Privacy policy

Effective 2026-09-29.

Controller: ALGD LTD, company number NI744090, 121 Glencam Road, Omagh, Tyrone, BT79 7HB, United Kingdom. Data-protection contact: support@brokerdiligence.app.

What we hold

Account details for each brokerage (workspace name, contact email), a login per user (name, email and a scrypt hash of the password — never the password), and the records the workspace creates: loads, diligence snapshots, uploaded evidence files, exports and the log of emails we sent to that workspace.

Evidence files

Screenshots and PDFs are uploaded by the workspace's own users. They can contain personal data (a name on a carrier record, a signature on a certificate of insurance). The workspace is the controller of that content and decides what is uploaded and how long it is kept; we are the processor and store the bytes under their SHA-256 on an encrypted-at-rest volume.

Optional FMCSA lookup

If an FMCSA L&I webkey is set up, the load page can look the carrier up in the FMCSA's public register and prefill the form. The request goes from our server to the FMCSA service and includes the DOT number being looked up; no data about your workspace is sent. Where no key is set up, no such request is made.

Where it lives

On servers provided by Fly.io (US region, iad) with the database, the evidence files and the stored exports on an encrypted-at-rest volume. Payment details are held by Stripe, Inc. — cards are never stored by us. Outbound email is sent through Amazon SES.

Cookies

One cookie: a session cookie (HttpOnly, SameSite=Lax) that keeps a signed-in user signed in. No analytics, no advertising trackers, no third-party embeds.

Retention and your rights

Records are kept while the workspace's account is open and deleted on request 30 days after cancellation. A workspace's users can export everything at any time. Data subjects can write to support@brokerdiligence.app to exercise access, correction or deletion rights; we hand requests that concern a workspace's records to that workspace.