Legal
Privacy Policy
Last updated: September 16, 2026
The short version: we collect personal information to run the platform, we use AI from Anthropic for a few drafting and summarizing features, we share data only with the service providers listed in Section 5, we never sell it, and when you delete a file we actually delete it.
1. Who We Are, and Which Data Is Whose
Fleet Market is a software platform used by equipment dealers, distributors, and manufacturers to run their websites, inventory, rentals, service, events, hiring, and customer communications. This policy covers fleetmarket.us, the Fleet Market dashboards, and the storefronts and embeds we host on our customers’ behalf.
Two different relationships are described in this policy, and the distinction matters for your rights:
- Account data: information about the businesses and people who subscribe to Fleet Market and sign in to our dashboards. Fleet Market decides how this is used, so we are the controller of it.
- Tenant data: information that a dealer, distributor, or manufacturer collects from their own customers, applicants, and site visitors using Fleet Market (contact forms, quote requests, rental bookings, service records, event RSVPs, job applications, marketing contacts). That business is the controller. Fleet Market is the processor: we store and process it on their instructions and do not use it for our own purposes.
If you submitted your information to a dealer, distributor, or manufacturer that uses Fleet Market and you want it accessed, corrected, or deleted, the fastest route is to contact that business directly. You may also contact us at the address in Section 12 and we will route your request to them and assist in fulfilling it.
2. Information We Collect
We do collect personal information. This section lists what we collect and where it comes from.
Information you give us directly
- Account and identity: name, work email address, phone number, business name, job title, role, and the profile photo and biography you choose to publish in a team directory.
- Authentication: your email address and a securely hashed password, plus session tokens. We never store your password in readable form.
- Business and billing: business address, locations, tax registration details, purchase orders, and the billing contact. Card numbers are handled by Stripe and never reach our servers.
- Content you upload: photographs, logos, videos, fonts, brochures and spec sheets, blog posts, and product and inventory listings.
- Support and correspondence: the contents of messages you send us, and messages sent through in-platform chat.
Information collected through our customers’ sites
- Form submissions: contact and quote requests, rental and service bookings, event registrations and RSVPs, and dealer-locator searches, typically name, email, phone, address, and whatever the business asks on its own form.
- Job applications: applicant name, contact details, cover letter, answers to screening questions, and any résumé or CV uploaded. A CV frequently contains a home address, employment history, and education. We treat these as our most sensitive uploads and store them in a private, access-controlled location, never in a publicly readable one.
- Commerce: order, quote, invoice, deposit, and rental-agreement records. Payment card data goes directly to Stripe; we retain only the last four digits, card brand, and Stripe identifiers.
- Marketing consent: whether you opted in to email or text messages, when, from which form, and the policy text in force at that moment. We keep this because it is the evidence that an opt-in happened.
- Equipment records: the machines you own or rent, assembled by the business from your service bookings, purchases, rentals, and quote requests, typically make, model, type, serial number, hour-meter reading, purchase date, warranty expiry, and the dates it was serviced. A business uses this to know what you run and when it is next due for a service. Some of it describes equipment you bought somewhere else, because you told them when you booked a repair.
What a business holds about you is matched into a single customer record using your email address or your phone number, so a service booking made by phone and a quote requested by email can be recognised as the same person. A record can exist with a phone number and no email address. Job applicants also become part of a business’s contact records, but an application is never treated as marketing consent and does not add you to a mailing list.
Information collected automatically
- Log and device data: IP address, browser and device type, operating system, referring page, and timestamps.
- Usage data: pages and listings viewed, features used, and interactions with embeds, used to produce the traffic and lead analytics we show the business whose site you visited. Where you are identified, as described below, these views are also recorded against your customer record with that business.
- Cookies and local storage: see Section 8.
When browsing is linked to you by name
Most browsing on our customers’ storefronts is anonymous and stays that way. There are exactly two ways it becomes linked to you by name, and both are first-party: the information goes to the business whose site you are on, and to nobody else.
- You are signed in to that business’s customer portal. While you are signed in, the pages and listings you view are recorded against your customer record with them.
- You followed a link from an email that business sent you. The link carries a signed token, and following it sets a first-party cookie on that storefront (fm_vid, in Section 8) lasting up to 45 days. While it is set, the pages and listings you view on that storefront are recorded against your customer record with that business.
This only ever works forwards. We do not go back and attach your earlier anonymous browsing to you once you become identified, and we do not follow you between different businesses’ sites, each storefront’s cookie is separate and is readable only by that storefront.
One limitation worth stating plainly: if someone forwards you a marketing email and you follow the link, that browsing is attributed to the person the email was addressed to, because the link is what identifies the reader. For that reason a link click can only ever add browsing activity to a record, it can never change a name, contact details, or equipment on file. If you would rather not be recognised this way, delete that site’s cookies or block them.
We do not run third-party advertising trackers or analytics pixels on Fleet Market storefronts. There is no Google Analytics, Meta Pixel, or comparable ad-tech embedded by us. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We do not knowingly collect Social Security numbers, government identification numbers, precise geolocation, biometric data, health data, or other categories of sensitive personal information, and we ask that you do not submit them through Fleet Market forms.
3. How We Use Information
- To provide the platform: host sites, publish listings, deliver forms and leads to the right business, process orders and rentals, and schedule service.
- To authenticate you, keep accounts secure, detect fraud and abuse, and enforce seat limits and permissions.
- To bill subscriptions and add-ons, and to process payments through Stripe.
- To send transactional messages you asked for: confirmations, invoices, notifications, invitations, and password resets.
- To send marketing messages where you have opted in, and to let our business customers send marketing to contacts who opted in to them. Every marketing message carries an unsubscribe mechanism.
- To provide the AI-assisted features described in Section 4.
- To produce analytics and reporting for the business whose site or dashboard the data belongs to.
- To assemble the customer record a business keeps about its own customers, contact details, the history of quotes, bookings and purchases, the equipment they own, and how they have engaged with messages, and to prompt that business when a machine is due for a service or a warranty is ending.
- To maintain, debug, and improve the platform, and to meet legal, tax, and accounting obligations.
We do not use tenant data to train machine-learning models, and we do not use one customer’s data to benefit another customer except in the explicitly aggregated form described in Section 5.
4. Our Use of Artificial Intelligence
Fleet Market uses AI in parts of the product. We think you are entitled to know exactly where, what gets sent, and what happens to it.
Where AI is used today
- Website copy assistance: generating draft marketing text for a storefront from a short description you provide.
- Product categorization: suggesting which catalog category an inventory listing belongs in, from the listing’s title and specifications.
- Feedback summarization: condensing product demo write-ups and customer survey responses into a short summary and a coarse sentiment label for reporting.
How it works
- Our AI features are provided by Anthropic, PBC, using the Claude models via Anthropic’s API. Anthropic acts as our subprocessor.
- What is sent is limited to the text needed for the specific task: a product description, a listing title, a demo write-up. We do not send payment details, passwords, or uploaded résumés to any AI service.
- Anthropic does not use data submitted through its API to train its models, and content is retained only transiently for the purpose of returning a result and for abuse monitoring.
- AI output is a draft, not a decision. It is presented to a person who can edit, accept, or discard it.
What AI is not used for
- We do not use AI to make automated decisions that produce legal or similarly significant effects about you. In particular, AI does not screen, rank, score, or reject job applicants, and it does not make credit, pricing, or eligibility decisions about individuals.
- We do not use AI to profile individual consumers for advertising.
If we introduce a customer-facing AI assistant or chatbot, we will disclose it clearly at the point of use, so you always know when you are talking to software rather than a person, and it will operate under our published AI safety standards, including trained responses that direct anyone expressing distress or risk of self-harm to appropriate human crisis support. We will update this policy before any such feature launches.
6. Uploads, Deletion, and Retention
When you delete an upload (a photograph, a document, a video, a résumé), we delete the file itself from storage. We do not merely hide it from your dashboard while keeping the file retrievable. Deletion of a record deletes the files attached to it.
Two consequences worth stating plainly. First, deletion is permanent and we cannot recover a deleted file for you. Second, files that were published on a public website may persist outside our control: in search engine caches, in web archives, or on the devices of people who downloaded them. We can delete our copy; we cannot retract copies other people already have.
How long we keep things
- Active accounts: for as long as the account is open and the service is being provided.
- After cancellation: account and site data is retained for 30 days so the account can be reactivated, then deleted. You may ask us to delete it sooner.
- Job applications and résumés: kept while the business hiring is considering the application, and deleted when that business deletes them. Incomplete uploads from applications that were never submitted are purged automatically.
- Financial and tax records: invoices, payments, and transaction records are kept for as long as tax, accounting, and audit law requires, generally seven years, even after an account closes.
- Marketing consent and opt-out records: retained after you unsubscribe, because they are the proof that we honored your opt-out and the record of the consent that preceded it.
- Equipment records: kept for as long as the business keeps the customer record they belong to. Two points of detail, because they are exceptions to “deleted means gone”: when two records turn out to describe the same machine and are merged, the merged-away record is kept rather than erased, so the service visit or purchase it came from can still be traced; and removing a machine marks it removed rather than deleting that history. Both are reversible by the business, and both are deleted with the account.
- Backups: deleted data may persist in encrypted backups for a limited period before those backups age out on their normal cycle.
7. Your Privacy Rights
Depending on where you live, you may have some or all of the following rights. We extend the core of these rights to everyone who asks, regardless of location.
- Know and access: what personal information we hold about you, where it came from, why we process it, and who we share it with, and to receive a copy.
- Correct: have inaccurate personal information fixed.
- Delete: have your personal information erased, subject to the legal retention obligations in Section 6.
- Portability: receive your information in a portable, machine-readable format.
- Opt out: of marketing email and text messages at any time, using the unsubscribe link or reply keyword in any message.
- Limit: restrict or object to certain processing, and withdraw a consent you previously gave.
- Non-discrimination: we will not deny service, charge a different price, or provide a lesser quality of service because you exercised a privacy right.
Because we do not sell personal information or share it for cross-context behavioral advertising, there is nothing to opt out of on that front, but you are entitled to ask us to confirm this, and we will.
To exercise a right, email privacy@fleetmarket.us. We will verify your identity before acting, which normally means confirming control of the email address on the record. We respond within 45 days and will tell you if we need a permitted extension. You may use an authorized agent, with proof of authorization. If we decline a request, we will explain why, and you may appeal by replying to our response; where your state provides one, you may also complain to your attorney general or supervisory authority.
If your information was submitted to a business that uses Fleet Market, we act on that business’s instructions. We will forward your request to them promptly and help them fulfill it.
9. Email and Text Messages
- Transactional messages (order confirmations, invoices, booking reminders, password resets, and account notices) are part of the service and are sent without separate marketing consent.
- Marketing email requires opt-in. Every marketing email includes a one-click unsubscribe.
- Text messages require express written consent tied to the specific number, captured on a form that also collects that number. Message and data rates may apply; frequency varies. Reply STOP to opt out and HELP for help.
- Consent is never a condition of purchase, and we do not make a marketing opt-in mandatory on any form.
- Businesses using Fleet Market to message their own contacts are responsible for having obtained valid consent, and publish their own messaging terms and privacy notice.
10. Security and Data Location
- Data is encrypted in transit with TLS and encrypted at rest.
- Access is controlled by row-level security in the database and by a role and permission model in the application, so each tenant reaches only its own records.
- Files containing personal information (résumés, internal documents, and attachments) are held in private storage reachable only through short-lived signed links issued to authorized users. Publicly readable storage is used only for material intended for publication on a website, such as product photographs and brochures.
- Payment card data is handled by Stripe, a PCI-DSS Level 1 provider, and does not touch our servers.
- Administrative access is limited to staff who need it, and production credentials are held in a managed secret store.
Our infrastructure is located in the United States. If you use Fleet Market from outside the United States, your information will be transferred to and processed there, where privacy laws may differ from those of your country. Where a transfer mechanism is legally required, we rely on Standard Contractual Clauses.
If a breach affects your personal information, we will notify affected customers and, where required, regulators, without undue delay and within the timeframes the applicable law sets.
No system is perfectly secure. We work hard to protect your information but cannot guarantee absolute security. If you believe you have found a vulnerability, please report it to security@fleetmarket.us; we will not pursue legal action against good-faith security research that respects user privacy and avoids service disruption.
11. Children
Fleet Market is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it promptly. A parent or guardian who believes a child has provided us information should contact privacy@fleetmarket.us.
12. Changes and How to Reach Us
We may update this policy. When we do, we will change the date at the top and post the revised policy here. For material changes (new categories of data, a new purpose, or a new category of recipient), we will give notice by email to account holders before the change takes effect. Earlier versions are available on request.
Privacy requests and questions: privacy@fleetmarket.us Security reports: security@fleetmarket.us General support: support@fleetmarket.us Web: fleetmarket.us