This Privacy Policy explains how X3 Fleet Safety, LLC ("X3") handles personal information when motor carriers and their personnel use the X3 platform (the "Service"). It applies to information we collect at x3fleetsafety.com, app.x3fleetsafety.com, and any X3 mobile or driver applications.
Roles. When a motor carrier subscribes to X3 and uploads records about its drivers, vehicles, or operations:
Drivers and other carrier personnel whose records appear in the Service should direct privacy questions and access/deletion requests to their carrier-employer first. X3 will support whatever response the carrier instructs us to make.
We collect three categories of information:
We use information to:
We do not sell personal information. We do not share personal information with advertisers. We do not use Customer Data to train any artificial intelligence model except where the Customer has explicitly opted in to features that require it (and even then, only on Customer's own data, not pooled across customers).
We share personal information only with:
Background checks, MVRs, and certain investigative reports may be governed by the federal Fair Credit Reporting Act (FCRA). When the Service handles FCRA-covered records on Customer's behalf:
If a driver disputes the accuracy of a record, the dispute should be made to the originating CRA (e.g., Checkr) per FCRA's dispute process. X3 will assist by surfacing the record and the originating CRA contact.
DOT compliance records have layered obligations beyond ordinary privacy law. Some records (DQF contents, drug-test records, hours-of-service) have regulatory minimum retention windows that override ordinary deletion requests. Our Data Retention & Destruction Policy details the windows. In summary:
| Record class | Regulation | Minimum retention |
|---|---|---|
| DQF contents | 49 CFR § 391.51 | 3 years post-termination |
| MVR pulls | § 391.51 | 3 years |
| D&A test (negative) | § 382.401 | 1 year |
| D&A test (positive/refusal) | § 382.401 | 5 years |
| Hours-of-service / RODS | § 395.8 | 6 months |
| DVIR | § 396.11 | 90 days |
| IFTA mileage + fuel | IFTA Articles § P560 | 4 years |
X3 retains records for the regulatory minimum plus a 1-year safety buffer.
We retain Customer Data for as long as Customer's account is active, plus the regulatory retention windows above for DOT-covered records, plus up to 90 days for backups to age out. Audit logs are retained for 7 years to support our own compliance and audit defense. Specific destruction practices are described in our Data Retention & Destruction Policy.
We protect personal information using administrative, physical, and technical safeguards including encryption at rest and in transit, role-based access controls, row-level security for tenant isolation, audit logging, and regular security reviews. Despite these measures, no system is impervious; if we discover unauthorized access to your data, we will notify Customer (the data controller) within 72 hours of confirmation, per our Incident Response Policy.
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of personal information about you. Under California's CCPA / CPRA, residents have the right to know what data we hold, request deletion, request correction, and opt out of "sale" or "sharing" (we do neither).
Because X3 is a data processor for carrier customers, individual rights requests should typically be directed to the carrier-controller first. If a carrier instructs us to access, export, correct, or delete a record, we will do so unless prevented by regulatory retention obligations. If you are unable to reach the carrier or believe the carrier is not responding, contact [email protected] and we will route your request appropriately.
The Service is not directed at children under 16, and we do not knowingly collect personal information from children. Commercial driver licensure requires drivers to be 18+ (interstate) or 21+ for many operations, so the Service inherently does not contemplate child users.
We may update this Privacy Policy. Material changes will be communicated to Customer by email and an in-app banner with at least 30 days' notice before they take effect. The "Last updated" date at the top reflects the most recent revision.
If a user provides a mobile phone number and checks the SMS consent checkbox during account signup, X3 Fleet Safety may send operational SMS messages to that number. SMS messages are transactional and operational only — we never use SMS for marketing, promotions, or solicitation.
Message types include:
Frequency. Approximately 2–5 messages per user per month, depending on the number of drivers managed and pending compliance events.
Consent. Explicit, opt-in only. Users must check an unchecked-by-default consent checkbox on the signup page at app.x3fleetsafety.com/signin.html. Consent is logged in our database with timestamp, IP address, user agent, and a hash of the exact text the user agreed to. Consent records are retained for 4 years per FCC TCPA requirements.
Opt-out. Users can opt out at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message. The system processes opt-outs within 30 seconds and sends a single confirmation message. To resubscribe, reply START. Users may also opt out by emailing [email protected].
Help. Reply HELP for support, or email [email protected].
Costs. Message and data rates may apply depending on your mobile carrier and plan. X3 Fleet Safety does not charge for SMS messages.
Mobile information sharing. Mobile information (including phone numbers and SMS consent data) will not be shared with third parties or affiliates for marketing or promotional purposes. We share SMS delivery data only with our SMS service provider (Twilio) as a sub-processor strictly to deliver messages on our behalf.
Carrier disclaimer. Mobile carriers are not liable for delayed or undelivered messages. Service availability depends on your carrier and signal coverage.
Privacy questions: [email protected] (subject line: "Privacy"). Postal address available on request to that email.