Data Deletion Policy

1. Your Right to Deletion

You have the right to request deletion of all personal data associated with your OverTheRoad.ai account at any time. This right is provided regardless of your location, and we honor deletion requests in compliance with the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), General Data Protection Regulation (GDPR), and other applicable data privacy laws.

2. How to Request Deletion

You may request data deletion through any of the following methods:

• In-app: Log in to your account, navigate to Settings, and click "Request Account Deletion." This initiates an immediate, verified deletion request.
• Email: Send an email to privacy@overtheroad.ai with the subject line "Delete My Account." Include the email address associated with your account so we can verify your identity.

3. What We Delete

Upon processing your deletion request, we will permanently remove all of the following from our systems:

• Your account profile (name, email, phone, business information)
• All loads, invoices, and financial records
• All expense and fuel transaction data
• All uploaded documents (BOLs, rate confirmations, receipts, etc.)
• All compliance records and alerts
• All IFTA reports and state mileage data
• All AI chat history (ChatMessage records)
• All Co-Driver action audit logs (CoDriverAction records)
• The Co-Driver AI actions opt-in preference and timestamp
• All notification history
• All bank transaction data synced via Plaid
• Your Plaid access token and connection details
• All Motive and QuickBooks connection data and access tokens
• All vehicle and driver records
• Your Clerk authentication account

4. Third-Party Data

When we process your deletion request, we will also:

• Revoke your Plaid access token, which disconnects our access to your bank data. Plaid may retain data independently under their own privacy policy. To request deletion from Plaid directly, visit Plaid's data deletion portal.
• Revoke Motive and QuickBooks access tokens, ending data sync with those services.
• Stripe may retain payment transaction records independently as required by financial regulations and their merchant agreement. You may contact Stripe directly regarding their data retention.

5. Processing Timeline

• In-app requests are queued immediately upon confirmation. Your account will be deactivated within 24 hours and data permanently deleted within 30 days.
• Email requests require identity verification (matching the email on file). Once verified, processing follows the same timeline.
• During the 30-day processing period, you may contact us to cancel the deletion request if you change your mind.

6. Data We May Retain

After deletion, we may retain the following limited information as required by law:

• Stripe payment records (required for tax reporting and financial compliance) — retained by Stripe, not by us.
• Anonymized, aggregated statistics that cannot identify you (e.g., platform-wide broker payment-performance data used in BrokerProfile). Your individual loads and invoices are deleted, but the anonymized statistical contributions (average days-to-pay, payment counts) that have already been aggregated cannot be individually extracted or removed.
• Clerk (our authentication provider) may retain certain authentication event logs (sign-in timestamps, IP addresses) for up to 90 days after account deletion for security and fraud-prevention purposes, in accordance with their data retention policies.
• Records of the deletion request itself, for our compliance records.

7. Contact

For questions about data deletion or to verify the status of a deletion request:

Email: privacy@overtheroad.ai