Privacy

Policy version

This privacy policy is the version of 2026-10-17. The notice before upload names the applicable notice version and the Terms of Service version.

Who runs this

RoadsideProof is run by SOV17 LLC, Yerevan, Armenia. For anything about your data — a copy, a correction, deletion — write to support@roadsideproof.app. We answer within five days.

What we hold, and only that

The free lookup needs a USDOT number, with no account, password or email address. Opt-in alerts also need your email address, the USDOT numbers you select, your consent and delivery records. We keep the address while the alerts are active.

If you start a case, before or after payment, we hold the documents you upload — usually an inspection report and, if there was one, a citation — the page images and text made from them, the fields read from them, comparison fields for the selected claim, and your confirmations and corrections. The field set depends on the claim.

Case metadata includes the USDOT number, selected claim, access-link capability, expiry, revision and notice-acceptance records. We also store a plain SHA-256 fingerprint of each document to associate it with its evidence slot. Someone with a known file and access to this fingerprint can match them; it is not an anonymous identifier.

Payment references, transaction and event identifiers, amounts, currencies and payment, refund and dispute status are stored separately to reconcile purchases. These records can remain after the case expires; case deletion does not erase them.

Public FMCSA contact data used for outreach is held separately from case documents. Current and experiment-pinned contact snapshots remain until they can be pruned; they do not share the case's deletion clock. Suppression records prevent further outreach.

If you choose to track a Request for Data Review you filed yourself, we keep a separate tracker link, your email address, USDOT number, inspection report number, the dates you enter, and reminder records. The tracker holds no documents, page images, other values read from your documents, or confirmations.

Those documents name other people: a driver, sometimes an officer. Upload only records of your own operation.

What we never ask for

We never ask for your FMCSA Portal, DataQs or Login.gov credentials, and we never file a Request for Data Review on your behalf. The certification on that filing is signed under 18 U.S.C. 1001 by the person filing it, and that person is you.

We do not sell your data, and we do not share it with insurers, brokers or anyone assessing you.

Who else sees any of it

Google Cloud hosts the servers this runs on.

To read a page of a document we send its image to Gemini on Vertex AI, Google's AI service, configured for the United States multi-region endpoint. Outside our own servers, only Google and the sub-processors it lists can see the pages you upload.

The image itself may contain personal data printed on the document, including names and identifiers. We do not attach account or payment metadata to the image. Google's terms bar it from using this data to train its models without our permission, and we have not given it. Google uses sub-processors of its own, listed on its site.

Payment, when you buy the paid check, is handled by Paddle as the merchant of record. Your card details reach Paddle and never reach us.

Email delivery involves our configured mail relay and your mailbox provider. They receive the destination address and message; their own retention applies.

How long each thing lives

Your files, the page images made from them, and the values held for the paid check are deleted 14 days after upload. Deletion is automatic, and uploading the same file again does not extend it.

The case page and your confirmations expire on the same clock, no later than 14 days after your first upload.

If you start a tracker, its separate copy of the inspection report number remains with the tracker after the paid case expires. The tracker and its records are deleted automatically 30 days after the final decision date you enter, or 180 days after you start tracking if no final stage is reached. Using the stop link deletes the tracker immediately.

If you separately opt in to early inspection comparison, we keep that report and its confirmed comparison values in live storage for up to 90 days from your consent, delete them sooner after comparison and a queued alert or your private-link deletion request, and apply the existing backup and email-queue retention separately.

A free report link opens for 30 days.

These are our clocks. When a photographed page is read by Google (see who else sees your data), Google keeps its own clock under its own terms. Its published policy describes in-memory and, for supported models, durable caching, each for up to 24 hours. Project settings control caching. Requests flagged for abuse review may be kept for up to 90 days. These provider periods are separate from our live-data deletion clock.

The configured daily data-disk snapshots have a separate 14-day retention. Document content in them is encrypted, with the document key kept on a separate disk. A snapshot taken just before live deletion can therefore retain that encrypted content for about 28 days from upload. This is not a maximum for all records. Backups and database transaction logs can retain case metadata, including the plain document fingerprint, after live deletion. Their own retention and any recovery copies are separate from link expiry.

Technical access and error logs are separate from your case. The ingress is configured to remove request URLs and headers, including case-link secrets, before logging. Method, status, duration and network address can remain. Their retention follows the hosting log configuration; deleting a case does not delete these logs.

Operational records track readings, refusals and service behaviour without document content. Reading-episode records have a configured 180-day ceiling. Aggregate counts and experiment decisions may remain indefinitely; they do not share the case's deletion clock.

Where it happens

Our hosting is configured for the United States, and the Google reader is configured for the United States multi-region endpoint. This describes the configured processing location, not a claim of zero provider retention.

How it is protected

Documents and the values read from them are encrypted while we hold them. Document contents are excluded from application logs; technical diagnostics and operational records are separate from the encrypted documents.

The renderer that opens the uploaded file and makes page images has no network access. On a hosted-reading deployment, a separate reader sends those images over the network to the AI service described above.

Cookies

When you choose a light or dark theme, we store your choice in the rp_theme preference cookie for one year. It is shared by roadsideproof.app and app.roadsideproof.app. You can change it with the theme button or remove it in your browser. Without a saved preference, the site follows your device’s colour setting.

We set two cookies, and they are not used for tracking. rp_theme=light|dark is set only when you press the theme button and stores only the theme preference. rp_checkout_refresh is set on app.roadsideproof.app when the checkout page opens and expires after 60 seconds. It holds a random value that we never read and that grants no access; it only makes your browser load your request page again, rather than show a saved copy, when you return to it after paying.

What you can ask for

Write to support@roadsideproof.app for a copy of what we hold about you, a correction, or deletion before the clock runs out. We answer within five days.

Each tracker reminder has a one-click stop link. You can also stop from the tracker page. Stopping deletes the tracker, its email destination and its reminder records immediately.

Alert emails carry an unsubscribe link, and one click is enough. We keep the address you unsubscribed on, in a form we cannot read back, as a suppression record so that we do not send further alerts or outreach. This does not cancel tracker reminders; use the tracker stop link for those. It does not stop purchase receipts or replies to support requests.

If something goes wrong

If personal data leaks from our systems, we immediately publish an announcement and report it at the same time to the Police of the Republic of Armenia and the Armenian data-protection authority.

We tell the carrier whose documents were involved directly and without delay, at the address we have for the carrier.

Where the state law that applies to an affected person gives additional notice rights or deadlines, we follow that law for that person. No deadline in one state waits for another.

A written incident procedure stands behind this response.

What this page is not

Nothing here is legal advice, and nothing here says what your filing will achieve. The state that issued the record decides, and the burden of showing it is wrong is yours.