Privacy Policy

DefectDash ("the app," "the service") is a fleet vehicle inspection and defect tracking tool used by businesses ("customers," "you") and their employees ("technicians" and "managers," together "authorized users"). This policy explains what information the app and this website collect, why, and how that information is handled. It applies to the DefectDash iOS app and to this website at defectdash.com.

DefectDash is operated by Benjamin Ocker ("we," "us," "DefectDash"), reachable at support@defectdash.com for any privacy question or data request.

Who this applies to

DefectDash is a business tool sold to companies that operate vehicle fleets. Each customer's employees use it as part of their job. It is not directed at, marketed to, or knowingly used by children, and we do not knowingly collect information from anyone under 13. If we learn that a child under 13 has provided personal information, we will delete it.

Information the app collects

• Account and access codes: a company code and manager code, set up when the customer signs up. These identify which company's data a sign in belongs to. Manager codes are stored using one way encryption (bcrypt hashing), so no one, including us, can read a manager code back out of the database.
• Technician names: entered by a manager, used to attribute inspections and defects to the person who logged them.
• Vehicle information: vehicle profiles (for example name, type, VIN, odometer readings) entered by managers and technicians.
• Inspection records: pass, fail, and not applicable checklist results and odometer readings logged during pre trip and post trip inspections.
• Defect records: descriptions, severity, and status of reported vehicle defects, work orders, and maintenance reminders.
• Photos (optional): if a technician chooses to attach a photo to a defect, the app requests camera or photo library access at that moment. Photos are stored in a private file storage bucket and are only ever attached to a specific defect.
• Digital signatures: when an inspection or defect resolution is signed off, the signature is captured as an image and stored with that record.
• Email addresses: office and report recipient email addresses that a manager enters in Settings, used only to send that company's own inspection (DVIR) PDFs and weekly fleet defect reports.
• Invoice and cost data: optional cost figures a manager enters when resolving defects against a repair invoice.
• Vehicle location (optional, off by default): a company can choose to record where each inspection (DVIR) was submitted. This is off for every company unless a manager turns it on. When a manager turns it on, it is switched on for every technician on that company's active roster at that moment, and for anyone added to the roster later while it stays on. The manager can then switch it off again for any individual person, so it remains a per person setting once it is running, but the starting point is the whole roster rather than nobody. When it is on for a person, the app asks that device for permission and reads its location once, at the moment an inspection is submitted. A single set of coordinates is stored on that inspection record, along with how accurate the reading was and when it was taken. The location is shown on the inspection PDF and to that company's managers, and is used to tag the inspection as taking place at the company yard or out in the field, and to compare distance travelled against the odometer readings the technician entered. The tablet is issued to a vehicle rather than to a person, and the purpose is to show where the vehicle was inspected. Note, though, that an inspection record also carries the name of the technician who submitted it, so in practice the location is associated with that person as well as with the vehicle.
• Company yard location (optional): a manager may record the location of their own yard in one of three ways: by typing the yard's street address, by typing the coordinates directly, or by pressing a button in the web portal that reads their browser location once, with their permission. Where they type an address, that address is sent to a third party mapping provider to be converted into coordinates, and both the address and the resulting coordinates are stored on the company record. This is a property of the company rather than of a person, and is used only to work out whether an inspection happened at the yard or away from it.
• Vehicle location through the working day (optional, off by default): separately from the inspection stamp described above, a company can choose to record where each vehicle goes while it is out on a trip. This is a different setting with its own switch, it applies to the whole company, and turning on the inspection stamp does not turn it on. When it is on, recording starts when a technician submits a start of trip inspection on a vehicle and stops when they submit the matching end of trip inspection. Nothing is recorded between trips. While recording is running the device displays a blue location indicator, so the person using it can see that it is on. What is stored is a series of positions, each with how accurate it was and when it was taken, plus a marker when the vehicle left or returned to the company yard. Each stored position is attached to the vehicle and carries no technician name or identifier of any kind. Note, though, that the inspection which opened the trip does record who submitted it, so a manager is able to connect a vehicle's movements to the person who was driving it.

What DefectDash records depends on which of the two settings above a company has turned on. With neither on, which is the default, no location is recorded at all. With only the inspection stamp on, location is read once at the instant an inspection is submitted and the device is not followed between inspections. With day recording on, a vehicle's position is recorded while a trip is open, as described above, and the device shows a blue location indicator throughout.

Who is responsible for telling employees. The company that turns a location setting on is the employer, and it decides whether to record location at all. That company is responsible for giving its own employees whatever notice, and obtaining whatever consent, the law where it operates requires. DefectDash provides the setting and describes here exactly what it records. We are not the employer and we do not make that decision for them. This is also stated in our Terms of Service.

DefectDash asks only for permission to use location while the app is in use, and never for the "always" permission. A device's location permission can be withdrawn at any time in the device's own Settings, under Privacy and Location Services. Withdrawing it stops all recording immediately.

DefectDash does not collect advertising identifiers or browsing and usage analytics, and does not use third party advertising or tracking software development kits.

Information this website collects

This website (defectdash.com) does not use cookies, does not run analytics or advertising scripts, and does not track visitors across other sites.

When you submit the contact form on the Contact page, the details you enter are sent to our servers and stored so that we can respond. That is your name, your company, your email address, the fleet size band you chose, and anything you wrote in the message box. We use it to reply to you and to keep track of the conversation. We do not sell it, we do not share it with anyone outside the service providers listed below, and we do not add you to a marketing list without asking you first.

Alongside those details we store the browser and device description your browser sends with the request, and a one way cryptographic hash of your network address rather than the address itself. The hash exists only to limit how many submissions can arrive from a single source, so that the form cannot be flooded. It is not reversible by us and it is not used to identify you or to follow you around.

If our server cannot be reached, the form falls back to opening your own email application with the details pre filled. In that case nothing reaches or is stored by us unless you send that email yourself.

Contact form submissions are kept while we are in touch with you, and for a reasonable period afterwards so that we have a record of the conversation. You can ask us to delete yours at any time by writing to support@defectdash.com.

A small amount of information, your light or dark theme preference, is saved in your browser's local storage purely to remember your display choice on your next visit. That preference never leaves your device.

How information is used

All information described above is used to operate the inspection and defect tracking features described in the app: showing a fleet's vehicles and open defects, generating PDF and CSV inspection and fleet reports, emailing those reports to the addresses a manager configures, and producing the trends and analytics that a company's own managers read about their own fleet inside the app. Data belonging to one company is never visible to another company's users.

DefectDash does not sell any of this information, does not share it with advertisers or data brokers, and does not share one company's records with another company. Aggregated, de-identified statistics that cannot be traced back to a particular company, vehicle or person may be used to improve the app's features. Nothing in this paragraph permits DefectDash to use an identifiable company's records, including recorded vehicle positions, for any purpose other than providing the service to that company.

Do we sell your information

No. We do not sell, rent, trade, or share personal information with third parties for their own advertising or marketing purposes, and we never have. We do not use or disclose sensitive personal information for any purpose other than providing the service itself.

Who can see it

Access is restricted by company. Technicians and managers can only see data belonging to their own company, enforced by database level security rules, not merely by application logic. Benjamin Ocker, as the operator of the service, can access data only as needed to provide support, investigate a reported problem, or maintain the service.

Third party service providers

DefectDash relies on a small number of infrastructure providers to operate. Each acts as a service provider or processor on our behalf, is bound to use data only to provide their service to us, and does not use your data for their own independent purposes:

• Supabase, which hosts the app's database, authentication, and private photo storage. See Supabase's privacy policy.
• Resend, which sends every email the app produces on its behalf, which includes DVIR copies, defect alerts, incident reports, and the weekly and monthly fleet reports. Where an inspection recorded a location, that location appears in the body of the email or on the attached PDF and therefore passes through Resend. Contact form submissions from this website are also delivered to us through Resend, so the details you enter on the Contact page pass through it as well. See Resend's privacy policy.
• A mapping provider (Mapbox, privacy policy), used for one purpose only: when a manager types their company yard's street address in Settings, that address is sent to the mapping provider to be turned into coordinates. Nothing else is sent to it. No technician name, no inspection, and none of the locations recorded by the app are ever sent to the mapping provider.

Your privacy rights

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, to receive a copy of it in a portable format, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under state privacy laws, so there is nothing to opt out of. To exercise any of these rights, contact support@defectdash.com. We will verify your identity or authority to make the request (for example, confirming you are the manager of the company account in question) before acting on it, and we will respond within the time required by applicable law, generally within 45 days. We will not discriminate against you for exercising these rights.

Because DefectDash is a business to business tool, most personal information in the app (technician names, inspection records) is entered and controlled by the customer company, not by the individual it describes. If you are a technician or manager and want to exercise a privacy right over data your employer has entered, we may direct your request to your employer, who controls that account, in addition to or instead of acting on it directly.

Data retention

• Defect records are automatically deleted 30 days after creation.
• Inspection records, including any location recorded on them, are automatically deleted 14 days after creation.
• A PDF copy of each inspection is also stored, but only briefly. At most the 5 most recent per vehicle are kept, and older ones are deleted once the company's weekly summary email has been sent, so a stored PDF is usually held for days rather than weeks. Where an inspection recorded a location, that location is printed on its PDF and is deleted along with it. The compliance record required by federal regulation (49 CFR 396.11, a three month retention requirement for vehicle inspection reports) is the copy emailed to the company's own configured recipients at the time of inspection. That emailed copy is the durable one and the company holds it itself. The copy we store is a short lived convenience for viewing in the app and the portal, and a company should not treat it as its compliance record or as a backup of one.
• Incident reports, including the photos attached to them, are kept on file. When a report is filed, a PDF of it with those photos included is emailed to the company's configured recipients. We do not currently delete incident reports on a schedule, so a report stays until the company asks for it to be removed. That is deliberate rather than an oversight: an incident can become an insurance claim or a legal matter long after the day it happened, and a report that quietly expired on a timer would be worse than no report at all. If a company would rather not have them held indefinitely, it can ask us to delete them at any time using the address below.
• Recorded vehicle positions, where day recording is switched on, are automatically deleted 7 days after they are recorded.
• The per-vehicle daily summaries calculated from those positions (when a vehicle left the yard, how far it travelled, how many stops it made, how long it spent stopped, and when it returned) are kept for 13 months and then automatically deleted. These summaries deliberately outlive the individual positions they were calculated from: they are what a manager actually reads, and they carry far less detail.
• Fleet summary statistics and invoice records are retained for 13 months for trend reporting, then automatically deleted.

A customer may request earlier deletion of their company's data at any time by contacting support@defectdash.com.

Data security

Data is stored with a hosted database provider (Supabase) using per company access restrictions enforced at the database level. Photos are stored in a private, not publicly accessible, file storage bucket. Manager codes are stored as one way cryptographic hashes rather than in plain text. All traffic between the app and our servers is encrypted in transit. No method of storage or transmission is completely secure, and we cannot guarantee absolute security, but we take reasonable, industry standard measures to protect the information in our care.

If a data breach occurs

If we become aware of a security incident that compromises personal information we hold, we will investigate, take reasonable steps to contain it, and notify affected customers without unreasonable delay and in accordance with applicable law, so they can take any steps needed to protect their own employees or operations.

Where data is processed

DefectDash is intended for use by businesses operating within the United States, and personal information is stored and processed in the United States. If you access the app or this website from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your own country.

Do Not Track signals

Some browsers offer a Do Not Track setting. Because this website does not track visitors across other sites and does not use tracking cookies, there is no cross site tracking behavior for such a signal to change, and we do not respond to Do Not Track signals differently.

Changes to this policy

If this policy changes, the "last updated" date above will change accordingly. For material changes, we will make reasonable efforts to notify customers, such as an in app notice or an email to the company's registered office address. Continued use of the app after an update constitutes acceptance of the revised policy.

Contact

Questions about this policy or your data: support@defectdash.com