Privacy Policy

This Privacy Policy describes how SECRUL ("Secrul," "we," "us") collects and processes personal information when you visit secrul.com, join our waitlist, or use the Secrul platform, mobile applications, and related services (together, the "Secrul Services"). Secrul is a business-to-business service for the freight industry; we primarily handle business contact and operating information for personnel of shippers, freight brokers, and motor carriers.

If you are a driver performing shipments in connection with the Secrul Services, the Secrul Driver Privacy Notice (secrul.com/legal/driver-privacy) is part of this Privacy Policy and describes the information we collect about you in that role, including precise location during active shipments, photographs and photo ID, and facial verification (biometric) data.

What information does Secrul collect?

Information you give us

• Waitlist and early-access forms: your role (shipper or carrier), name or company name, email address, phone number (optional), MC number, USDOT number, fleet size, trailer type, shipping volume, and a referral code if someone invited you.
• Account and profile information when the platform is available, and load, shipment, and pricing data you post, bid on, or manage.
• Documents you upload (for example, insurance certificates or shipment documents) and anything you send us by email or through the Secrul Services.

Information collected automatically

• Marketing attribution: campaign parameters (UTM tags), the referring site, and the landing page of your visit, stored in your browser's local storage and submitted with the waitlist form, along with an analytics client identifier.
• Usage analytics: pages viewed, approximate location (country/region level), and browser and device type — via our web-analytics tools (cookie-setting analytics runs on the production site only, and part of our analytics is cookie-free and aggregated). See our Cookie Policy.
• Security signals: when you submit the waitlist form, we compute a salted, one-way hash of your IP address to rate-limit abuse. We do not store your raw IP address in our database, and the hash cannot practically be reversed.
• Mobile app data: if you use our mobile applications, we collect app interactions, device type and operating-system version, crash and diagnostic logs, and push-notification tokens, associated with your account. Data collected from drivers is described in the Secrul Driver Privacy Notice.

Information from public sources

• FMCSA records: to verify carriers we may check the MC/USDOT numbers you provide against public FMCSA registration and safety data.

Payments

When paid plans launch, billing will be handled by a third-party payment processor. Our payment processor will collect your card details directly; we will receive only limited billing information — such as card brand, last four digits, billing address, and payment outcome — which we use for billing, receipts, and fraud prevention. We will not store full card numbers on our systems.

For what purposes does Secrul use my information?

• to operate the waitlist and invite users to the platform;
• to verify the identity and operating authority of shippers, brokers, and carriers;
• to provide, maintain, secure, and improve the Secrul Services, and to understand which marketing channels bring us users;
• to send service communications about your waitlist status or account, and product updates (you can opt out of non-essential email at any time);
• to prevent spam, fraud, theft, and abuse;
• to comply with legal obligations and to protect Secrul, our users, and others.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Does Secrul share my information?

We share personal information only as described below:

• Service providers that process it on our behalf under contract — in the following categories, now or as the corresponding features launch:

• Transaction counterparties: when you book, verify, or track a shipment through the Secrul Services, the other parties to that shipment see the business information reasonably needed for the transaction (for example, company identity, verification status, and shipment progress).
• Legal compliance and protection: we may disclose information when we believe it is appropriate to comply with the law, enforce our agreements, or protect the rights, property, or safety of Secrul, our users, or others.
• Business transfers: if Secrul is involved in a merger, acquisition, or sale of assets, relevant business data may be among the transferred assets, but it remains subject to the promises made in the pre-existing privacy notice.
• At your direction or with your consent.

We will update this section before we begin sharing personal information with any new category of providers. We require every third party that receives personal information from us — including the providers above and any SDKs in our applications — to protect it to at least the standard described in this Privacy Policy and in the Secrul Driver Privacy Notice, and we contractually prohibit them from using it for their own purposes, including advertising or model training.

Cookies and tracking

We use a small set of first-party analytics cookies and local-storage keys, and no advertising trackers. Details, lifetimes, and opt-out options are described in our Cookie Policy.

Do Not Track and opt-out preference signals: some browsers send "Do Not Track" (DNT) or Global Privacy Control (GPC) signals. We do not sell or share personal information and use no cross-site advertising trackers, so there is no sale or sharing for these signals to opt out of, and the Secrul Services do not change behavior in response to DNT or GPC signals. We do not permit third parties to collect personal information about your online activities over time and across different websites through the Secrul Services; our analytics providers process usage data only on our behalf.

How secure is my information?

Data is encrypted in transit (TLS) and at rest. Access to production data is restricted; our waitlist database accepts writes only from our server, with row-level security enabled; and IP addresses are stored only as salted one-way hashes. No system is perfectly secure — if a breach affects your data, we will notify you as required by applicable law.

International transfers

Secrul is a U.S. company and stores data in the United States. If you use the Secrul Services from outside the U.S., your information will be transferred to and processed in the U.S. Where the GDPR applies, we rely on appropriate safeguards such as Standard Contractual Clauses with our service providers.

How long does Secrul keep my information?

• Waitlist data: until the platform launches and you either create an account or ask us to remove you; waitlist records that remain inactive for 24 months after launch are deleted.
• Account and shipment data: for as long as your account is active and as needed for disputes, claims, tax, and accounting purposes.
• Analytics: our analytics tools retain user-level data for up to 14 months; part of our analytics exists only in aggregated form.
• Communications: up to 24 months after our last exchange, unless a dispute requires longer.

What rights and choices do I have?

You may request access to, correction of, a copy of, or deletion of your personal information, and you may opt out of marketing email, by writing to hello@secrul.com. We may ask you to verify your identity, we respond within 30 days, and we do not discriminate against you for exercising your rights. If you have a Secrul account, you can also delete your account and associated personal data directly in the Secrul app (Settings > Account > Delete Account).

Additional State-Specific Privacy Disclosures (California)

We provide these disclosures to California residents in the format of the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), and they serve as our notice at collection. Secrul does not currently meet the CCPA's thresholds for a covered "business"; we honor the rights below voluntarily for all California residents, and these disclosures will operate as our CCPA disclosures if and when the CCPA applies to us.

• Categories collected: identifiers (name, email, phone); commercial and professional information (company, operating authority such as MC/USDOT numbers, fleet and shipping details); internet or other electronic network activity (usage and attribution data described above); approximate geolocation (from analytics); and payment and billing information (card brand, last four digits, billing address, transaction history) when you purchase a paid plan. Precise geolocation, biometric, and visual information are collected only from drivers as described in the Secrul Driver Privacy Notice.
• Categories disclosed for a business purpose: the categories above, to the service providers listed in this policy.
• No sale or sharing: Secrul has not sold or shared personal information, as those terms are defined in the CCPA, in the preceding 12 months, and we do not sell or share personal information.
• Sensitive personal information: we do not use or disclose sensitive personal information for purposes other than those expressly permitted by the CCPA.
• Your rights: to know, access, correct, delete, and obtain a portable copy of your personal information, and to appeal a denial. Exercise them (directly or through an authorized agent) via hello@secrul.com. We will not discriminate against you for exercising your rights.
• Retention: as described in "How long does Secrul keep my information?" above.

Visitors from the EEA and UK

Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract or steps at your request before entering one (waitlist, early access); our legitimate interests in operating, securing, and marketing a B2B service; your consent where required; and compliance with legal obligations. You also have rights to restrict or object to processing and to data portability, and you may lodge a complaint with your local supervisory authority.

Children

The Secrul Services are for businesses and are not directed to anyone under 18. We do not knowingly collect information from children.

Contact, notices, and revisions

If you have any questions or concerns about privacy at Secrul, contact us at hello@secrul.com and we will try to resolve the issue for you. Our business changes constantly, and this Policy will change also; the "Last Updated" date above always reflects the current version. If we make material changes — for example, at platform launch — we will notify waitlist members and account holders by email at least 14 days before they take effect. We will not materially change our practices to make them less protective of personal information collected in the past without your consent.

SECRUL · 3685 Elkhorn Blvd #1421, North Highlands, CA 95660