Customer Privacy Policy

Effective date: [EFFECTIVE DATE]
Version: [VERSION]

This Privacy Policy explains how Ivy Group LLC ("Ivy," "we," "us," or "our") collects, uses, shares and protects information in connection with Ivy RouteOps ("RouteOps" or the "Service") — our route-operations software for delivery companies — and our websites, including ivyrouteops.com.

1. Who this policy covers, and our role

RouteOps is used by delivery businesses (our "Customers"), such as OnTrac Regional Service Providers. Customers use RouteOps to manage their operations and the people who work with them.

• When you visit our website, contact us, or sign up as a Customer, Ivy decides how your information is used. This policy describes that.
• When a Customer puts information about its drivers, contractors or staff into RouteOps, the Customer decides what information is collected and why. Ivy processes that information on the Customer's behalf, as its service provider (sometimes called a "processor"), under our contract with the Customer. If you are a driver or worker of one of our Customers, the Customer's own privacy notice also applies to you, and you should contact the Customer first with questions or requests about your information. We will help the Customer respond.

2. Information we collect

2.1 Account users (Customer owners, managers, dispatchers and other staff).

• Name, work email address, phone number, job role, company, and log-in details (passwords are stored by our authentication provider, not readable by Ivy).
• If you sign in with Google, your Google name and email address.
• Settings and preferences, such as language and time zone.
• Messages you send to us (support requests, emails, calls).

2.2 Customer business information.

• Company name, legal name, addresses, tax ID (EIN), contacts, billing contact details.
• Territories, facilities, routes, schedules, packages, delivery performance, scorecards, rates, fees and reports.
• Billing information: plan, prices, invoices and payment status. Card and bank account numbers are collected and stored by Stripe, our payment processor; Ivy only sees limited details such as the card brand or the last four digits.

2.3 Driver and worker information processed for Customers. Depending on what a Customer chooses to enter or import, this may include:

• Identity and contact details: name, phone number, email address, home address, date of birth, emergency contacts, photos.
• Work details: carrier and contractor IDs (for example OnTrac, OpenForce or FasTrac IDs), driver's license number and expiration, vehicle and insurance details, onboarding documents, signed agreements, training progress.
• Operations data: schedules, availability, route assignments, stops, package events, delivery photos or proofs of delivery, performance metrics.
• Pay information: pay rates, stop counts, settlements, fees, deductions, loans and payment records.
• Communications: text messages, WhatsApp messages, call logs and emails sent through the Service.
• Device information if the driver uses our mobile app (see 2.4), and location information only where a feature asks for it and the device allows it. [ATTORNEY/OWNER: confirm whether any feature collects device location.]

2.4 Information collected automatically.

• Device and usage information: browser and device type, operating system, app version, IP address, pages and features used, timestamps, and error logs.
• Push-notification tokens (if you allow notifications).
• Cookies and similar technologies needed to keep you signed in and to run the Service. [ATTORNEY/OWNER: list any analytics or advertising cookies on the marketing site, if used.]

2.5 Information from other sources. Customers may import files exported from carrier and contractor systems (such as OnTrac, OpenForce or FasTrac). Payment status comes from Stripe.

3. How we use information

We use information to:

• provide, operate, maintain and secure the Service;
• create and manage accounts and keep each Customer's data separate from other Customers' data;
• perform the features Customers use, such as scheduling, route management, imports, reports, pay calculations, and messages to drivers;
• bill Customers and process payments;
• provide customer support and send service messages (for example, account, security, billing and policy-change notices);
• understand how the Service is used and improve it, including by creating aggregated or de-identified statistics that do not identify any person or Customer;
• detect, prevent and respond to fraud, abuse, security incidents and technical problems;
• comply with law and enforce our agreements; and
• with your permission or where allowed by law, tell Customers and prospects about our products. You can opt out of marketing emails at any time.

For driver and worker information that we process for a Customer, we use it only to provide the Service to that Customer and as described in our contract with that Customer — not for our own marketing.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. How we share information

We share information only as follows:

4.1 Within the Customer's account. Authorized users of a Customer can see information in that Customer's account according to the roles the Customer assigns. Drivers can see their own information that the Customer makes available to them.

4.2 Service providers (subprocessors). We use trusted providers to run the Service. They may process information only to provide services to us:

4.3 Carrier and contractor platforms. RouteOps reads files that Customers export from systems such as OnTrac, OpenForce and FasTrac. [ATTORNEY/OWNER: confirm whether RouteOps ever sends data to these systems; if not, state "We do not send your information to these platforms."]

4.4 Legal and safety reasons. We may disclose information if we believe in good faith it is required by law, subpoena or legal process, or needed to protect the rights, property or safety of Ivy, our Customers, drivers or others.

4.5 Business transfers. If Ivy is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal, subject to this policy.

4.6 With your direction. We may share information when a Customer or user asks us to.

5. Security

We use reasonable administrative, technical and physical safeguards designed to protect information, including encryption in transit and at rest provided by our hosting platform, role-based access controls, separation of each Customer's data, and limiting staff access to what is needed. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security incident affecting information we hold, we will notify affected Customers (and, where the law requires, individuals or authorities) as described in our Terms of Service and as required by law.

6. Data retention

• Customer and driver information is kept for as long as the Customer's account is active. After a Customer's subscription ends, we keep the data for [30] days so the Customer can request an export, and then delete or de-identify it within a reasonable time, except where we must keep some of it longer (see below).
• Billing, tax and acceptance records (such as invoices and records of who accepted our Terms) are kept for as long as needed for legal, accounting and tax purposes — generally [7] years. [ATTORNEY: confirm.]
• Backups are kept for a limited time and overwritten on a normal schedule.
• A Customer may ask us to delete specific information sooner, and may delete many records directly in the Service.

7. Your choices and rights

Account users can review and update much of their information in the Service, and can contact us to access, correct or delete their information.

Drivers and workers of our Customers should send requests to the Customer they work with, because the Customer controls that information. If you contact Ivy directly, we will pass your request to the Customer and help them respond.

State privacy rights. Depending on where you live (for example, California and other states with consumer privacy laws), you may have rights to know what personal information is collected about you, to access it, to correct it, to delete it, to opt out of its sale or sharing (we do not sell or share it), to limit use of sensitive personal information, and not to be treated differently for using these rights. We will verify requests before acting on them. You may use an authorized agent where the law allows. [ATTORNEY: confirm which state laws apply to Ivy and to Customers given business-only use and company size, and whether a "Notice at Collection" is needed for California workers.]

Marketing emails. You can unsubscribe using the link in any marketing email.

Push notifications. You can turn them off in your device settings.

To make a request, email support@ivyrouteops.com.

8. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child's information has been entered, contact us and we will delete it.

9. Where information is stored

Ivy is based in the United States and the Service is intended for use in the United States. Information is stored and processed in the United States by Ivy and its service providers.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers by email or in the Service before the changes take effect, and update the effective date and version above.

11. Contact us

Ivy Group LLC
[MAILING ADDRESS]
Email: support@ivyrouteops.com
Website: https://ivyrouteops.com