Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between HaulProof AI, Inc. ("HaulProof") and the customer ("Customer") for use of the Service, and applies where HaulProof processes personal data on Customer's behalf. A signed copy is available on request.

1. Roles

For personal data processed through the Service, the Customer is the controller and HaulProof is the processor. Each party will comply with applicable data protection laws.

2. Scope and purpose of processing

• Subject matter: provision of the carrier-vetting Service.
• Duration: for the term of the agreement, plus retention periods required for audit records or by law.
• Nature and purpose: hosting, vetting, monitoring, generating audit records, and support.
• Types of data: account contact details and usage data. The Service primarily processes business data about motor carriers, not large volumes of consumer personal data.
• Data subjects: Customer's authorized users.

3. Processor obligations

HaulProof will: (a) process personal data only on the Customer's documented instructions, including as set out in the agreement; (b) ensure persons authorized to process data are bound by confidentiality; (c) implement appropriate technical and organizational security measures (see our Security page); (d) assist the Customer, where reasonable, in responding to data subject requests; and (e) make available information needed to demonstrate compliance.

4. Subprocessors

The Customer authorizes HaulProof to engage subprocessors to provide the Service, including cloud hosting, our AI provider (Anthropic), our payment processor, and carrier-data providers (such as FMCSA data services). HaulProof imposes data-protection obligations on subprocessors and will give notice of material changes so the Customer may object.

5. Security and breach notification

HaulProof maintains the security measures described on our Security page and will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data, with the information reasonably available.

6. International transfers

Where data is transferred across borders, the parties will rely on a lawful transfer mechanism as required by applicable law.

7. Return and deletion

On termination, HaulProof will, at the Customer's choice, delete or return Customer personal data, except where retention is required by law or for the defensible audit records the Service is designed to maintain.

8. Audits

HaulProof will, on reasonable request and subject to confidentiality, provide information to demonstrate compliance with this DPA.

9. Contact

To request a signed DPA or ask questions, email hello@haulproof.ai.