Privacy Policy

Version 1.0. Effective 29 August 2026. Operated by Innovations App Lab LLC, a Texas limited liability company. Questions or privacy requests: support@fleethook.com.

The short version

FleetHook is software towing companies use to run their operations. We hold the information needed to provide the service and support each company’s towing work. We do not sell personal data, share it with advertisers or data brokers, use it for targeted advertising, or use it to profile people. Database-level access controls isolate each towing company’s records from every other company. This policy explains what we process, why, who receives it, and how privacy rights may be exercised.

Who is responsible for your information

Privacy law distinguishes the party that decides how personal data is used (the "controller") from the party that merely processes it on the controller's instructions (the "processor"). FleetHook plays both roles, depending on the data:

• We are a processor of the operational records a towing company puts into its account — tow records, customer and vehicle details, photographs, invoices, driver and staff records. The towing company is the controller of that data. It decides what to record and why; we hold and process it on the company's behalf, under its instructions and under a data processing addendum. Our obligations for that data are set out in our Data Processing Addendum.
• We are a controller of the data we decide the purposes for ourselves: the account-registration and billing information a towing company gives us to open and pay for its subscription, our website records, and any support correspondence you send us.

If you are a driver, dispatcher or office user, the company that gave you your login is the controller of what is recorded about you at work. Questions about your own work records should go to that company first; if they cannot help, write to us and we will assist or refer you. If you are a vehicle owner whose vehicle was towed, the towing company — not FleetHook — holds that record, and we will pass any request straight to them.

Categories of personal data we process

This is the list §541.102 of the Texas Data Privacy and Security Act asks us to publish. Not every category applies to every person; a customer whose car is towed appears in different rows than a driver who works for a FleetHook company.

Identifiers and account information

Name, email address, phone number, mailing address, role and permissions, the company you belong to, and the badge or unit number a company assigns. Passwords are never visible to us; they are stored as one-way hashes by our authentication provider.

Commercial and billing information

For the towing company that pays for a subscription: company name, billing contact, plan tier, and payment status. Card details are entered directly with our payment processor (Stripe) and are not stored on FleetHook's own systems.

Precise geolocation (drivers)

The app records a driver's position to fill in pickup addresses, to timestamp a shift start, and to show dispatch where trucks are. Continuous tracking runs only while a driver is on shift (clocked in or marked available) and continues while the phone is locked or the app is in the background during that time. Clocking out, marking yourself unavailable, or signing out stops it, and the last known coordinates are cleared. The app asks permission before location is used the first time, and both iOS and Android let a driver withdraw that permission at any time in Settings.

Route history on a call

Separately from the live position above, the app records a trail of GPS points while a driver is working an assigned call, so the road a truck actually took can be shown afterwards — how a mileage charge is answered weeks later instead of from memory. It runs from the moment a call is assigned until that call is cleared, and at no other time: not between calls, not off duty, and not while a driver is merely available with nothing assigned. A point is kept roughly every thirty seconds and only when the truck has moved at least 75 metres, so the trail is a route rather than a minute-by-minute log of a person. Route history is visible only to the owner, to anyone the owner specifically grants that permission, and to the driver for their own trail; it is never shared between companies, and printed receipts show total route miles, not the map.

Tow and vehicle records

Vehicle identification numbers, plates, make, model and colour; pickup and drop-off addresses; the reason for the tow and the authorising party (including a police agency or officer where a tow is police-authorised); charges, invoices and payment status; storage and impound details.

Customer information on a tow

The name, phone number and address of the vehicle's owner or the person requesting a tow, and — where the company uses the app's scanner — the information printed on a driver licence, captured to fill in a form.

Photographs, signatures and documents

Condition photographs taken before and after a tow, damage evidence, signatures collected on release or consent, and insurance cards. These are stored privately, separated by company, and served only through links that expire after a short time.

Device and technical information

A device push-notification token (so job alerts can be delivered), IP address, and ordinary operational logs recording which account performed which action and when. We do not run advertising trackers, and there is no third-party advertising analytics in the app.

Sensitive personal data

The Texas Data Privacy and Security Act treats precise geolocation as sensitive personal data, and FleetHook processes it — the driver location and route history described above. We process it for one reason only: to operate the dispatch and billing features a towing company is using, on that company's instruction. We do not sell it and we do not use it for targeted advertising or profiling. A driver whose employer uses these features can turn location off in their device settings, recognising that on-shift dispatch and mileage features depend on it; the towing company, as controller and as employer, is responsible for informing its drivers and for any consent its own policies or the law require.

A driver licence number is government-identification data and, whether or not a given statute labels it "sensitive," we treat it with the same protection as everything else here. FleetHook does not collect racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, immigration status, or genetic data.

Why we process it (purposes)

• To provide the dispatch, tracking, impound, invoicing and record-keeping features a towing company signs up to use.
• To authenticate users, enforce each person's permissions, and keep one company's data walled off from every other company's.
• To fill in pickup addresses, timestamp shifts, show dispatch where trucks are, and support the public tracking link a company can send a customer.
• To deliver job-assignment push notifications to a driver's device.
• To bill a towing company for its own FleetHook subscription (once paid plans are active) through our payment processor.
• To keep the service secure, diagnose faults, prevent fraud and abuse, and comply with our legal obligations.

We do not process personal data for purposes that are neither reasonably necessary to, nor compatible with, the purposes above without your consent.

A public tracking link a towing company sends to a customer shows only the tow status, vehicle description and plate, pickup and destination addresses, the driver’s first name, and the truck’s live position while the tow is active. It does not show customer or driver contact details. The link uses an unguessable access token stored in the URL fragment. The fragment is not included in the browser’s initial page request or ordinary referrer headers; the FleetHook page uses it to request the authorized tracking information.

Who else touches the data

Running the service requires a small number of suppliers ("processors" or "sub-processors"), each bound by contract to handle information only as instructed. The categories of third parties are: cloud infrastructure and storage, payment processing, message and push-notification delivery, mapping/geocoding, app distribution, and government reference databases. Specifically:

• Supabase — database, file storage and sign-in (cloud infrastructure).
• Vercel — hosting for this website (cloud infrastructure).
• Stripe — subscription billing and payment processing, once paid plans are active. Card data is entered directly with Stripe.
• Apple Push Notification service and Google Firebase Cloud Messaging — delivering job-alert push notifications to devices.
• Apple and Google — distribution of the iOS and Android apps.
• MapTiler — map tiles for the dispatch board, the customer tracking page and the Android app. MapTiler receives the viewer’s IP address and the map area being viewed, together with a domain-restricted key.
• Address geocoding — turning a typed address into map coordinates. On the website this uses OpenStreetMap Nominatim; in the mobile apps it uses the device’s own operating-system geocoder — Google on Android and Apple on iOS. Only the address text is sent.
• NHTSA vPIC — the United States government's public vehicle database, used to turn a VIN into a make and model. Only the VIN is sent.

We keep this list current. If we add a supplier that handles personal information, it will appear here, and our Data Processing Addendum describes how we notify towing-company customers of new sub-processors.

What we do not do

• We do not sell personal data to anyone, for money or for any other valuable consideration.
• We do not process personal data for targeted advertising.
• We do not use personal data for profiling in furtherance of decisions that produce legal or similarly significant effects.
• We do not share information with advertisers, data brokers or marketing networks, and we do not track you across other apps or websites.
• We do not use your tow records to train any general-purpose model, or to build a product other than your own account.

Because we do not sell personal data or sensitive personal data, we do not post the sale-notice language that §541.102 requires only of controllers who do sell it.

How your information is protected

We maintain reasonable administrative, technical and physical safeguards appropriate to the volume and nature of the data. Separation between companies is enforced by the database itself rather than by the app: every request is checked against the account making it, so a request for another company's records is refused at the source. Traffic is encrypted in transit. Photographs and documents are private by default and reached only through links that expire. Passwords are stored only as one-way hashes. Sensitive changes are written to an audit log that client software cannot alter or erase, and the mobile apps lock behind the device's own biometric or passcode after a period of inactivity.

No system is perfect, and we will not pretend otherwise. If a breach of security affecting your personal data occurs, we will investigate and notify affected people and, where the law requires it, the Texas Attorney General and other regulators, within the timeframes the law sets. (Texas law, Tex. Bus. & Com. Code ch. 521, requires notice to the Attorney General when a breach affects at least 250 Texas residents, no later than the 30th day after the breach is determined.)

How long we keep it

Tow records are business records, and towing companies are typically required by state regulation to keep them for a set period, so we keep account data for as long as the company's account is active. GPS route history is the exception and is deleted 90 days after it is recorded by an automated daily job, because a trail of a person's movements has a short useful life as billing evidence and no reason to outlive it. If a company closes its account, we will delete or return its data within 90 days of the request, except where we are required to retain something by law.

Your privacy rights

Depending on where you live, and subject to the exceptions the law allows, you may have the right to: confirm whether we process your personal data and access it; correct inaccuracies; delete personal data provided by or obtained about you; obtain a portable copy of data you provided; and opt out of the sale of personal data, targeted advertising, or profiling with legal or similarly significant effects. As explained above, FleetHook does not sell personal data, serve targeted advertising, or conduct that kind of profiling, so those opt-outs are already the default.

How to exercise your rights

Submit a request by email to support@fleethook.com with enough detail for us to identify the relevant records and understand your request. We will respond without undue delay and within 45 days. When reasonably necessary, we may extend once for up to 45 additional days and will tell you why within the initial period. We do not charge for up to two requests in a 12-month period, except where applicable law permits a reasonable fee for a manifestly unfounded, excessive, or repetitive request. We will take reasonable steps to verify your identity before acting; if we cannot verify it, we may decline the request and will explain why.

If you are an employee of a towing company and your request concerns your work records, we will refer the request to that company as the controller, since the records are theirs. Account owners can also access, correct and export most of their data directly inside FleetHook. You can permanently delete your own account from inside the FleetHook app: open the app’s settings and choose Delete My Account. Deleting removes your login and signs you out on every device, clears your contact details (such as phone number, licence number and insurance) and your push tokens, and stops any new record being created under your account. If you are the only owner of your company, the app will first ask you to make someone else an owner, so your company and its drivers are not stranded. Records your company is legally required to keep — completed tows, invoices and impound records — remain with the company, including your name, because they are binding records of work that was actually performed. Your driver record is retired and marked off duty, so those past jobs still show who did the work.

How to appeal a denied request

If we deny your request, we will tell you why. You may appeal within a reasonable time by replying to our decision or writing to support@fleethook.com with the subject line "Privacy Appeal." We will review the appeal and respond in writing within 60 days, explaining the reasons for our decision. If we deny the appeal, we will provide you an online mechanism or other method to contact the Texas Attorney General to submit a complaint, at the Texas Attorney General's consumer-privacy page.

Biometric information

FleetHook's mobile apps can lock behind Face ID, Touch ID or the equivalent Android biometric. That check is performed by the device's own operating system; FleetHook never receives, and never stores, any fingerprint, face geometry or other biometric identifier. The app's document scanners read the printed and barcoded text on a driver licence, plate or VIN — not facial geometry. We therefore do not capture a "biometric identifier" for a commercial purpose within the meaning of Texas's biometric statute (Tex. Bus. & Com. Code ch. 503, CUBI). Our full explanation is on the Biometric Information Notice page, which we will update before introducing any feature that would capture biometric data.

Children

FleetHook is a tool for commercial towing operations. It is not intended for and not directed at anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, write to us and we will delete it.

Where information is held

Information is stored on servers located in the United States, in our hosting provider’s US East (Northern Virginia) region (Supabase, region us-east-1), and backups are held in the same region. If you use FleetHook from outside the United States, your information is transferred to and stored in the United States, and by using FleetHook you are asking us to make that transfer.

Changes

If this policy changes in a way that matters, we will update the version and date at the top and notify account owners by email before the change takes effect.

Contact

Write to support@fleethook.com. FleetHook is operated by Innovations App Lab LLC, a Texas limited liability company. For a formal privacy request or notice by mail, our address is Innovations App Lab LLC, 20102 Maple Landing Dr, Cypress, TX 77433.