Privacy

Who runs this

RoadsideProof is run by SOV17 LLC, Yerevan, Armenia. For anything about your data — a copy, a correction, deletion — write to hello@sov17.tech. We answer within five days.

What we hold, and only that

The free alert needs one thing: your USDOT number. No account, no password, no email address unless you ask us to send you alerts.

If you go on to the paid check, we hold the documents you upload — usually an inspection report and, if there was one, a citation — the page images made from them, the four values read off them, and your confirmations of those values.

Those documents name other people: a driver, sometimes an officer. Upload only records of your own operation.

What we never ask for

We never ask for your FMCSA Portal, DataQs or Login.gov credentials, and we never file a Request for Data Review on your behalf. The certification on that filing is signed under 18 U.S.C. 1001 by the person filing it, and that person is you.

We do not sell your data, and we do not share it with insurers, brokers or anyone assessing you.

Who else sees any of it

Google Cloud hosts the servers this runs on.

To read a page of a document we send its image to Gemini on Vertex AI, Google's AI service, in the United States. Outside our own servers, only Google and the sub-processors it lists can see the pages you upload.

What leaves is the page image and nothing we could attach to it: no account details, no payment information, nothing about who uploaded it. Google's terms bar it from using this data to train its models without our permission, and we have not given it. Google uses sub-processors of its own, listed on its site.

Payment, when you buy the paid check, is handled by Paddle as the merchant of record. Your card details reach Paddle and never reach us.

How long each thing lives

Your files, the page images made from them, and the values read from them are deleted 14 days after upload. Deletion is automatic, and uploading the same file again does not extend it.

The case page and your confirmations expire on the same clock, no later than 14 days after your first upload.

A free report link opens for 30 days.

These are our clocks. When a photographed page is read by Google (see who else sees your data), Google keeps its own clock under its own terms: it may hold a request in memory for up to 24 hours, and a request its automated abuse checks flag can be kept for up to 90 days for review. That is why the numbers differ.

Backups and disk snapshots hold encrypted copies without the key that opens them, and the key is kept apart from both. A copy taken shortly before your files were deleted is kept for another 14 days, so in the worst case an encrypted copy of a file exists for about 28 days from the day you uploaded it, and never longer.

Our ingress keeps a request log for 30 days: method, status, duration and network address. The address of your case is stripped from it before it is written, because that address is the key to your case.

Counts of how the product behaved — how often a reading was refused, how often two readings disagreed — are kept indefinitely. They contain no document content and nothing about you.

Where it happens

Our servers are in the United States, and so is the Google service that reads your pages: Gemini on Vertex AI in Google's United States multi-region.

How it is protected

Documents and the values read from them are encrypted while we hold them. The application keeps no logs of its own, so your document cannot appear in one.

A page of a document is opened only by a process that has no network access at all.

What you can ask for

Write to hello@sov17.tech for a copy of what we hold about you, a correction, or deletion before the clock runs out. We answer within five days.

Alert emails carry an unsubscribe link, and one click is enough. We keep the address you unsubscribed on, in a form we cannot read back, so that we do not write to it again.

If something goes wrong

If personal data leaks from our systems, we immediately publish an announcement and report it at the same time to the Police of the Republic of Armenia and the Armenian data-protection authority.

We tell the carrier whose documents were involved directly and without delay, at the address we have for the carrier.

Where the state law that applies to an affected person gives additional notice rights or deadlines, we follow that law for that person. No deadline in one state waits for another.

A written incident procedure stands behind this response.

What this page is not

Nothing here is legal advice, and nothing here says what your filing will achieve. The state that issued the record decides, and the burden of showing it is wrong is yours.