Legal
How we collect, use, share and protect your information.
This Policy explains what we collect, why, who receives it, and the choices and rights available to you. It covers our website, shipper and carrier portals, and mobile applications.
Smart Expedite Inc. (“Smart Expedite,” “we,” “us”) operates a business freight-brokerage platform, website, portals and mobile applications. This Policy explains information about drivers, business representatives, carriers, shippers, recipients, visitors and support contacts. The Mobile Application Privacy Policy gives the mobile-specific explanation. The same retention rules and privacy commitments apply across both policies. This notice does not create consent where a separate affirmative choice is required.
Contact support@smartexpedite.com, call (331) 300-7200, or write to Privacy, Smart Expedite Inc., 535 Duane Street, Suite 100, Glen Ellyn, IL 60137. Identify a privacy request in your message; do not send a Social Security number, bank account number or identification image in ordinary email. Privacy and deletion requests may be made through Support, the published account-deletion page or the App's privacy/account settings. Device permissions can also be changed in device settings. You do not need to reinstall the App to make a web or Support request.
We collect information you or your authorized business provide; information created by your use of the services and device permissions; shipment information from transaction participants; and verification information from government records, insurers, authorized payment or verification providers and persons authorized to supply it. Our collection depends on your role and features used.
| Category | Examples and purpose | Typical recipients for that purpose |
|---|---|---|
| Account and business identifiers | Name, business, contact details, MC/USDOT numbers, role, login and authentication records; account administration and fraud prevention | Restricted hosting, authentication and verification providers; authorized business administrators |
| Qualification and verification | Authority and insurance records, equipment, license or identity evidence where necessary; qualification and investigation | Verification providers, insurers, relevant operational staff; transaction participants only as needed |
| Freight and commercial records | Tenders, rates, locations, shipment descriptions, BOL/POD, photographs, messages, signatures, disputes and claims; transportation, billing and enforcement | Authorized carriers, shippers, facilities and claim participants; document and support providers |
| Financial and tax information | Payee, tax forms, assignment notices, bank tokens, masked details or full account/routing information when a verified direct-payment process requires it, invoices and settlement records; payment, tax and fraud prevention | Restricted payment, banking, tax and accounting providers; verified factors and legally entitled recipients |
| Precise and approximate location | Device GPS or authorized telematics, timestamps and accuracy; Available matching, Active Dispatch visibility, milestones, ETA, detention evidence, safety and fraud review | Restricted mapping/hosting providers and authorized participants needing active-Load visibility; no public availability map |
| Device, online and diagnostic information | IP address, app/device installation identifier, browser/OS/app version, events, access logs, error and crash reports; service operation, security and improvement | Restricted hosting, security, crash and analytics providers |
| Communications and submitted media | Support messages, uploaded files/photos, preferences; support, proof and dispute handling; recordings only after the applicable recording notice and permission | Restricted communications/support providers and appropriate transaction participants |
| Derived information | Performance, fraud indicators, matching features, forecasts and inferences; service improvement and Smart Expedite analytics/AI | Authorized internal users and restricted processors; human review for material disputed outcomes |
Installing the App does not authorize us to collect a phone's contacts, SMS inbox, call history, microphone audio, entire photo library, health information or biometric templates. Those are not baseline collection purposes under this Policy. A future feature needing new sensitive access must first provide its specific notice, obtain required permission, and satisfy its legal and store requirements. Ordinary uploaded photographs are not permission to create face-geometry templates. Device-level Face ID or fingerprint unlocking does not give us the device’s biometric template.
We use information to verify and administer accounts; arrange transportation; match loads; provide shipment visibility; communicate; document performance; calculate accessorials; pay and collect legitimate obligations; prevent and investigate fraud and security incidents; respond to disputes, claims and legal requests; maintain required records; and develop and improve Smart Expedite’s services, analytics, automation and AI. We use only information appropriate to these purposes and applicable permissions. Tax, raw bank, identity-document and similarly restricted information is segregated from ordinary analytics and model-training datasets.
We may analyze lawfully collected operational records and create de-identified or aggregated datasets, features and models for Smart Expedite’s present and future products. Identifiable data use remains subject to this Policy, confidentiality, retention, applicable consent and law; a broad contract license does not eliminate those limits. We do not authorize providers to use identifiable shipment or location information for their unrelated advertising, profiling or unrestricted general-purpose AI training. Before sharing personal information through a feature with a third-party AI service, we clearly disclose the recipient or service, information and purpose and obtain explicit permission where required, including applicable Apple requirements. Other third-party sharing also follows applicable notice and permission requirements; AI consent is not a substitute for those duties. A corporate user cannot grant another person's consent where the law requires that person's choice. Declining an optional AI feature does not prevent ordinary shipment or payment support. We may retain and use properly de-identified information and non-identifying model improvements after account closure, with safeguards against re-identification. We commit to maintaining information represented as de-identified in that form, do not attempt to re-identify it except for legally permitted controlled testing, and contractually require recipients to observe applicable de-identification restrictions. Replacing names with IDs alone is insufficient.
Matching, recommendations, fraud detection, document processing and performance tools may use automation. A driver’s location is not conclusive proof of misconduct. Material disputed verification, payment, performance or access decisions can be submitted to Support for human review and correction. We do not authorize automation to override safety obligations or silently agree to new rates or banking instructions. A use requiring a special assessment, notice, sensitive-information limitation or decision-related right will be enabled only after those requirements are met. We explain relevant processing and material decision factors where required, while protecting trade secrets and security information to the extent the applicable law permits. We do not treat that protection as an exemption from required notices or a person's right to understand a decision.
The actual driver receives a specific notice before collection. “Available” means the driver affirmatively offers availability for suitable Load offers. Matching identifies nearby suitable pickups under the driver's applicable service terms. Available collection may occur in the background only with the required permission. A future booking alone does not begin shipment tracking. “Active Dispatch” begins when the assigned driver is confirmed dispatched toward pickup. Tracking then supports that Load through lawful delivery and resolution of remaining cargo custody, or cancellation and custody resolution. Missing paperwork alone does not prolong tracking after cargo custody ends.
Selecting Unavailable stops availability matching. If an active Load remains, its separately disclosed tracking purpose may continue with permission. When neither purpose remains, new precise-location collection stops. You can revoke permission in the App or device settings at any time; essential location features then stop or degrade. During an active Load, contact operations to arrange safe alternative reporting. Loss of permission is not itself an automatic fine. Historic data remains subject to the retention and deletion rules below.
We do not publish unassigned drivers’ precise availability locations to anonymous visitors or give prospective shippers unrestricted access. Authorized participants in the booked active Load may receive needed shipment visibility. Access links are restricted and expire when the operational purpose ends. We do not sell location information, use it for targeted advertising, or use it to infer visits to sensitive places for unrelated profiling.
We disclose information to restricted providers performing hosting, mapping, authentication, communications, security, analytics, document processing, payment and support functions; authorized transaction participants; insurers, factors and professional advisers with a legitimate need; and persons you authorize. Providers must process information for defined purposes, protect it, restrict further disclosure and assist with applicable privacy obligations. We disclose only the information reasonably needed for the recipient’s role. Business administrators may see account and shipment activity for their business but do not receive unrestricted access to a driver’s personal device or off-duty movements.
We may disclose information when legally required, to establish or defend rights, prevent harm or fraud, or respond to a properly evaluated legal request. We review jurisdiction, scope and legal process and seek appropriate limits where warranted. We give notice to affected persons when lawful and appropriate. An allegation or informal request does not automatically justify release of a full location history. In a merger, financing, reorganization or asset transfer, information may be disclosed under appropriate confidentiality protections and transferred subject to these commitments and applicable notice or consent requirements.
We do not sell personal information, share it for cross-context behavioral advertising, or use precise location for targeted advertising. We do not exchange SMS opt-in or consent records with others for their marketing; service providers may process them to operate our communications. If those practices change, we will first provide required notices and choices. A recipient's independent processing is governed by its own applicable duties; our disclosure remains limited by this Policy. We require providers receiving App user data to provide the same or equal protection described by the applicable App privacy commitments and platform requirements. Personal-data sharing with an independent controller requires an identified lawful basis and appropriate disclosure rather than a misleading processor label.
Necessary cookies or similar storage support login, security, preferences and transactions. Optional analytics, if offered, have a separate control and do not start before consent where required. You can change optional choices without losing essential account functions. We honor legally applicable recognized opt-out signals and do not interpret an opt-out as permission for a different collection channel. Because we do not conduct advertising tracking, the absence of a browser signal does not authorize it. We do not use fingerprinting to bypass your choices. Analytics, session replay, error reporting and embedded services may not collect undisclosed sensitive content or evade a consent withdrawal. Feature-specific collection notices identify any additional permitted collection before it starts. Browser controls can disable storage, but necessary functions may then fail.
Push notifications require device permission where applicable. Operational SMS and optional marketing have separate enrollment and opt-out choices. SMS consent does not authorize reading your phone’s messages. You may opt out of marketing email using its unsubscribe link; necessary transaction and account notices may continue through appropriate channels. See the Communications Consent and Recording Notice for message-specific terms.
We retain the minimum information appropriate to the following periods and purposes. Longer retention is limited to a documented legal requirement or a specific, proportionate claim, investigation or preservation duty; ordinary usefulness is not a blanket extension. More protective mandatory limits control, including special biometric limits. Legally required records of a separately activated restricted-data transaction follow that specific law; a general contract period does not replace a longer mandatory record period. Deleting a source file does not by itself establish that an embedding or model no longer contains personal information. Records under a hold are restricted and reviewed, then deleted or de-identified after the hold and applicable period end.
| Record | Retention rule |
|---|---|
| Master agreement, amendments and minimum evidence of assent | Relationship plus 10 years from the latest of termination, last Load or final settlement |
| Accepted Load-specific agreements and minimum assent evidence | 10 years from the later of completion or final settlement |
| Freight, invoice, payment and tax records | 7 years from the later of final settlement or applicable tax return filing/due date; broker transaction records in all cases at least the required 3 years |
| Raw identifiable GPS tracks | Up to 90 days from collection in active systems; restricted backup copies expire within the additional period below. Only selected evidence subject to a specific justified hold may remain identifiable longer; lawful de-identification may occur before deletion |
| Necessary arrival/departure and custody milestones | 7 years from final Load settlement; retain event location/time only, not the continuous route |
| Raw ID images | Delete within 90 days after verification or application closure, unless a specific documented requirement applies; retain minimum verification result separately |
| Raw bank credentials or account details under our control | Tokenize or delete when feasible; remove within 90 days after final settlement or replacement and when no longer needed for an unresolved lawful obligation; retain masked payment evidence |
| Tax forms | 7 years from the later applicable filing/due date or final settlement; restricted access |
| Support correspondence and authorized recordings or transcripts | Up to 3 years after issue closure; raw audio is deleted earlier when no longer needed, and the recording notice states the applicable purpose and period. Selected claim or contractual evidence follows its justified record category |
| Ordinary usage and crash logs | Up to 90 days; remove sensitive payloads and de-identify longer-term statistics |
| Security/audit logs | Up to 1 year; selected incident evidence only for a documented investigation or legal duty |
| Privacy request records and ordinary choice evidence | At least 24 months after request closure or the end of an ordinary choice's operation, limited to evidence necessary to demonstrate compliance; the specific consent categories below control where longer evidence is needed |
| Communications consent and revocation evidence | Minimum notice, signature, number, scope, reliance and withdrawal evidence for 5 years after the later of last reliance or revocation; this is a compliance/defense policy, not continued messaging permission |
| Biometric notice and release evidence if a feature is activated | Minimum nonbiometric notice/release and destruction evidence for 5 years after the last reliance or destruction event, subject to a specific lawful preservation duty; biometric identifiers/templates themselves follow the separate, shorter statutory destruction policy |
| Optional marketing suppression | Minimal contact/suppression entry while needed to honor the opt-out; no repurposing |
| Backups | Age out within 90 additional days after scheduled deletion; isolate from ordinary use and reapply deletion on restoration |
| Properly de-identified data and non-identifying models | May be retained indefinitely for lawful Smart Expedite analysis and development while de-identification remains effective |
Deletion of an account ends new optional collection and ordinary account access, revokes active tokens where supported, and triggers deletion or de-identification of associated information. We may retain the limited agreements, transaction, tax, fraud or claim records described above. We explain relevant exceptions and timing; an outstanding dispute does not justify retaining unrelated raw location or unrestricted account access. A privacy request does not cancel a shipment, erase a lawful debt or require unsafe abandonment. Contact operations to resolve active custody independently of your privacy choices.
Use the Platform privacy controls or contact us to request access, correction, deletion, a portable copy, withdrawal of consent, or review of a decision. We provide rights required by your applicable law, including rights concerning sensitive information, targeted advertising, sale/sharing, and qualifying automated decisions where they apply. We do not retaliate for exercising legal rights. Some essential functions need specific information, which we explain before collection.
We reasonably verify identity and authority using information proportionate to the request and avoid collecting unnecessary new identification. Authorized agents may act with appropriate evidence; we may also verify the individual where law permits. We respond within 45 days, or a shorter applicable deadline; when law permits more time we notify you with the reason and extension before the initial deadline. If we cannot fully comply, we explain the applicable exception and any review or appeal right. You may ask Support to appeal a denial; a different qualified reviewer will consider it within 45 days or a shorter applicable period. You may contact the regulator or attorney general with jurisdiction. These service procedures do not limit statutory remedies.
For California residents where the CCPA applies, Sections 2, 3, 5 and 7 identify categories, purposes, recipients and retention criteria for collection and business-purpose disclosures. You may request categories and specific pieces of personal information, source and recipient categories, correction, deletion and portability, and exercise applicable sale/sharing and sensitive-information rights. We do not sell or share personal information for cross-context advertising and do not knowingly do so for persons under 16. Precise-location use is limited to disclosed services, authorized operational analysis and other legally permitted purposes; any use requiring a sensitive-information limitation or additional consent will have that control before use. We do not offer a financial incentive for personal information. Workplace or business contact information is not assumed categorically exempt. You may also request information about our collection and disclosures during the preceding 12 months.
We use reasonable safeguards appropriate to the information, including access restrictions, encryption in transit and at rest where appropriate, authentication, vendor controls and incident response. No method is perfectly secure. Report suspected exposure promptly to Support. Required incident notices will follow applicable law; this Policy does not impose an inaccurate universal notification deadline.
The services are for adults conducting business and are not directed to children under 18. We do not knowingly collect information from children for account use. Contact us if such information was provided so that we can investigate and take appropriate action. Our operational framework is designed for United States services. International transfers, services or users requiring additional notices, safeguards or rights must be assessed before deployment; a contract’s Illinois-law clause does not waive another jurisdiction’s mandatory privacy law.
We publish the revision date and retain prior versions. We give appropriate notice of material changes and obtain new permission before materially different processing where required. A privacy-policy update does not itself expand a prior sensitive-data consent or amend a Carrier’s commercial terms. The recorded collection notice and consent govern the activity for which they were given, subject to lawful updates and your rights.
Version 2 | September 18, 2026
Smart Expedite Inc. provides the Smart Expedite freight-brokerage App on iOS and Android. This notice describes App information, purposes, recipients, permissions and choices. The general Privacy Policy provides the same cross-service commitments and detailed retention schedule and is available before collection. Neither notice is blanket consent to all device permissions. This mobile notice is available publicly in readable HTML, from the App’s settings and from its store listing.
Privacy contact: support@smartexpedite.com; (331) 300-7200; Privacy, Smart Expedite Inc., 535 Duane Street, Suite 100, Glen Ellyn, IL 60137. Use the App’s privacy controls or the published web account-deletion page to request deletion. You may contact Support without reinstalling the App.
| Information | When collected and why | Disclosures |
|---|---|---|
| Account and verification | Registration, login, role authorization and qualification; business/contact information, authority/insurance and necessary identity evidence | Restricted authentication, hosting and verification providers; authorized business administrators |
| Shipment and payment | Bookings, rates, BOL/POD, signatures, invoices, payee tokens or necessary direct-payment account details, support and claims; arranging, documenting and paying for transportation | Authorized transaction participants and restricted document, payment, support, insurance and professional providers |
| Precise/background location | Only with the described driver choices and permissions for Available matching and Active Dispatch tracking | Restricted mapping/hosting providers and authorized active-Load participants; not a public availability map |
| Camera and selected media/files | When you capture or select documents, cargo evidence or profile/verification information for an identified purpose | Restricted document/verification providers and transaction participants needing that evidence |
| Messages and communications | Messages you send us, messaging preferences and delivery information; operational communications and separately selected marketing | Restricted communications providers; no unrelated marketing use of consent records |
| Device and diagnostics | IP address, installation/account identifiers, OS/app version, access/security events and redacted crashes; operation, fraud prevention and improvement | Restricted hosting, security, crash and analytics providers |
| Operational inferences and AI input/output | Lawfully collected transaction data used for matching, document processing, fraud review, support, analytics and Smart Expedite AI development | Restricted processors; third-party AI receives personal information only after applicable specific disclosure and permission |
We also receive information from your authorized Carrier or Shipper, facilities, public authority records, insurers and authorized verification or payment providers. Installation does not authorize collection of an entire photo library, SMS inbox, call log, contacts, microphone stream, biometric template or health data. These are not baseline collection purposes under this notice. The App cannot access a biometric template used solely by the device to unlock your account. A future feature requiring additional information must first provide its own accurate notice and obtain required permission.
When you select Available, we use precise location for nearby suitable pickups under your applicable service terms. If you separately enable background access, matching may continue while the App is closed or not in use. Turning Available off ends that matching purpose. A future booking alone does not activate shipment tracking.
When the assigned driver is confirmed dispatched toward pickup, Active Dispatch tracking supports shipment visibility, ETA, arrival/departure evidence, detention review, security and operational problem resolution. With permission, it continues in the background through lawful delivery or cancellation and resolution of remaining cargo custody. Missing paperwork alone does not prolong tracking after custody ends. When neither Available nor Active Dispatch applies, we stop new precise-location collection.
Prospective shippers and anonymous visitors do not receive unrestricted precise availability location. Authorized participants in a booked active Load receive only needed shipment visibility; links and access expire with that purpose. We do not sell location, use it for targeted advertising, or infer sensitive personal visits for unrelated profiling. Lawful operational analysis and Smart Expedite AI development use location only under the disclosed purpose, permissions, retention and de-identification rules. Materially different sensitive use requires a new lawful basis and any required consent before it begins.
You can revoke location in App controls or iOS/Android settings at any time. The required location feature then stops or becomes limited. During active transportation, notify operations for safe alternative reporting; revocation is not itself an automatic fine. Coarse location may support limited features but cannot reliably prove precise facility arrival. Historic records follow Section 7 rather than continuing to collect new data after revocation.
Camera access is requested when you choose to capture shipment or verification evidence. Where supported, the system photo/document picker lets you grant only the selected item. We do not need broad library access for ordinary POD uploads. Remove unrelated personal content before upload. If camera permission is denied or a facility prohibits photography, use permitted alternate documents or contact operations; do not violate facility or safety rules.
SMS delivery uses the phone number you provide, not permission to read your SMS inbox. Opening a dialer does not give us call history or record audio. Optional one-time-code assistance uses permitted OS mechanisms or manual entry. Push tokens deliver selected notifications and are removed or invalidated when no longer needed. A push permission is not marketing consent. Operational SMS, marketing and recording have their own specific disclosures and choices. Calls are recorded or transcribed only after the applicable recording notice and affirmative permission.
We use operational and diagnostic information to operate, secure and improve the App, and may develop Smart Expedite analytics, automation and AI from lawfully collected information. Identifiable input remains subject to confidentiality, consent, retention and law. Raw bank, tax and ID information is segregated from ordinary training datasets. A third-party AI feature identifies the recipient/service, data and purpose and obtains explicit permission where required before sending personal information. Other third-party sharing also follows applicable notice and permission requirements. A general business acceptance does not replace another individual's legally required permission. Providers may not repurpose identifiable shipment/location information for unrelated profiling, advertising or unrestricted general-purpose training. Optional AI may be declined in favor of ordinary support.
Properly de-identified data and non-identifying model improvements may support Smart Expedite’s future products and be retained after account closure. We maintain safeguards against re-identification; pseudonymous device or driver IDs alone do not make information anonymous. You may request human review of material erroneous verification, eligibility, payment, location or performance decisions. Automated recommendations cannot authorize unsafe operation or silently accept a new rate or banking instruction.
We disclose information to the recipients described above, restricted advisers/insurers/factors with a legitimate need, persons you authorize, and recipients of properly evaluated lawful requests or protected business transfers. We do not sell personal information or share it for cross-context behavioral advertising. Advertising identifiers and fingerprinting are not used for cross-company advertising tracking under this Policy. Any change requires prior legal and platform review, truthful revised disclosures and applicable choices, including Apple ATT where it applies. ATT is a distinct advertising-tracking control and is not ordinary permission for freight GPS. Our app-store privacy disclosures provide additional information about App and service-provider collection.
Request access, correction, deletion, portability, withdrawal of consent or review through the App or Support. We provide applicable regional rights, including California rights where the CCPA applies, without retaliation. Verification is proportionate; an authorized agent may act with appropriate evidence. We respond within 45 days or a shorter required period and explain any lawful extension, exception, denial and appeal route. You may request review by a different qualified reviewer and contact the regulator with jurisdiction. The general Privacy Policy supplies the California category and retention disclosures; business users are not assumed categorically exempt.
Account deletion can be initiated inside the App and through the publicly available deletion web page. It terminates ordinary account access and optional collection, triggers associated-data deletion/de-identification, and revokes applicable login/push tokens. It does not merely deactivate the account. We may retain the limited legal, tax, transaction and claim records below, explain applicable exceptions and provide retained records where required. Deletion does not erase a lawful debt or authorize cargo abandonment; operational custody is resolved separately. We use reasonable safeguards, restricted access, appropriate encryption and vendor controls, and investigate reported security incidents. No security method is perfect.
The category-specific schedule in Section 7 of the general Privacy Policy applies equally to App data. Raw identifiable GPS remains in active systems for up to 90 days from collection, with only selected evidence kept longer for a specific lawful preservation reason. Necessary shipment milestones are retained separately for 7 years after settlement, rather than keeping the continuous route for that period. Restricted backups may take up to 90 additional days to expire and are excluded from ordinary use; deleted data is not restored to ordinary processing.
Master contract and minimum acceptance evidence follow the relationship-plus-10-year schedule; Load contracts follow the 10-year Load schedule. Transaction and tax records ordinarily follow the 7-year schedule. Raw identity and bank information follow the general Policy's narrower verification/replacement rules. Authorized support recordings and transcripts fall within the support category, with earlier raw-audio deletion when no longer needed. Ordinary diagnostics, security records, privacy requests, communications consent, suppression records and any nonbiometric proof of a biometric release follow their separate categories in that same schedule.
The general schedule does not extend a biometric template's statutory destruction limit or create permission for future collection. Properly de-identified information and non-identifying models may be retained for lawful development while de-identification remains effective. An identifier substitution alone is insufficient; model artifacts that still contain personal information remain subject to applicable rights and retention. We explain relevant retention exceptions when responding to a deletion request.
The App serves adults conducting business, is not directed to children under 18, and does not knowingly collect children’s account information. Report such information for investigation and appropriate deletion. This deployment is designed for United States operations; expansion requiring international transfer safeguards or other regional rights needs assessment before launch. We date and archive notice versions, communicate material changes and obtain new permission for materially different processing when required. An OS update or revised Privacy Policy does not itself expand your consent.
Smart Expedite Inc.
You may request access, correction, deletion, a portable copy, withdrawal of consent or review of your Smart Expedite information through the App, the account-deletion page or Support. Contact support@smartexpedite.com or (331) 300-7200. You do not need an active account or to reinstall the App to contact us.
Identify the requested action and provide your contact and account reference, if any, for proportionate verification. Do not send a Social Security number, full bank account number or identity image in ordinary email. We will explain applicable verification, exceptions, timing and appeal rights. The Privacy Policy describes additional contact details and rights.
