We may update this from time to time; we'll notify account holders of material changes.
This Privacy Policy explains how Casting Karma LLC handles information in connection with the TenderProof Service. TenderProof is a business-to-business tool; it does not involve consumer health data (no HIPAA/PHI) and is not directed to children.
Account & billing data: your name, work email, company name, role, and billing information. Payment card details are handled by our payment processor (Stripe); we do not store full card numbers. Carrier data we retrieve for you: FMCSA and third-party operating-authority, insurance, and safety information for the carriers you look up — this is business data about carriers, not consumer personal data. Your inputs & records: the criteria you set, the lookups you run, the verdicts and overrides you make, and the defense files you generate and freeze. Usage & technical data: log data, device/browser information, and cookies necessary for the Service to function, plus limited analytics.
To provide and operate the Service (run lookups, evaluate against your criteria, generate and preserve your records); to authenticate and secure accounts; to process billing; to provide support; to maintain, analyze, and improve the Service; if you enable optional monitoring, to re-check carrier data on your records and send you email alerts and a periodic digest (you can opt out of these optional emails at any time; transactional and security emails are not optional); and to comply with law. We do not sell your personal information, and we do not use your records to rate carriers or to build any carrier-scoring product.
With service providers (subprocessors) that process data on our behalf under contract, including: hosting/compute (Vercel and/or Render), edge functions & scheduled jobs (Cloudflare), database & authentication (Supabase), immutable record storage / WORM (Amazon Web Services S3 Object Lock, if enabled), payments (Stripe), and email (Resend). With FMCSA and data providers only as needed to retrieve the data you request. As required by law or to protect our rights, users, or the public, and in connection with a merger, acquisition, or sale of assets (with notice). We maintain a current subprocessor list and will provide it on request.
Defense-file records are preserved using tamper-evident hashing and trusted timestamps and, where enabled, write-once (WORM) storage, to protect their integrity. We retain records for the subscription term plus seven (7) years (see ToS §5), then delete or de-identify them, subject to law and any legal hold. Account and billing data are retained as needed for the relationship and legal/tax obligations.
We use reasonable technical and organizational safeguards, including encryption in transit and at rest, access controls, hashed credentials, and tamper-evident record hashing. No system is perfectly secure.
You may access, correct, export, or request deletion of your account data (deletion is subject to the record-integrity retention in Section 4 and legal holds). Depending on your state or country, you may have additional rights (for example, under the CCPA/CPRA or GDPR); we honor applicable rights and do not sell personal information. To make a request, email privacy@tenderproof.io.
We use cookies and similar technologies that are essential for authentication and Service function, plus limited analytics. You can control cookies through your browser; disabling essential cookies may break the Service.
The Service is operated from the United States; if you access it from elsewhere, you consent to processing in the United States.
We may update this Policy; material changes will be posted with a new date. Questions or privacy requests: privacy@tenderproof.io, Casting Karma LLC.