BorderHOS privacy policy
Last updated 24 October 2026
The short version
- What we collect. For a free check: your email address, the consent wording you saw, your IP address and browser type at sign-up, and whether you opened the sign-in link. We do not store the hours you type into a check. If you subscribe: billing details, with card numbers held by Stripe, not us. If you connect an ELD: driver first names, last initials and hours-of-service snapshots, with your authorization.
- Who gets it. The providers that run the site, database, email, payments and analytics, named in section 4. We never sell personal information or share it for advertising.
- Why. To send your sign-in link, run your checks, bill you, keep the service secure and meet our legal obligations.
- The risks. Your information is stored in the United States, where US courts, law enforcement and national security authorities could access it under US law. No system is perfectly secure. We keep what we hold small and short-lived to limit the harm if something goes wrong.
1. Who we are and who is responsible
BorderHOS is run by CVORReady Inc., 1 Brock St. West, Uxbridge, ON L9P 1P6, Canada ("we", "us", "our"). This policy covers borderhos.com and everything we offer under the BorderHOS name.
The person accountable for how we handle personal information, and the person in charge of the protection of personal information under Quebec law, is the Privacy Officer, CVORReady Inc., reached through the contact form at borderhos.com/contact. Mark your message "Privacy".
This policy is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's private-sector privacy law, and we apply the same practices to everyone, wherever they are.
2. What we collect and when
2.1 When you request a free check. We store your email address, the time you gave it, the exact consent wording shown beside the field, your IP address and browser user agent at that moment, whether you opened the sign-in link, and how many free checks that address has used and when. We also store a hashed one-time sign-in token that stops working after 30 minutes or one use. We do not store the hours, drivers, trips or anything else you type into the check.
2.2 When you use the contact form. Your name, email address and message, delivered through Formspree.
2.3 When you subscribe. Stripe collects and holds your card details; we never see them. We store your Stripe customer ID, plan, subscription status, billing country and tax status, company name and billing email, to run your account, charge the right tax and send receipts.
2.4 If you connect an ELD. With your authorization we receive driver first names and last initials (full names only if you turn that on) and hours-of-service snapshots for the drivers you check. Your ELD credentials are stored encrypted and deleted the moment you disconnect. Snapshots are used to run the check and not kept afterwards unless you save a result. We handle driver information on your instructions as the carrier.
2.5 The one cookie and technical data. When you open a sign-in link we set one cookie that keeps you signed in for up to 30 days. It is http-only, so scripts on the page cannot read it, and holds only a session reference. We use no advertising, tracking or social-media cookies. Like any web host, our hosting provider may keep short-term technical logs of requests to the site.
2.6 Analytics. When we measure site traffic we use Plausible, an analytics service in the European Union that counts page views without cookies and without storing anything that identifies you. If we ever change that approach, we will update this policy first.
We collect nothing else and buy no data about you.
3. Why we use it, and on what basis
- With your consent. Given when you type your email address and ask for a sign-in link, when you connect an ELD, and separately if you ever ask for marketing email. You can withdraw consent at any time (section 8); if we need that consent to provide the service, we will tell you what stops working.
- To provide the service you asked for. Sending the link, running checks, billing and answering your messages.
- To keep the service secure. The IP address, user agent and consent record let us spot abuse of the free check and show what you agreed to.
- To meet legal obligations. Tax and accounting records, records of consent and records of any security breach.
We do not use personal information to build profiles, make automated decisions about people, or market to drivers.
4. Who we share it with
Only the providers we need to run BorderHOS, only for the purposes above, each bound by contract to protect your information and use it only for us.
| Provider | What it does for us | Where |
|---|---|---|
| Replit | Hosts the site and application | United States |
| Neon (through Replit) | Runs the database | United States |
| Formspree | Delivers contact-form messages and sign-in emails | United States |
| Stripe | Processes payments and holds card details | United States and Canada |
| Plausible | Counts page views without cookies (planned) | European Union |
| Your ELD provider | Sends us hours data when you connect an ELD | Depends on the provider |
We may also disclose personal information when the law requires it, such as to comply with a court order, subpoena or lawful request from a government authority, or to protect someone's safety.
We do not sell personal information and do not share it for advertising, and we never have.
5. Where your data is stored
Our servers and most of our providers are in the United States, outside Canada and outside Quebec. While your information is there it is subject to US law and may be accessed by US courts, law enforcement and national security authorities. Our contracts require each provider to protect it to a standard comparable to Canadian law, but no contract overrides another country's laws. Canadian hosting is not available today.
6. How long we keep it
| What | How long |
|---|---|
| Free-check sign-up record (email, consent record, IP, user agent, link status, check count) | 90 days after the last activity on that address |
| Sign-in token | Stops working after 30 minutes or one use; deleted with the sign-up record |
| Session cookie | Up to 30 days, or until you sign out |
| Contact-form messages | 12 months |
| Account and billing records | Life of the account plus 30 days |
| Tax and accounting records | Six years from the end of the tax year, as Canadian tax law requires |
| ELD credentials | Deleted when you disconnect |
| ELD snapshots and driver details | Not kept beyond the check unless you save a result, then life of the account plus 30 days |
| Marketing consent (if you ever give it) | While we send you marketing email, plus a short period to show consent was given |
| Records of any security breach | 24 months, as PIPEDA requires |
Deleted records may remain in our providers' backups for a short time until those backups rotate. We do not restore deleted records from backups except to recover from a failure.
7. How we protect it
- Sign-in tokens are stored only as a hash. The usable token exists only in the emailed link, works once and stops working after 30 minutes. There are no passwords to steal.
- The session cookie is http-only and limited to 30 days.
- ELD credentials are encrypted while stored, never written to logs, and deleted on disconnect.
- Card details never reach us.
- Traffic to borderhos.com is encrypted in transit.
- Access to stored data is limited to the people at CVORReady Inc. who need it to run the service.
- We store little and delete on a schedule, so there is less to lose.
8. Your rights
Wherever you live, you can ask us to access the personal information we hold about you and learn how we have used it; correct anything inaccurate or out of date; withdraw consent at any time (for a free-check record this means we delete it; for a subscription it means closing your account); delete your personal information, unless we must keep part of it for a legal reason such as tax records, in which case we will tell you; take it with you, where that applies, in a structured, commonly used format; and complain. We investigate every complaint.
Send a request through the contact form, marked "Privacy". We confirm who you are by sending a sign-in link to the email address on file before we act. We respond in writing within 30 days; if we need up to 30 more days, we will tell you why before the first 30 end. If we must refuse part of a request, we will give our reasons. We do not charge for requests unless we tell you an estimated cost first and you agree.
Drivers. If your carrier has connected an ELD, your carrier decides what is sent to us. Ask your carrier first; we will help them answer you.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec residents can also complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
9. Quebec residents
If you are in Quebec, the following also applies.
- The person in charge of the protection of personal information is the Privacy Officer, CVORReady Inc., reached through the contact form at borderhos.com/contact.
- Your personal information leaves Quebec and Canada and is stored in the United States (section 5).
- BorderHOS uses no technology that identifies, locates or profiles you. The session cookie only keeps you signed in, and our analytics identify no one.
- Any privacy setting we offer defaults to the most protective option; for example, ELD connections send first names and last initials unless you choose otherwise.
- We keep a register of confidentiality incidents and will notify the Commission d'accès à l'information and the people affected if an incident presents a risk of serious injury.
10. United States residents
The rights in section 8 are available to everyone in the United States, exercised the same way. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, so there is no "Do Not Sell or Share" link because nothing would happen if you clicked it. We will never treat you differently for exercising your rights.
11. Emails we send
The sign-in link. When you ask for a free check, we send one email containing a one-time sign-in link. The wording beside the field says: "Send me a one-time link to run my free check. This is the only email you will get from BorderHOS unless you ask for more." We mean that. The email contains the link, our name and nothing promotional.
Account email. If you subscribe, you will receive receipts, renewal reminders, failed-payment, price-change and security notices, and anything else needed to run your account. These are not marketing and continue while you have an account.
Marketing email. We send marketing email only if you give a separate, express consent through an unchecked box that explains what you would receive and from whom. Every marketing email will identify CVORReady Inc., include our postal address and carry an unsubscribe link that works. We honor unsubscribes promptly, and in any case within 10 business days.
12. Children
BorderHOS is a business tool for people 18 or older. It is not directed at children and we do not knowingly collect information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.
13. If something goes wrong
If we learn of a breach of security involving personal information under our control, we will contain it, notify the people affected and any regulator we are required to notify without undue delay and as soon as feasible, tell any other organization that can help reduce the harm, and keep a record of the breach for 24 months whether or not notification was required. Our notice will say what happened, when, what information was involved, what we have done and what you can do.
14. Changes to this policy
We may update this policy. Each version shows its "Last updated" date. If a change materially affects how we handle your information, we will tell you by email or by a notice on borderhos.com before it takes effect, and ask for your consent again where the law requires it. Earlier versions are available on request.
15. How to contact us
Privacy questions, requests and complaints go to the Privacy Officer, CVORReady Inc., through the contact form at borderhos.com/contact, marked "Privacy". Anything that must be on paper can be mailed to CVORReady Inc., 1 Brock St. West, Uxbridge, ON L9P 1P6, Canada.