NextDrive Privacy Policy

NextDrive (“NextDrive,” “we,” “us,” or “our”) provides software and administrative services that help motor carriers, drivers, mechanics, aviation operators, and related personnel organize and manage regulatory compliance records. This Privacy Policy explains how we collect, use, disclose, and protect personal information across all of our products and services (collectively, the “Services”).

This Policy applies to individuals who use the Services, including drivers and other personnel who maintain credentials in NextWallet, and to personnel of carrier and operator customers who use NextDrive and related products. It does not apply to third-party websites or services that we do not control.

By using the Services, you acknowledge that you have read and understood this Policy. Where we require your consent for a specific activity — such as obtaining a motor vehicle record or querying the FMCSA Drug and Alcohol Clearinghouse — we will obtain that consent separately, in the form the law requires.

The categories below track the classifications used under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). Not all categories apply to every user; what we collect depends on the Services you use and your role.

• Directly from you: information you enter or documents you upload, including through NextWallet.
• From your employer or prospective employer: when a carrier customer adds you to its account or uploads records relating to you.
• From third parties, with your authorization: state motor vehicle agencies (motor vehicle records); the FMCSA Pre-Employment Screening Program (PSP); the FMCSA Drug and Alcohol Clearinghouse; previous employers responding to safety performance history inquiries under 49 C.F.R. § 391.23; certified laboratories and Medical Review Officers; background screening providers.
• Automatically: technical and usage information generated when you access the Services.
• From integrations your employer enables: electronic logging device (ELD), telematics, or transportation management system data, where the carrier connects such a system.

Consent for regulated inquiries. We obtain motor vehicle records, PSP reports, Clearinghouse query results, consumer reports, and safety performance history only where the applicable law permits and where we or the carrier have obtained the authorization that law requires. Those authorizations are collected separately from this Policy.

We use personal information for the following business purposes:

• To provide, operate, maintain, and support the Services.
• To create, populate, and maintain compliance records, including driver qualification files, vehicle maintenance and inspection records, training records, and drug and alcohol program records.
• To perform regulated inquiries and verifications that you or your employer authorize.
• To administer drug and alcohol testing programs where we serve as C/TPA.
• To notify you and your employer of upcoming expirations, required actions, and compliance status.
• To generate compliance reporting, audit-preparation materials, and analytics as described in Section 7.
• To verify identity, authenticate users, prevent fraud, and secure the Services.
• To respond to your requests and provide customer support.
• To improve, develop, and test our products and features.
• To comply with legal and regulatory obligations and to respond to lawful requests from government authorities.
• For any other purpose disclosed to you at the time of collection or to which you consent.

We will not collect additional categories of personal information, or use personal information for materially different purposes, without providing you notice.

We disclose personal information in the following circumstances:

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not sold or shared personal information in the preceding twelve (12) months.

The Services include analytics and artificial-intelligence-assisted features. These may include document reading and classification, coaching suggestions, compliance summaries, and safety risk indicators derived from compliance and operational records.

If you are a California resident, you have the following rights under the CCPA, subject to the exceptions and verification requirements described below:

• Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it.
• Right to delete. You may request that we delete personal information we have collected from you, subject to the exceptions in Section 8.2.
• Right to correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. We do not sell or share personal information as defined by the CCPA. If this changes, we will update this Policy and provide the required opt-out mechanism.
• Right to limit use of sensitive personal information. We use sensitive personal information only for purposes permitted under Cal. Civ. Code § 1798.121(a), and therefore this right does not currently apply. If our practices change, we will provide the required mechanism.
• Right to non-discrimination. We will not discriminate against you for exercising your privacy rights.
• Right to portability. You may request a copy of your personal information in a portable format.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit and at rest.
• Encryption of Social Security numbers and other highly sensitive fields.
• Role-based access controls enforced at the database layer, including restrictions that prevent unauthorized personnel from accessing drug and alcohol testing information.
• Access logging and monitoring.
• Contractual security obligations imposed on service providers.

No system is completely secure. We cannot guarantee the security of personal information. If we become aware of a breach of the security of your personal information, we will notify you and any applicable regulator as required by California Civil Code § 1798.82 and other applicable law.

We retain personal information for as long as necessary to provide the Services, and for the periods required by applicable law and regulation. Representative retention periods include:

Where no legal retention period applies, we retain personal information for as long as your account is active and for a reasonable period thereafter, and then delete or deidentify it.

NextWallet is designed so that a driver maintains a personal credential file that travels with them. You choose which employers or prospective employers may access it, and you may revoke that access at any time through the Services.

Revoking access does not delete records that an employer is legally required to retain. Where a carrier obtained or paid for a record about you — for example, a motor vehicle record, a road test certificate, or a training certificate — that carrier may retain its own copy as required by law and its own recordkeeping obligations, independent of your credential file.

The Services may link to or integrate with third-party services, including laboratories, screening providers, telematics systems, and payment processors. Those parties handle information under their own privacy policies, and we are not responsible for their practices. Review their policies before providing information to them.

The Services are intended for individuals aged 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected such information, we will delete it. We do not sell or share the personal information of consumers under 16.

The Services are operated from the United States, and personal information is stored and processed in the United States. If you access the Services from outside the United States, including from Mexico, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those of your country. Where required, we will obtain your consent to such transfer and provide the notices your local law requires.

We may update this Policy from time to time. We will post the updated Policy with a revised “Last Updated” date and, for material changes, provide notice through the Services or by email at least thirty (30) days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

If you have questions about this Policy or our privacy practices, or wish to exercise your rights:

If you have a disability and need this Policy in an alternative format, contact us at the address above.