FleetSynq Privacy Policy

Provider: AquilaIQ LLC, operating FleetSynq (“AquilaIQ,” “FleetSynq,” “we,” “us,” or “our”)
Effective date: September 13, 2026
Privacy contact: privacy@aquilaiq.com

1. Scope and Roles

This Privacy Policy explains how AquilaIQ collects, uses, discloses, retains, and protects personal information through FleetSynq, its web application, backend API, driver portal and paperwork links, support channels, and related services (collectively, the “Service”).

For AquilaIQ’s own account administration, security, support, product operation, and business records, AquilaIQ generally acts as a controller or business. For company operational data processed on a customer’s instructions, the customer generally acts as controller or business and AquilaIQ acts as processor or service provider. The Customer Agreement and data processing addendum govern that processing. Customers are responsible for giving required notices to drivers, employees, brokers, carriers, and other people whose information they submit or connect.

2. Information We Collect

Depending on how you use FleetSynq, we may collect:

• Account and identity data: Supabase authentication identifiers, email address, name, profile, role, company assignment, driver link, sign-in and session events, and access status. Staff may authenticate through Google. Drivers may create an email/password account.
• Company and administrator data: company name, dispatcher, operations, after-hours, billing, and notification email addresses; company identifiers; role assignments; setup status; integration settings; and administrator actions.
• Driver and workforce data: driver name, email, phone number, driver identifier, carrier, company, truck and trailer details, activity, assigned loads, status updates, and paperwork submitted through the driver portal or capability links.
• Freight and business data: load numbers, shipment identifiers, brokers, broker MC numbers, carriers, routes, addresses, stops, appointment dates/times, rates, miles, commodities, weight, equipment, billing instructions, dispatcher notes, invoice and payment status, claims, layover and detention amounts, and related workflow metadata.
• Uploaded documents and files: Rate Confirmations, Broker Credit Checks, revised Rate Confirmations, POD/BOL documents, payment statements, images, PDFs, extracted text, document metadata, and generated PDFs. Files may be processed temporarily and synchronized to company-authorized Google Drive folders or Supabase storage according to the configured workflow.
• Email and Google Workspace data: Google OAuth profile email and authorized access tokens, Google Sheets rows and metadata, Drive folders/files and metadata, Gmail thread metadata and message content needed to search or send authorized dispatch, POD, claims, revised-RC, layover, detention, paperwork, or driver-status messages.
• AI processing data: document text, page images, prompts, extracted fields, confidence or warning metadata, model responses, and logs needed to run and troubleshoot Gemini extraction. FleetSynq’s current extraction prompts process trucking-document content and may contain personal or commercial information.
• Payment and financial operations data: amounts, payment status, Square or OTR statement content, invoice and remittance instructions, matched and unmatched payment rows, claims, and related documents. FleetSynq’s current reviewed code does not establish a card-payment processor or require raw card credentials.
• Technical and usage data: IP address, browser/device details, request timestamps, API and error logs, security events, rate-limit events, session information, and information stored in browser local/session storage for authentication, test/demo state, and setup progress. No separate advertising or analytics tool was identified in the reviewed current frontend code.

Please do not upload unnecessary sensitive personal information, payment-card numbers, bank credentials, passwords, or secrets into documents, notes, email, or prompts.

3. Sources of Information

We collect information from users and administrators; from Supabase authentication and database records; from Google OAuth, Sheets, Drive, and Gmail when a customer authorizes those integrations; from uploaded files and connected business systems; from driver sign-up and capability-link workflows; from support and communications; and automatically from browsers, devices, APIs, and server logs.

4. How We Use Information

We use information to:

• authenticate users and administer company, staff, and driver access;
• create companies, configure workspaces, and provision company-specific Google Sheets, Drive folders, and Gmail operations;
• ingest, parse, OCR, classify, and extract information from freight and payment documents;
• let authorized users review, correct, commit, search, filter, export, and reconcile load and financial records;
• assign drivers, expose only permitted loads and documents, accept POD/BOL uploads, create PDFs, and update workflow states;
• synchronize customer-authorized information with Google Sheets, Drive, and Gmail and send configured business communications;
• track payment, invoice, claim, layover, detention, revised-rate, and delivery-paperwork workflows;
• provide, maintain, secure, debug, rate-limit, restore, and improve the Service;
• detect fraud, abuse, unauthorized access, duplicate operations, malformed files, and security incidents;
• respond to requests, provide support, communicate service or legal notices, and manage the business relationship; and
• comply with law, enforce agreements, establish or defend claims, and protect customers, users, AquilaIQ, and the public.

We do not sell personal information for money.

5. Legal Bases

Where GDPR, UK GDPR, or similar law applies, AquilaIQ may rely on performance of a contract, steps requested before a contract, legitimate interests in operating and securing an enterprise service, consent where required, and compliance with legal obligations. When AquilaIQ acts as a processor, it processes Customer Data under the customer’s documented instructions and the customer determines the legal basis.

6. Google and Gemini Processing

When a customer connects Google Workspace, FleetSynq requests and uses scopes for Sheets, Drive, Gmail sending, Gmail read-only access, and the Google account email needed for onboarding. FleetSynq uses the customer’s authorized Google resources to create or update company-specific projections, organize files, search relevant threads, and send configured operational messages. Customers may revoke access through Google; doing so may disable related features.

FleetSynq sends eligible document text and, for supported Rate Confirmation extraction, page images to Google Gemini. Gemini returns candidate structured fields that users review before commit. The Service may log processing errors and warnings. Do not send unnecessary personal or sensitive data to Gemini through FleetSynq. Google’s terms and privacy practices also apply to Google’s independent processing.

7. How We Share Information

We may share or make information available to:

• The customer’s authorized users: administrators, dispatchers, back-office staff, drivers, and other users according to role, company, load, and document permissions.
• Supabase: authentication, profiles, company and operational records, uploads or metadata, audit events, leases, and database hosting.
• Google: OAuth authentication and authorized Google Workspace operations, including Sheets, Drive, Gmail, and Gemini processing.
• Infrastructure and service providers: hosting, storage, networking, monitoring, security, email, document-processing, and support providers used to operate FleetSynq. The approved provider and subprocessor list must be maintained with the applicable Customer Agreement or made available on request.
• Customer-directed third parties: brokers, carriers, payment or accounting contacts, and other recipients selected by an authorized customer user through a configured workflow. FleetSynq validates recipients and workflow context but the customer remains responsible for confirming recipients and content before sending.
• Professional advisers and authorities: lawyers, accountants, insurers, auditors, regulators, courts, law enforcement, or other parties when required or reasonably necessary for legal, safety, fraud-prevention, or rights-protection purposes.
• Corporate transaction parties: an affiliate, buyer, investor, successor, or adviser in connection with financing, reorganization, merger, acquisition, or sale of assets, subject to appropriate safeguards.

We do not rent or trade personal information. We do not disclose Customer Data to unrelated third parties for their own advertising.

8. Cookies, Storage, and Tracking

FleetSynq uses browser storage and similar mechanisms for authentication sessions, cross-tab auth state, setup progress, and necessary application behavior. The reviewed frontend uses local storage for Supabase authentication state in normal operation and session storage for setup and workflow state. The current reviewed code does not identify a separate advertising cookie, Google Analytics tag, or Clarity tag.

Browser controls can clear or block local/session storage, but doing so may sign you out or reset setup state. If analytics, advertising, or non-essential cookies are introduced, AquilaIQ must update this Policy and implement consent or opt-out controls where required by law.

9. International Transfers

AquilaIQ and its providers may process information in the United States and other countries. Where required, AquilaIQ uses recognized transfer safeguards, such as contractual clauses and supplementary measures appropriate to the transfer. Customer-specific residency and transfer commitments belong in the Customer Agreement or data processing addendum.

10. Retention and Deletion

We retain information only as long as reasonably necessary for service delivery, security, support, dispute resolution, and legal obligations. FleetSynq’s reviewed code does not establish one universal retention period for all tables, uploaded files, Google resources, emails, logs, or backups. Retention and deletion must therefore be confirmed in the Customer Agreement, data processing addendum, configuration, and documented operational schedule.

Subject to those terms and legal obligations, customers may request return or deletion of Customer Data. Terminating FleetSynq does not automatically delete copies in customer-controlled Google Sheets, Drive, Gmail, connected systems, exports, or backups. Supabase authentication records, audit records, invoices, security logs, and legal records may need to be retained for defined periods. Deletion from active systems may not immediately remove encrypted backups.

11. Security

FleetSynq’s current implementation includes Supabase JWT validation for protected routes, role and company checks, company-scoped operational queries, hashed and revocable driver capability tokens, per-company Google resource boundaries, Drive ancestry checks, file and input validation, rate limits, audit events, operation leases, security headers, and server-side handling of provider credentials. No method of transmission, storage, AI processing, or third-party service is completely secure, and controls may vary by deployment.

Customers must protect credentials and capability links, use least-privileged roles, maintain Google permissions, review outbound messages and attachments, and notify AquilaIQ of suspected compromise or unauthorized disclosure.

12. Privacy Rights

Depending on your location and AquilaIQ’s role, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or appeal of a denied request. You may also have the right to complain to a data-protection authority and opt out of certain targeted advertising, sale, sharing, or profiling. AquilaIQ does not sell personal information for money.

Send requests to privacy@aquilaiq.com. We may verify identity and authority, apply lawful exceptions, and direct requests about Customer Data to the customer that controls it. An authorized agent may submit a request where law permits. We will respond within the time required by applicable law.

13. Children’s Privacy

FleetSynq is designed for businesses, logistics professionals, and authorized adult users. It is not directed to children under 18, and we do not knowingly collect children’s personal information through consumer use. If you believe a child provided information to AquilaIQ, contact privacy@aquilaiq.com.

14. Third-Party Services and Links

FleetSynq may link to or interoperate with third-party services that AquilaIQ does not control. Their own terms and privacy policies apply to independent processing. Review Google, Supabase, Gemini, carrier, broker, payment, and other connected-provider notices before authorizing access or sending information.

15. Changes to This Policy

We may update this Policy as FleetSynq, its providers, or applicable law changes. We will post a revised version with a new effective date. If a change materially affects active customers or requires consent, we will provide additional notice or obtain consent as required.

16. Contact

Questions, requests, or complaints may be sent to:

AquilaIQ LLC — FleetSynq
Privacy: privacy@aquilaiq.com
Legal: legal@aquilaiq.com
Support: support@aquilaiq.com