Customer Data Processing Agreement

Version 2026-10-04

DRAFT - pending counsel; not in force.

This agreement is between the organization that accepts the Terms of Service (the "customer") and RC Studios, {{COMPANY_LEGAL_NAME}}, a {{COMPANY_ENTITY_TYPE}} organized in {{COMPANY_STATE}}, with its address at {{COMPANY_ADDRESS}} ("RC Studios"), the company that operates Fleetie (https://fleetie.si). It is part of the Terms of Service and applies to the personal information RC Studios handles for the customer. Counsel has not reviewed this draft and it creates no obligation for anyone. It is not legal advice. Items in double braces are placeholders for facts the business still has to supply.

Roles and scope

DRAFT - pending counsel.

• The customer decides what customer data it puts into the service and why. For personal information in that data, the customer is the controller (or business) and RC Studios is the processor (or service provider). [Counsel: confirm the roles and the law that applies in each region, such as California and the European Union.]
• RC Studios processes customer data only to run, secure and support the service for the customer, and on the customer's documented instructions: the settings and actions its members take in the service, and written requests to RC Studios.
• RC Studios is the controller of account and security information it keeps for its own purposes, such as sign-in and abuse prevention, as the Privacy Notice describes.

Data the service stores

DRAFT - pending counsel.

• People: work email address, password hash, email verification status, role and organization membership, sign-in sessions, and the version of each legal document an account accepted.
• Freight records: loads, appointments, bookings, rates and rate cards, invoices, accessorial charges, settlement and driver pay records, fuel transactions, and EDI interchanges and trading partners.
• Fleet and compliance: drivers, power units, trailers, maintenance records, compliance credentials and insurance details.
• Driver phone data: position points (latitude, longitude, accuracy, speed, heading and the load they belong to) while the driver is on duty with an active assignment, proof of delivery and photo captures, and the phone's push notification token.
• Documents: PDF, PNG and JPEG files up to 6 MiB, stored in the service's database, and the fields the document intake proposes from them and a reviewer confirms or rejects.
• Integration records: the customer's connections to its own telematics and load board providers, with the credentials its members supply stored sealed (encrypted) and destroyed when revoked.
• Logs: account, API, export and agent audit logs, and sign-in throttling records.
• The service is not designed to hold card or bank account numbers, and payment rails are switched off. [Engineering: confirm nothing stores them.]
• Categories of people: the customer's staff and members, its drivers, and contacts at the customer's own shippers, carriers and brokers who appear in the records.

Subprocessors

DRAFT - pending counsel.

• Fly.io: hosts the web application, background workers, carrier application and managed Postgres database. Region: San Jose, California, United States. Receives all customer data. [Business: confirm the legal name of the Fly.io contracting entity and its data processing terms.]
• Resend: delivers account emails (email verification, password reset and invitations). Receives the recipient's email address, the message text and a one-time link. [Engineering: the code at the time of writing has an email sending port with a disabled setting and a staging capture setting, and no Resend adapter; confirm Resend is the production provider before this document goes in force.]
• AI model node for document intake: automatic extraction sends the document bytes to the node the operator configures when there is no readable text layer. User-requested re-extraction (Re-run extraction) also sends the document bytes, including documents with a readable text layer. In both cases the answer is only a proposal that a member of the owning organization confirms. [Business: unknown at the time of writing - name the host and provider of this node, or state that it runs on Fly.io.]
• Error collection: unhandled errors may go to an operator-provided HTTPS error collector. [Business: unknown at the time of writing - name the service, or state that errors stay in application logs.]
• Providers the customer connects itself (for example Samsara, Motive or a load board): they act for the customer with the customer's credentials, and are not RC Studios' subprocessors.
• RC Studios gives the customer notice of {{SUBPROCESSOR_NOTICE_DAYS}} days before adding or replacing a subprocessor, and the customer may object on reasonable grounds. [Counsel: objection and remedy wording.]
• RC Studios stays responsible for each subprocessor's handling of customer data and binds it to terms no less protective than these.

Security

DRAFT - pending counsel.

• Each organization's records are separated from every other organization's at the database, and a member sees only what their role allows.
• Credentials for integrations are stored sealed, and session handles are stored only as hashes.
• Access to customer data by RC Studios staff is limited to those who need it and is logged. [Engineering: confirm before this document goes in force.]
• RC Studios notifies the customer within {{INCIDENT_NOTICE_HOURS}} of confirming a security incident affecting its customer data, with what is known and what the customer should do.

Assisting the customer

DRAFT - pending counsel.

• RC Studios helps the customer answer requests from people to access, correct, export or delete their personal information, using the export pages in the service or on written request to {{PRIVACY_CONTACT}}. A person who contacts RC Studios directly about customer data is referred to the customer.
• RC Studios helps the customer with impact assessments and regulator enquiries about the service, to the extent the law requires. [Counsel: cost and scope.]

Retention, return and deletion

DRAFT - pending counsel.

• Driver position points are deleted automatically after 720 hours (30 days). [Business: confirm the automatic deletion is switched on in production before this document goes in force.]
• Documents and freight records are kept while the customer uses the service. [Counsel and business: retention period per type.] A document under a legal or dispute hold is kept until the hold is released.
• When the terms end, the customer's owners can export the customer's data for {{EXPORT_WINDOW_DAYS}} days. After that RC Studios deletes or de-identifies it, except what the law or an open hold requires it to keep, and deletes it from backups as they expire. [Engineering: confirm the backup expiry period.]

Transfers

DRAFT - pending counsel.

• Customer data is hosted in the United States. Where the customer is in a region that restricts transfers, the parties rely on the safeguard counsel selects. [Counsel: transfer mechanism, such as standard contractual clauses.]

Audits

DRAFT - pending counsel.

• RC Studios gives the customer the information needed to show it follows this agreement, and allows an audit no more than once a year on reasonable notice, subject to confidentiality. [Counsel: scope and cost.]

Liability and order of precedence

DRAFT - pending counsel.

• The limits in the Terms of Service apply to this agreement. [Counsel: whether data protection claims have a separate cap.]
• If this agreement and the Terms of Service differ on the handling of personal information, this agreement wins.

Contact

DRAFT - pending counsel.

• Questions and notices under this agreement go to {{PRIVACY_CONTACT}}.