which the connector uses to count your weekly lookup allowance; it does not grant access to your watchlist, reviews, billing details or password, and the connector never receives your Claude conversation, prompts, files or memory.

For the Claude connector we store the connector's registration (its name and return address), and SHA-256 hashes of pending sign-in requests, authorization codes and refresh tokens, never the codes or tokens themselves, together with the account they belong to and when they were used or revoked. The connector stores a keyed hash of your account identifier, a keyed hash of the carrier you looked up and the dated public result it returned. These records are kept until you request account deletion, which removes them. You can end connector access by removing the connector in Claude, by resetting your VerifyCarrier password (access stops at the next token refresh, within 15 minutes) or by emailing support@verifycarrier.com. We send PostHog an action receipt when you approve or deny a connection and when tokens are issued, with your pseudonymous account identifier and a fixed client type only; never a token, carrier identifier, search term or email address.

Chrome extension

The VerifyCarrier Chrome extension sends the USDOT number, MC number or company name you enter, or text you explicitly select and choose to look up, to verifycarrier.com. Selected text is limited to 120 characters. The extension has no content scripts, does not read web pages automatically, does not collect browsing history, and does not retain lookup terms.

If you save a personal VerifyCarrier API key, it is stored in Chrome local extension storage on your device, not Chrome sync. It is sent to verifycarrier.com only as an authorization header for lookups you request, and is never added to website links. You can remove it in the extension or by uninstalling it.

The extension runs no advertising, analytics or session-replay code. Our API receives normal request information, including your IP address, which we use to enforce usage allowances as described under Data Retention. Links from the extension to our website carry fixed campaign tags identifying the extension, without any API key or personal identifier; once on the website, its analytics preferences apply. We do not sell extension data or use it for advertising or creditworthiness decisions.

Optional product analytics

With your permission, PostHog analytics runs in your browser to measure visits and successful lookup, signup, and monitoring actions. A pseudonymous account identifier connects these actions when you sign in. We do not send private review notes, decisions, carrier identifiers, email addresses, or form contents to PostHog. Session recording is disabled. With consent, we retain a normalized first-visit page, a broad source category (such as search or email), an allowlisted campaign name without recipient identifiers, and a pseudonymous browser identifier in browser storage and a first-party cookie for attribution over a 28-day window. Saved-action receipts let us check analytics delivery against operational records. Revoking consent clears this browser attribution. You can change your choice using Analytics preferences. We also measure aggregate adoption from the records needed to provide your service, as described in the next section.

Server-side measurement without consent

Browser analytics only counts visitors who allow it, so our server also keeps a basic count that does not depend on your analytics choice. We use it to know how many people reach the site and complete key actions, and to tell automated traffic from people. It sets no cookie and stores nothing in your browser. Our server sends this data to PostHog, which processes it for us.

Page loads: for each full page we serve (not API calls, files, or the signed-in dashboard), we send one event with the page path with carrier numbers and query strings removed, the referring website's domain, an email campaign code only if it is one of our own allowlisted campaigns, and yes/no flags about which standard browser headers the request carried. The event is keyed to a pseudonymous ID made by hashing your IP address and browser user agent with the current UTC date, plus a second hash made with the current week. The daily ID changes every UTC day and the weekly ID changes every Monday at 00:00 UTC, so visits can be linked within a single week but not across weeks. Your IP address and user agent are used only to compute these hashes and are not sent to PostHog. PostHog does not create a person profile for these events.

Carrier profile views: when you open a carrier profile page, we record the USDOT number with the same daily pseudonymous ID in our operational carrier lookup log, kept as described under Data Retention.

Action receipts: when an action completes on our server, such as signing up, signing in, a carrier lookup, starting checkout, a subscription change, a watchlist change, a saved review, a carrier claim, or a certificate of insurance upload, we send PostHog an event naming the action, a random receipt ID, and a small fixed set of details such as sign-up method, trial length, or an allowlisted campaign code. If you are signed in, the event uses your pseudonymous account identifier and PostHog keeps a profile for that identifier; otherwise it uses the daily ID above or the receipt ID. These events never include your email address, name, notes, or form contents. Your first-visit page and traffic source are included only if you allowed analytics.

API and agent requests: for calls to our carrier API from outside our own pages, requests for machine-readable discovery files such as /llms.txt, and requests carrying a payment header, we send one event with the kind of path, the response status, whether the call was authenticated and, for API keys, the key's internal row number (never the key itself). Your user agent is reduced on our server to a fixed category, such as browser, script, AI assistant or AI crawler, and a fixed client label; the user agent itself is not sent. The event uses the daily ID above, or your pseudonymous account identifier if you called with an API key, and PostHog does not create a person profile for it.

Email delivery and alert links

Postmark processes application email and reports acceptance, delivery, bounces and complaints. Carrier-alert links use click tracking so we can diagnose whether alerts lead back to the dashboard. Our callback records retain a normalized destination and campaign, without carrier numbers or URL tokens. Automated scanners can generate clicks; clicks do not establish that you reviewed a carrier. We do not enable open pixels on application emails or wrap password-reset, verification or carrier-claim links. Manage carrier-alert preferences in Settings.

1. Information We Collect

When you use our DOT lookup tool, we collect:

• Email address
• Mobile phone number
• Company name (optional)
• DOT numbers you search
• IP address and browser information

2. How We Use Your Information

We use your information to:

• Send you carrier safety reports via email
• Send the text alerts you request about changes to carriers you watch
• Improve our service and user experience
• Communicate product updates and features

3. SMS and Email Communications

Text messages. We text a phone number only after it texts us. A lookup gets one reply. Replying WATCH is your consent to recurring alerts about the carrier you chose and a weekly check-in; we send no marketing or promotional texts. Message frequency varies and message and data rates may apply. Reply STOP to any text to stop all texts, or HELP for help. Full program terms: text alerts terms.

We use your phone number only to answer your texts and send the alerts you asked for. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. Phone numbers are never shown publicly, never shared with carriers and never sold. Our SMS provider processes messages only to deliver them.

Email. By providing your email, you may receive:

• Carrier safety reports and alerts
• Product updates and feature announcements
• Promotional offers (you can opt out anytime)

Opt-Out: Click unsubscribe in any email.

4. WhatsApp Communications

4.1 What We Collect

If you opt-in to receive WhatsApp notifications, we collect and process:

• WhatsApp phone number
• Message delivery status and read receipts
• Conversation metadata (timestamps, message IDs)
• User preferences (notification settings, quiet hours, timezone)
• Messages you send us through WhatsApp

4.2 How We Use WhatsApp Data

We use your WhatsApp information to:

• Send carrier status change alerts (authority status changes, insurance expired, safety rating changes)
• Send proactive risk notifications
• Respond to your inquiries and support requests
• Deliver service updates and important announcements
• Respect your quiet hours and notification preferences

4.3 WhatsApp Opt-In and Consent

WhatsApp notifications are 100% opt-in. You must explicitly check the WhatsApp opt-in box when submitting a carrier lookup request. By opting in, you consent to:

• Receive messages from VerifyCarrier via WhatsApp
• Allow Meta (WhatsApp's parent company) to process your messages as per their privacy policy
• Storage of your WhatsApp conversation history for service delivery and support

4.4 WhatsApp Opt-Out

You can opt-out of WhatsApp notifications at any time by:

• Replying "STOP" or "UNSUBSCRIBE" to any WhatsApp message
• Contacting us at hello@verifycarrier.com
• Requesting account deletion (see Data Deletion section below)

Opting out will stop all WhatsApp notifications immediately. Your conversation history will be retained for 90 days for legal compliance, then permanently deleted.

4.5 Meta/WhatsApp Privacy

WhatsApp messages are sent through Meta's WhatsApp Business Platform. Meta processes your messages according to their privacy policy. Meta may collect:

• Phone number and profile information
• Message metadata (delivery status, timestamps)
• Device and connection information

WhatsApp messages are end-to-end encrypted between you and VerifyCarrier. Meta cannot read message contents, but they process metadata for service delivery.

For more information, see Meta's privacy policy at: https://www.whatsapp.com/legal/privacy-policy

5. Data Sharing

We do NOT sell your personal information. We may share data with:

• Service providers: Email delivery (Postmark), SMS services, WhatsApp (Meta), database hosting
• Meta/WhatsApp: Phone numbers and message metadata for WhatsApp message delivery
• Legal requirements: When required by law, court order, or government request
• Business transfers: In connection with a merger, acquisition, or sale of assets

All third-party service providers are contractually required to maintain the confidentiality and security of your personal information.

6. Data Retention

We retain your personal information for different periods depending on the type of data:

• Account data: While your account is active, plus 90 days after deletion request
• WhatsApp conversations: 2 years for service delivery, or 90 days after opt-out
• Email/SMS history: 2 years for legal compliance
• Recent carriers in your dashboard: Up to 50 carriers viewed while signed in, shown for 90 days. You can clear this account history from your dashboard; clearing it does not remove watchlists, saved reviews, or operational logs. Old history is pruned when you next save a carrier. No anonymous browsing history is attached to your account.
  Operational carrier lookup logs: 1 year for service improvement
• Payment records: 7 years for tax and accounting purposes

After retention periods expire, we permanently delete or anonymize your data.

7. Data Security

We use industry-standard security measures to protect your data, including:

• TLS/SSL encryption for data in transit
• Encryption at rest for sensitive data
• Secure cloud infrastructure (Vercel, DigitalOcean)
• Access controls and authentication
• Regular security audits and monitoring

While we implement strong security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

8. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Correction: Update incorrect or incomplete information
• Deletion: Request deletion of your account and data (see Data Deletion)
• Portability: Receive your data in a machine-readable format
• Opt-out: Unsubscribe from marketing communications
• Object: Object to processing of your data for certain purposes

To exercise any of these rights, contact us at privacy@verifycarrier.com

9. Children's Privacy

VerifyCarrier is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards are in place for international data transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• For WhatsApp users: Sending a WhatsApp notification

Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

12. Contact Us

Questions about this privacy policy? Contact us: