Privacy Policy

1.Scope and who is responsible

The controller is Best Friend Transport LLC, a limited liability company organized under the laws of the State of New Jersey, with its address at 503 Garfield Ave, Apt 601, Jersey City, NJ 07305, USDOT 4241168, MC 1642448, EIN 99-3027667.

Our affiliate Jobe Kemba Transport LLC issues invoices and runs loads from the same platform. Where a load or invoice belongs to the affiliate, both entities act as joint controllers for that transaction and this policy applies equally.

Covered surfaces

• Web dashboard (https://app.bestfriendtransport.com): load management, live fleet, finance, driver settlements, CRM, human resources, tasks, and conversations.
• Tow365 mobile app (iOS and Android): assigned trips, navigation, pickup and delivery confirmation, photo evidence, Bill of Lading signature, chat and calls with dispatch.
• Documents and emails generated by the platform: quotes, invoices, cash receipts, Bills of Lading, Proof of Delivery, settlements, and commercial email campaigns.
• Public pages of this site, including these legal documents and the account deletion page.

This policy does not cover third-party sites or services you may reach from our documents or emails, which are governed by their own policies.

2.Our two roles: controller and processor

We handle information in two different capacities, and that changes who you should address a request to:

• As controller: for data about our drivers, employees, internal users, direct customers, brokers, vendors, and commercial prospects. We decide what it is used for.
• As processor: when a broker or customer gives us third-party data (for example, the consignee's name and phone number, or the vessel owner's address) so that we can perform the transport. In that case we handle the data on the instructions of whoever hired the service, and that third party should first direct requests to the company that asked for the data.

If you write to us and we turn out to be a processor, we will tell you and point you to the responsible company, while still handling anything that is within our reach.

3.Categories of information we handle

We only handle the categories the operation needs. We do not request or store credit card data in the platform.

a) Account and access (all users)

• Name, email address, phone number, and password (stored irreversibly by the authentication provider; we never see your password in plain text).
• Role, per-module permission matrix, and assigned company.
• Activity markers: last sign-in, online presence, account creation and last modification dates.
• Device push notification tokens (web and mobile) so we can alert you about loads, messages, and calls.

b) Drivers and personnel (employment)

• Driver's license (CDL) number and expiration date, plus supporting documentation.
• Onboarding documents uploaded to the platform: license, insurance, equipment registration, and Form W-9.
• Social Security Number (SSN) or EIN where the driver or owner-operator is a contractor and a W-9 or 1099 must be issued.
• Payroll and settlement data: per-load pay, advances, deductions, loans, adjustments, absences, withdrawals, and supporting documents.
• Operational performance evidence: pickup and delivery confirmations, ETAs, miles driven, assigned supply inventory.

c) Operations and loads

• Pickup and delivery addresses, contact names and phone numbers at origin and destination, dates and service windows.
• Description of the transported unit: year, make, model, VIN or serial (HIN) number, dimensions, weight, condition, and temporary plates.
• Prices, adjustments, route expenses (fuel, DEF, tolls, parking, escorts), load profitability, and invoicing status.
• Reference identifiers such as the broker order number and the invoice number.

d) Precise geolocation (drivers)

• Latitude and longitude of the driver's device during an active trip, captured roughly every 50 meters of movement or every 60 seconds, including while the app runs in the background.
• Coordinates at the exact moment pickup and delivery are confirmed.
• Remaining distance, remaining duration, and ETA computed along the route.
• Last known position and online status while the session is open, so we know which drivers are available.
• When the load closes, the route is archived alongside the trip record as tracking history and deleted from the real-time channel.

e) Media evidence and signatures

• Photos and videos of the unit at pickup and delivery, including any ambient audio captured in the video.
• Handwritten signatures captured on screen (shipper, receiver, and driver) on the Bill of Lading, and the resulting signed PDF.
• Boat inspection reports and supporting documents (rate confirmation, payment proofs, temporary plate receipts).
• File metadata: name, type, size, who uploaded it, and when.

f) Communications

• Chat messages between dispatch and driver, including voice notes, images, and location voluntarily shared in the chat.
• Metadata for in-app voice calls: who called whom, when, duration, and outcome. Call audio is not recorded or stored — the conversation travels directly between the two devices.
• Emails the platform sends on the Company's behalf (quotes, invoices, POD, campaigns) and their delivery log.

g) Customers, brokers, vendors, and prospects

• Legal name, contact name, email, phone, address, website, MC and DOT numbers, payment terms, and VIP status.
• Tax information needed to invoice and to issue information returns (W-9 EIN or SSN).
• Commercial prospects (leads) with their source, funnel stage, estimated value, logged activities, and loss reason.
• Leads from Facebook and Instagram ad forms, where the person completed and submitted those forms.
• Delivery events for our commercial email: delivered, opened, clicked, bounced, and spam complaint.

h) Operational credential vault

The platform includes a vault where administration stores the Company's credentials for external portals (for example, broker or permit portals). Those credentials are encrypted with AES-256-GCM and the key lives in a secret manager the client application cannot access. Every time someone reveals a credential we log who did it and when. This vault is for corporate credentials, not personal passwords.

i) Device technical data

• Device type, operating system, app version, language, and time zone.
• IP address and access and error logs generated by our servers and by the infrastructure services we use, for security and troubleshooting.

4.Where the information comes from

• Directly from you: when you use the app or dashboard, upload documents, sign a BOL, write to us, or complete a contact or ad form.
• From your employer or fleet administrator: driver and internal staff accounts are created by Company administration; there is no self-registration.
• From customers and brokers: when they send us a transport order or rate confirmation containing shipper, consignee, or unit owner information.
• From your device, with your operating system permission: location, camera, photo library, microphone, and notifications.
• From ad platforms (Meta), when you submit a contact form inside Facebook or Instagram.
• From public or commercial transportation-industry sources, for B2B prospecting (for example, MC/DOT listings).
• Generated by the system: route calculations, ETAs, profitability, receipt numbering, audit and access logs.

5.How we use the information

6.Sensitive data and consent

The NJDPA classifies certain categories as sensitive data and requires your prior consent to process them. In our operation those categories are:

• Precise geolocation: the driver's location during an active trip. It is processed based on the consent you give in your phone's operating system when granting the location permission — including background location — and on the written notice described in the next section. You may revoke it at any time in your device settings; if you do, the app cannot report your position and the operation may require another way to coordinate the trip.
• Social Security Number: collected only where indispensable to issue a W-9 or 1099, with access restricted to administration and finance staff.
• Health-related information: if you upload a DOT medical certificate or documentation of a regulatory examination, that document is stored with restricted access and used solely to evidence regulatory compliance.
• Biometric data: we do not capture fingerprints, facial recognition, or biometric templates. Handwritten BOL signatures are treated as electronic signatures, not biometric data, and are used only to evidence delivery.

We do not knowingly process sensitive data beyond the above. Please do not include health information, racial or ethnic origin, religion, sexual orientation, union membership, immigration status, or children's data in chats, load notes, or documents you upload.

7.Driver real-time location — specific notice

When location is recorded

• It starts when the driver confirms pickup of a load and the trip begins.
• It stops when the driver confirms delivery, when the load is cancelled, or when the driver stops tracking from the app. On Android, while tracking is active the system shows a persistent notification so it is obvious that it is running.
• Outside an active trip we keep only the last known position tied to online presence, so dispatch knows which driver to offer the next load to. We do not build a continuous record of your day outside the trip.
• The driver may revoke the location permission in the operating system settings or sign out at any time.

What we do with that location

• Show the trip position to the dispatch team and compute the ETA communicated to the customer.
• Evidence where and when pickup and delivery were confirmed, which protects both the driver and the customer in a claim.
• Estimate miles and times for load settlement and fleet management.
• Safety: locate a unit in case of an incident, theft, or roadside emergency.

Who can see it

Only internal staff with permission over the live fleet and operations modules, and only within the company that owns the load. Customers and brokers are told the status and ETA of their load; they are not given the point-by-point route unless it is needed to handle a claim or an authority requires it.

8.Chat, calls, notifications, and commercial email

Chat with dispatch

Messages between dispatch and driver are work messages, not private ones: they are tied to the conversation and to the load, and authorized staff may read them, including after the conversation is closed. You may attach images and voice notes and share your location; all of that is stored just like text.

In-app voice calls

Calls are established directly between the two devices. We do not record or store the audio. We do keep the call record (who, when, duration, and whether it was answered) as part of the operational history.

Push notifications

We send operational alerts: new load assigned, new message, incoming call, reminders, and collection or task alerts. You can turn them off in your operating system settings, but you will miss alerts you need in order to work. We do not use notifications for third-party advertising.

Commercial email and campaigns

• We send commercial communications only to business contacts and B2B prospects, always identifying the sender and offering a clear way to unsubscribe, in line with the CAN-SPAM Act.
• We measure delivery, opens, clicks, bounces, and spam complaints in order to clean our lists and stop contacting people who do not want to hear from us.
• Operational and transactional email — quotes, invoices, POD, collection notices, password resets — is not advertising and is sent while the business relationship exists, even if you unsubscribed from marketing.
• If we call or text you, we do so within the business relationship and applicable law (TCPA); you can ask us to stop.

9.Cookies and on-device storage

The platform is a work tool, not an ad-supported site. We use no advertising cookies, no third-party tracking pixels, and no behavioral analytics inside the authenticated application. We only use strictly necessary storage:

Because we do not run targeted advertising or sell data, there is nothing to opt out of through opt-out signals. We nonetheless honor recognized privacy preference signals, such as Global Privacy Control, on the public pages of this site.

10.Who we share information with

We share information only with those who need it, and only for the purposes described above:

• Customers, brokers, and shippers: load status, ETA, transport documents, POD, delivery photos, and the signed BOL, to evidence the service and be able to bill for it.
• Subcontracted carriers and owner-operators: the load data and pickup and delivery contacts needed to perform the trip.
• Consignees and origin and destination contacts: driver name, estimated window, and contact details for coordination.
• Insurers, adjusters, and surveyors: when there is a damage claim or a loss.
• Factoring companies and financial institutions: invoices and supporting documents when we assign or finance a receivable.
• Professional advisors: accountants, auditors, and attorneys, under a duty of confidentiality.
• Authorities and regulators: FMCSA, the Department of Transportation, tax authorities, police, and courts, where required by law, court order, or a legitimate investigation, or to protect life and safety.
• Service providers (subprocessors): those listed in the next section, which process data on our behalf and under contract.
• In a corporate transaction: if we sell or merge the business, information may be transferred to the acquirer, which becomes subject to commitments equivalent to this policy.

We never share Social Security Numbers, payroll data, or employment documents with customers or brokers.

11.Service providers we use

These providers process information on our behalf, limited to the stated purpose. None is authorized to use your data for its own commercial purposes.

Use of maps and routing inside the platform is additionally subject to Google's Terms of Service and Google's Privacy Policy.

12.We do not sell data or run targeted advertising

In the twelve months preceding the date of this policy, and as a standing practice:

• We did not sell personal information for money or other valuable consideration.
• We did not share personal information for targeted advertising within the meaning of the NJDPA.
• We do not profile individuals through automated decisions producing legal or similarly significant effects. Decisions about load assignment, rates, hiring, or claims are made by a person.
• We do not sell sensitive data or the data of individuals under 18.

Our own advertising (for example, Facebook or Instagram ads to attract transport customers) targets audiences defined by those platforms; we do not hand them driver, employee, or customer data to build audiences.

13.How long we keep information

We keep each category for as long as the purpose justifying it requires and, afterwards, for the period the law imposes. The periods below are minimums: we may extend them where a claim, audit, investigation, or litigation is pending.

When data is no longer needed, we delete it or de-identify it, so the operational or accounting record survives without identifying anyone.

14.Information security

We apply technical and organizational measures that are reasonable and appropriate to the risk and volume of the data we handle:

• Encryption in transit with TLS on all connections, and encryption at rest in the storage infrastructure.
• Role-based access control driven by a per-module, per-action permission matrix, enforced both in the interface and by server-side rules. Each user sees only the data of the company they belong to.
• Dedicated AES-256-GCM encryption for external portal credentials, with the key in a secret manager and a log of every reveal.
• Traceability of sensitive operations: every reveal of a vault credential is logged with its author and timestamp; every document records who uploaded it and when; and server functions leave execution logs.
• Immutable financial documents: invoices and receipts are never deleted; they are voided, leaving the full trail, with a voiding voucher linked to the original.
• Least-privilege access for staff, access reviews, and immediate revocation when the relationship ends.
• Backups, environment separation, and controlled deployments.

15.Your rights under New Jersey law

If you are a New Jersey resident, the NJDPA grants you the following rights over your personal information:

Exercising these rights is free and does not affect your employment or business relationship with us.

16.How to exercise your rights, and what happens next

How to request

• Write to gerenciafabianbf@gmail.com stating which right you want to exercise and over what information.
• Or by postal mail to Best Friend Transport LLC, 503 Garfield Ave, Apt 601, Jersey City, NJ 07305, marked "Privacy Request".
• If you only want your driver account deleted, the procedure is detailed in Account and data deletion.

Identity verification

To protect your information, we need to reasonably verify the request is yours. Writing from the email address tied to your account is normally enough. Where it is not, we may ask for additional data we already hold; we will not use that information for any other purpose. If a third party acts on your behalf, we will ask for proof of authorization. If we cannot verify you, we will explain why in writing.

Timelines

• We respond within 45 days of receiving the request.
• We may extend that period by a further 45 days where the request is complex or there are several, telling you before the deadline and explaining why.
• We handle up to two free requests per person every twelve months; a manifestly unfounded or excessive request may be refused or carry a reasonable fee, always with an explanation.

When we may not delete

Some information cannot be deleted on request, because the law requires us to keep it or because we need it for an overriding legitimate purpose. In particular:

• Transportation records, Bills of Lading, delivery evidence, and claim files, under federal transportation regulation and potential cargo liability.
• Invoices, receipts, settlements, and accounting and tax records.
• Payroll and employment documentation, under New Jersey and federal labor obligations.
• Information needed to prevent fraud, ensure security, or comply with a legal obligation, and to exercise or defend rights in a proceeding.

In those cases we delete what can be deleted, de-link your personal contact data from the record that must survive, and explain in writing what was retained and why.

Appeal

If we deny your request, you may appeal by replying to our communication or writing to gerenciafabianbf@gmail.com with the subject "Privacy Appeal", within a reasonable time. We will review the decision and reply in writing, with reasons, within 60 days. If we maintain the denial, we will tell you how to file a complaint with the New Jersey Division of Consumer Affairs or the Office of the New Jersey Attorney General, which enforces the NJDPA.

17.Residents of other states and outside the United States

We operate throughout the United States, so we also observe the state privacy laws that may apply (among others, those of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and Delaware). As a practical matter, we extend the same rights and the same procedure described above to anyone, regardless of where they live.

If you are a California resident, note additionally that: we do not sell or share personal information within the meaning of the CCPA; we do not discriminate for exercising rights; you may designate an authorized agent; and for employee and contractor information the employment sections of this policy apply.

Our servers and our staff are in the United States. If you write to us from another country, your information will be processed in the United States, whose data protection rules may differ from those of your jurisdiction.

18.Notice for drivers, employees, and applicants

If you work with us as an employee, driver, or independent contractor, the following clarifications also apply:

• Platform accounts are work accounts. Everything you do in them — messages, photos, confirmations, notes, in-trip location — is Company information and may be reviewed by authorized staff for operational, safety, settlement, or compliance purposes. Do not expect personal privacy in the use of a work account.
• Location tracking is limited to active trips, as described in section 6, and responds to the written notice required by N.J.S.A. 34:6B-22.
• Photo evidence at pickup and delivery is mandatory and protects the driver against damage claims that are not theirs.
• Your SSN or EIN is used exclusively for payroll, tax forms, and onboarding verification.
• If you apply and we do not hire you, we keep your application for the period the law requires and then delete or de-identify it.
• If you use your own phone for work (BYOD), we only handle the data the app generates: we do not access your personal photos, contacts, messages, or your activity in other applications.

19.Children

The platform is a work tool intended for people 18 years of age or older. We do not direct it to children, we do not knowingly collect information from children under 13, and we do not process the data of individuals aged 13 to 17 for targeted advertising or sale. If we find we have received a child's information without a legal basis, we delete it. If you believe a child sent us information, write to gerenciafabianbf@gmail.com and we will delete it.

20.Account and data deletion

You may request deletion of your account and personal data at any time. The procedure, what is deleted, what is retained by legal obligation, and the timelines are detailed in Account and data deletion.

Platform accounts are administered by the Company: when the employment or business relationship ends, access is disabled immediately even though operational and accounting records continue to be retained under section 11.

21.Third-party services and links

The platform integrates third-party maps, email, and forms, and our documents may contain links to sites we do not control (broker portals, marinas, ports, payment providers). We are not responsible for the content or privacy practices of those third parties; we recommend reviewing their policies before giving them information.

Our customers pay by bank transfer, check, or third-party payment apps. We do not process or store card numbers or banking credentials in the platform; that information stays with the financial institution or payment app you use.

22.Changes to this policy

We may update this policy when our practices, technology, or the law change. We will publish the new version at this same address, with its version number and effective date.

• If the change is material — for example, a new purpose incompatible with the original one, or processing an additional sensitive category — we will give reasonable advance notice by email or through an in-platform notice and, where the law requires it, ask for your consent.
• Minor or drafting changes take effect on publication.
• We keep prior versions; if you need the one in force on a given date, ask us for it.

23.How to contact us

• Privacy matters and rights requests: gerenciafabianbf@gmail.com
• General and operational matters: bfriendtransport@gmail.com · bfpoweronly@gmail.com
• Phone: +1 (954) 899-9436
• Address: Best Friend Transport LLC, 503 Garfield Ave, Apt 601, Jersey City, NJ 07305, USA
• Identifiers: USDOT 4241168 · MC 1642448 · EIN 99-3027667

Related documents: Terms and Conditions of service and Platform Terms of Use.