Privacy Policy

Almost everything in Harlo is entered by a motor carrier about its own business — its drivers, its equipment, its customers, its loads. For that information the carrier is the controller and Harlo Solutionsis a processor: we hold and process it on the carrier's instructions, under our agreement with them, and we do not use it for unrelated purposes.

If you are a driver, employee, or contact of a carrier that uses Harlo and you want to see, correct, or delete information about you, contact that carrier first — they decide what their records say. We will help them respond, and we will pass along requests we receive directly.

We are the controller for a smaller set of data: the accounts of the people who sign in, billing records, support correspondence, the operational logs we keep to run the service, and the aggregated statistics described in section 5.

• Account and sign-in data — name, work email, role and permissions, authentication records, and sign-in activity.
• Carrier operational data — customers, facilities, loads, routes, dispatch, equipment, financial records, and the event history of changes to them.
• Driver information— name, date of birth, contact details, address, employment records, pay terms, commercial driver's licence and endorsements, medical examiner's certificates, incidents, and duty and schedule records. Some of this is personal and sensitive; it is in Harlo because DOT and FMCSA rules require a carrier to keep it.
• Documents — files uploaded by the carrier, such as rate confirmations, bills of lading, licences, and certificates, together with the data extracted from them.
• Mobile numbers and messaging consent— where a carrier enables text notifications, the driver's mobile number, whether they consented, the exact wording they agreed to, when, and from where. See our SMS consent disclosure.
• Technical and usage data — IP address, browser and device information, pages and features used, and error and performance logs.
• Billing data — plan, metered usage, and invoices. Card details go directly to our payment processor; we do not store full card numbers.

What we do not collect.Harlo does not collect biometric identifiers or biometric information — no fingerprints, no face or voice templates, no retina or iris scans — and does not use facial recognition. We do not run background checks, pull motor vehicle records, or act as a consumer reporting agency. We do not collect government identifiers beyond what a carrier enters for its own DOT recordkeeping, and we do not track a driver's personal device location.

We do not knowingly collect information from anyone under 16. Harlo is business software and is not directed at children.

• Running the platform: showing a carrier its own operation, and recording the facts it enters.
• Producing the analysis Harlo exists for — compliance and fitness conclusions, risk and exception signals, document understanding, and the assistant's answers.
• Sending operational notifications, including text messages to drivers who have consented.
• Keeping an audit trail of changes, which we retain because carriers are subject to audit.
• Security, abuse prevention, troubleshooting, and support.
• Billing, and measuring usage against a subscription.
• Improving Harlo, and building the cross-carrier statistics described in section 5.
• Meeting our own legal obligations, and establishing or defending legal claims.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use carrier data to advertise to anyone, and we do not send marketing texts.

Where we act as a processor, the carrier determines the legal basis. Where we act as a controller, we rely on: performance of a contract, for accounts, billing, and delivering the service; our legitimate interests, for security, abuse prevention, support, product improvement, and the aggregated statistics in section 5, balanced against the rights of the people concerned; consent, where the law requires it, such as for messaging; and legal obligation, where we must keep or disclose something.

This is the section carriers should read closely, because it describes something we do deliberately.

Harlo uses platform activity to build aggregated, de-identified intelligence about how freight moves. For example: typical dwell time at a given facility, how a lane behaves by season, how often a class of exception turns into a real problem, how long a document type takes to clear. That intelligence is what lets Harlo tell any carrier that a shipper runs four hours late on Fridays — a thing no single carrier can see from its own data alone. We use it to improve the product, and we may publish or commercialise it as industry benchmarks and statistics.

Aggregated data means data combined across customers and de-identified, so it does not identify — and cannot reasonably be used to identify — a carrier, a driver, an employee, a broker, a shipper, or an individual load, rate, or transaction.

These limits are commitments, and they also appear in our Terms of Service:

• We never publish, sell, or disclose a carrier's rates, margins, financial records, customer or broker relationships, driver records, or load-level detail in identifiable form.
• We never identify which carriers contributed to a statistic, and nothing we publish is designed to expose or disadvantage any carrier.
• We do not attempt to re-identify aggregated data, and we require the same of anyone we provide it to.
• We do not publish a statistic drawn from too few contributing carriers or records to be meaningfully anonymous.
• We do not use one carrier's data to give another carrier a targeted advantage against it.
• Personal information about drivers and individuals is not part of what we publish. Dwell time is about a facility, not about the person who waited there.

Because aggregated data no longer identifies anyone, it is not personal information, and deleting a carrier's data does not require us to unwind statistics already derived from it. If you have a question about how a benchmark was built, ask us at support@goharlo.com.

Harlo interprets operational data — it reads uploaded documents, derives compliance conclusions, and answers questions about a carrier's operation. Some of that runs on models we host ourselves, and some, where a carrier has it enabled, runs on third-party model providers we contract with.

Where a third-party provider is used, it processes the content only to return a result to us and under contractual restrictions. Carrier data is not used to train third-party models. We may use carrier data to evaluate and improve our own systems, in line with section 5 and our agreement with the carrier.

Harlo's conclusions are decision support, not decisions. Nothing in Harlo makes a decision with legal or similarly significant effect on a person on its own: anything that changes a carrier's records is proposed to a person and applied only once they approve it, and the approval is logged. Conclusions can be wrong, and a carrier is expected to verify them.

We share information only as described here:

• Service providers who help us run Harlo, under contracts limiting them to that purpose — hosting and infrastructure, network and security providers, text-message delivery (Twilio), AI model providers where enabled, mapping and geocoding, error monitoring, email delivery, and payment processing.
• The carrier whose account the data belongs to, and the users it has authorised.
• Legal and safety — where we are required by law, or where it is necessary to protect rights, safety, or the integrity of the service. Where we may lawfully do so, we will tell the affected carrier first, so it can object.
• A successor, if the business is acquired, merged, or reorganised. This policy continues to apply to information transferred that way.
• Aggregated statistics as described in section 5, which are not personal information and do not identify a carrier.

A current list of the providers that process carrier data is available on request. If a carrier needs a data processing agreement, email support@goharlo.com.

Harlo uses cookies and similar storage that are strictly necessary to run the application: keeping you signed in, keeping your session secure, and remembering interface preferences. We use a small amount of first-party analytics to understand which features are used and to find errors.

We do not use advertising cookies, and we do not allow third parties to track you across other sites through Harlo. Because we do no cross-context behavioural advertising, we treat Global Privacy Control and Do Not Track signals as already satisfied. Blocking necessary cookies in your browser will stop the application from working.

Operational and audit records are kept for as long as the carrier's account is active, because the carrier needs them and is often required by DOT and FMCSA rules to keep them. When an account closes, the carrier may export its data; we then delete or de-identify it within 90 days, except where we must keep something longer to meet a legal, tax, or regulatory obligation, or to resolve a dispute.

Proof-of-consent records for text messaging are kept for at least four years after consent is withdrawn, because that is what defending a TCPA claim requires. Backups age out on their own schedule, generally within 90 days.

Access to a carrier's data is restricted at the database level, so one carrier cannot read another's. Data is encrypted in transit. Access is limited by role, changes are recorded in an audit trail, and administrative access is limited to staff who need it and is logged.

No system is perfectly secure. If a breach affects your information we will notify you and the relevant regulators as the law requires, without undue delay.

Depending on where you live you may have the right to access, correct, delete, or receive a portable copy of your personal information, to limit the use of sensitive information, to opt out of its sale or sharing (we do neither), to withdraw consent, and not to be discriminated against for exercising these rights. Residents of California, Colorado, Connecticut, Virginia, Texas, and other states with comparable laws have these rights; so do people covered by the UK and EU GDPR.

Write to support@goharlo.com and we will respond within the time the applicable law allows. We may need to verify your identity first, and an authorised agent must show they are authorised. If we decline a request, you may appeal by replying to our response; we will answer the appeal within the statutory period and tell you how to contact your state attorney general or supervisory authority.

Where the request concerns data a carrier controls — most driver and operational records — we will forward it to that carrier and support their response rather than altering their records ourselves.

Mobile numbers collected for driver notifications are used only to send that driver operational messages from their own carrier. Mobile information collected for SMS consent will not be shared or sold to third parties or lead generators for marketing or promotional purposes. Mobile numbers and opt-in data are never sold or rented, and are not shared with any third party for that party's own purposes. The only third parties that ever see a number are the messaging providers that carry the message and the carrier that employs the driver. Consent can be withdrawn at any time by replying STOP to any message, or by asking the carrier to switch notifications off. Message and data rates may apply. Our full disclosure is at /sms-consent.

Harlo is operated from the United States and information is processed there. If you use it from elsewhere, you are sending information to the United States, where privacy law differs from your own. Where we transfer personal data out of the UK or EEA, we rely on the European Commission's standard contractual clauses.

We will update this policy as Harlo changes, and revise the effective date above. If a change materially affects how we handle personal information we will tell account administrators before it takes effect.

Harlo Solutions LLC
8034 46 St, Lyons, IL 60534
Privacy: support@goharlo.com
Support: support@goharlo.com

This policy is governed by the laws of the State of Illinois.