Privacy Policy

1. About this Privacy Policy

Inland Truck Parts and Service ("ITP," "we," "us," or "our") operates the ITP Hub web portal and ITP Customer App, together with their associated online features (the "Platform"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information connected with the Platform and how you can exercise privacy choices.

Personal information is information that identifies, relates to, or can reasonably be linked to an individual. It can include a business representative's name and contact details, account activity, and vehicle or repair information linked to that person. This policy applies to individual customers, drivers, fleet representatives, and other authorized users.

This policy covers information collected through the Platform and information entered into it from related service, customer-account, and support activities. It does not replace separate notices for unrelated public marketing websites, employment matters, or third-party services. A separate notice may provide additional details for a particular activity.

This policy is a notice, not blanket consent to every use of your information. We obtain separate consent where required. Reading or acknowledging it does not authorize repairs, approve an estimate, enroll you in marketing, or waive privacy rights. Each repair approval or decline remains specific to its individual authorization request under the Terms of Service.

2. Information we collect

The information collected depends on the features you use, information you or your organization provide, and your access permissions. The following categories describe the Platform's customer-service activities.

2.1 Identity, contact, and business-account information

We collect information such as your name, email address, telephone number when provided, company or fleet affiliation, customer-account identifiers, and contact preferences. We also maintain user identifiers, account status, access roles, and records used to verify your relationship to an account and authority for particular actions.

2.2 Sign-in and security information

Our authentication services process information needed for registration, sign-in, account recovery, and identity verification. This can include credentials submitted through the sign-in process, identity-provider identifiers, authentication results, session information, IP addresses, and security events. Microsoft Entra External ID supports customer authentication. Do not send passwords or verification codes in ordinary messages or attachments.

2.3 Vehicle, service, and transaction information

We collect or receive vehicle identifiers such as VINs, unit or fleet numbers, and license plates when included in service records; repair-order numbers; reported concerns; service history; estimates; parts and labor details; invoices; and available account or payment-status information. These records may identify a driver, customer contact, or person acting for a fleet.

Displaying an invoice or payment status does not mean that the Platform collects a full payment-card number or bank credential. Do not submit these details in messages. Any enabled payment-collection feature must provide its own relevant collection and payment-provider disclosures.

2.4 Authorization decisions and electronic records

We maintain records of specific authorization requests and approvals or declines, including the relevant account, vehicle, repair order, request identifier and version, displayed work and amount, decision, user identity, and date and time. We may also retain associated communications, submission records, and security information used to investigate a disputed or unauthorized action.

We maintain Terms acceptance records and, where applicable, records of privacy choices and permissions. A repair order may have multiple separate authorization and decision records.

2.5 Messages, photographs, videos, and documents

We collect messages, support inquiries, photographs, videos, documents, and other content you submit or that ITP personnel add to the relevant service record. Files may contain names, faces, license plates, voices, or other personal information. They may also contain embedded metadata, including creation dates or location information. Avoid including unnecessary sensitive information or information about others without authority.

2.6 Device, usage, and diagnostic information

The Platform and its supporting services may collect IP address, browser and operating-system details, app version, device type, pages or functions used, interaction times, error reports, and security or performance logs. IP addresses may indicate an approximate location. When push notifications are enabled, a device or app-instance notification identifier and delivery information may be processed.

3. Where information comes from

We receive information directly from you; from your fleet, employer, vehicle owner, or other authorized account representatives; and from ITP personnel and business systems used to provide service. For example, an existing repair record may be made available to you after your access is verified.

We also receive information from authentication, hosting, security, and communication providers supporting the Platform, and automatically from your interactions with it. When relevant to the requested service, information may come from a warranty administrator, manufacturer, insurer, or another party you authorize.

4. How we use information

We use relevant information to create and secure accounts; verify identity and account access; connect users to authorized customer records; communicate about repairs; display service documents and account information; and record, carry out, or resolve questions about specific authorization decisions.

We also use relevant information to provide support, investigate errors or suspected misuse, maintain the Platform, assess service performance, improve customer-service processes, administer applicable warranty or billing matters, and meet legal, recordkeeping, and dispute-resolution obligations. Information used to verify a privacy request is used for that verification, processing the request, and related security and compliance records.

Information required to provide a feature is identified in the relevant process. Without necessary information, we may be unable to provide that feature or verify your authority. Optional device permissions and marketing choices are handled separately.

We may prepare aggregate or de-identified operational statistics. Where we treat data as de-identified, we take reasonable steps to prevent it from identifying an individual and do not attempt to re-identify it except where law permits testing of de-identification safeguards.

5. Repair decisions and visibility within an account

Each approval or decline is recorded against its own request. This policy does not combine decisions into a blanket authorization, expand approved work, or change a previously recorded decision.

Messages, attachments, service records, and authorization decisions are business communications, not private conversations limited to the sender and one technician. Depending on account permissions, they may be visible to relevant ITP personnel and other authorized representatives of the same customer account or fleet, including account administrators.

We use access permissions to restrict customer-account information. Report an incorrect account association or unexpected access promptly. Your organization may also maintain its own copies of business records under its policies and legal obligations. That does not eliminate ITP's obligations for information we control.

6. When we disclose information

6.1 ITP personnel and authorized account users

We disclose relevant identity, service, communication, transaction, and decision information to ITP personnel who need it for their responsibilities and to authorized customer-account users as described in Section 5. Access to security information is limited according to the recipient's role and need.

6.2 Service providers

Providers supporting hosting, data storage, identity management, communications, technical support, diagnostics, and security process information needed for those functions. These services include Microsoft Azure and Microsoft Entra External ID. A hosting provider may process stored records and attachments; an identity provider processes sign-in information; and an enabled email or push provider processes relevant routing, delivery, and message information.

We require providers acting on our behalf to handle personal information under applicable contractual confidentiality, security, and data-processing restrictions, rather than for unrelated purposes of their own.

6.3 Service-related recipients

Where needed for a requested service or claim, we may disclose relevant contact, vehicle, repair, transaction, and supporting information to an authorized warranty administrator, manufacturer, insurer, subcontracted service provider, or other recipient you direct. We limit disclosure to information relevant to that purpose.

6.4 Legal obligations and business transactions

We may disclose information where required by law or reasonably necessary to address fraud or security incidents, protect people or property, or establish, exercise, or defend legal claims. Recipients may include legal advisers, insurers, regulators, courts, or law enforcement, as appropriate to the matter.

Information may also be disclosed to advisers or a successor in connection with a proposed or completed merger, acquisition, reorganization, or transfer of the relevant business, subject to applicable confidentiality protections, privacy requirements, and notice obligations. We may otherwise disclose information at your direction or with consent where required.

7. Cookies, analytics, and advertising

ITP Hub and its sign-in services use cookies, browser storage, or similar technologies to authenticate users, maintain sessions, remember relevant settings, and protect the Platform. Blocking or clearing necessary storage may sign you out or prevent features from working. The app may use local storage for comparable functions.

Operational logs and diagnostics support security and reliability. Any optional analytics or tracking must be described accurately, with any required choices offered before collection begins.

Proposed launch commitment - subject to confirmation: We do not sell Platform personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not disclose Platform messages, repair records, or authorization decisions to advertisers for those purposes. Ordinary service-provider and authorized-account disclosures are described in Section 6.

We honor legally recognized opt-out preference signals, such as Global Privacy Control, where required by applicable law. These signals are distinct from older browser "Do Not Track" settings and do not turn off necessary account or security functions.

8. Device permissions and communications

Camera, photo-library, file-access, or microphone permissions may be requested when an enabled feature needs them, such as capturing or selecting a repair photograph or recording a video. Permission requests should identify the purpose. You can manage permissions through your device settings; declining a permission may limit the associated feature without blocking unrelated functions.

Approximate location derived from an IP address or location embedded in a file is different from collecting a device's live location.

Where enabled, we send service-related communications through ITP Hub, the app, email, or device notifications. You may manage optional notifications in available settings and can disable device notifications through your operating system. Essential account, security, legal, or active-service communications may continue through available channels. Lock-screen or email previews may expose information to someone with access to your device or inbox.

The initial Platform release does not include an SMS/MMS messaging program. Providing a telephone number or using the Platform does not enroll you in one. Any later introduction of text messaging will have separate disclosures and any required consent. Optional marketing is separate from repair and account communications. Where we send optional promotional email, use its unsubscribe instructions; opting out does not stop necessary account or service communications.

9. How long we keep information

We retain personal information only for as long as reasonably necessary for the disclosed purposes, subject to applicable legal obligations and deletion requirements. The relevant period depends on the record type, relationship, service activity, legal requirements, and whether a claim or legal hold applies.

Account and identity records: Used while the account is needed and while related access, verification, or closure matters are addressed. Information no longer necessary is deleted or de-identified, subject to the exceptions below.

Repair, invoice, warranty, and authorization records: Retained according to applicable repair-record, accounting, tax, warranty, and claims requirements. Multiple approval or decline records may be necessary to document what was and was not authorized. Keeping a service record does not justify keeping every unrelated profile field.

Messages and attachments: Retained according to their purpose and the service matter they document. Content needed as part of a required transaction record follows that record's retention requirements; unrelated content is not kept indefinitely merely because it was uploaded.

Security, diagnostics, and request records: Retained for the period necessary to investigate relevant events, maintain security, address requests, and demonstrate compliance, with longer retention only when justified by an applicable requirement or specific matter.

Backups may retain copies until they are overwritten or expire under the applicable backup schedule. They are not a basis for indefinite ordinary use of deleted information. If a backup is restored, applicable deletion restrictions must be reapplied.

10. Account and personal-information deletion

You may request deletion of your Platform account through [IN-APP ACCOUNT-DELETION PATH] or [PUBLIC WEB ACCOUNT-DELETION REQUEST URL]. For assistance or a request involving particular personal information, contact [PRIVACY CONTACT EMAIL]. Uninstalling the app alone does not delete the account or server-side information.

We may verify your identity and ask you to confirm your request to prevent unauthorized deletion. We will explain the expected completion time and any information that must be retained. Account deletion means deletion of the account and associated personal information, not merely disabling sign-in.

Some information may need to be retained because of applicable law, a binding recordkeeping requirement, or a legal hold. This can include relevant repair authorizations, invoices, warranty records, or dispute evidence. We retain only what is necessary for the applicable exception and limit its use. Any retention must also be consistent with applicable app-store deletion requirements; ordinary business convenience alone is not a reason to retain all account data.

We address associated information held by providers and other recipients as required, including deletion or restriction instructions where applicable. Necessary records retained in business systems remain protected and subject to their retention limits. An organization's access to a record is not a blanket exception to privacy rights.

Deleting your account does not cancel a repair authorization, undo completed work, close a fleet's commercial account, or resolve an outstanding invoice. Contact the servicing location separately about those matters. You do not need to keep an active Platform account solely to preserve existing contractual obligations.

11. Privacy rights and choices

11.1 Rights that may apply

Depending on your location, the information involved, and applicable law, you may have rights to confirm processing and access your personal information; obtain a portable copy; correct inaccuracies; request deletion; and learn the categories of information, sources, purposes, and recipients involved. In some jurisdictions, you may request the identities of specific third-party recipients.

You may also have rights to opt out of sale, advertising-related sharing, targeted advertising, or certain profiling or automated decisions with legal or similarly significant effects, and to limit certain uses of sensitive information or withdraw consent. These rights apply to the relevant processing when covered by law; their description does not mean the Platform performs each listed activity. We do not unlawfully discriminate against people for exercising privacy rights.

11.2 Submitting a request

Submit a request through [PRIVACY REQUEST WEB FORM], email [PRIVACY CONTACT EMAIL], or call [PRIVACY REQUEST PHONE]. State the right you wish to exercise and provide information sufficient to locate the relevant records. Do not include passwords or unnecessary sensitive documents. Contact us for an accessible alternative format or assistance.

We may request information reasonably necessary to verify a request involving disclosure, correction, or deletion, and your authority to act for someone else. We will not require verification or account creation for an opt-out where the law prohibits doing so. Authorized agents may submit requests where permitted, subject to applicable proof-of-authority requirements.

11.3 Response, review, and appeal

We respond within the period required by applicable law and explain permitted extensions or reasons a request cannot be fully fulfilled. Where the law requires, requests are handled without charge. Restrictions may protect another person's information, security, or required records; they do not eliminate the right to request a review.

To appeal a denial where an appeal right applies, use the same request channels and identify the original request as a "Privacy Appeal." We will respond within the applicable appeal period and provide any required information about contacting the relevant state attorney general or privacy regulator. You may also contact an applicable regulator directly.

11.4 Business and fleet users

Some laws distinguish business-contact information from personal or household information; others protect business representatives as well. We assess requests under the applicable law rather than assuming that fleet-related information is outside all privacy protections. Account-deletion options described in Section 10 are not limited to residents of a particular state.

12. Protecting information

We use administrative, technical, and organizational safeguards designed to protect personal information, including authenticated access, account permissions, and controls appropriate to the information and systems involved. Access is limited according to operational responsibilities.

No system or transmission method is completely secure. Protect your credentials and devices, avoid shared accounts, and promptly report suspected unauthorized access through [SECURITY OR SUPPORT CONTACT]. We assess security incidents and provide notifications required by applicable law. This policy does not guarantee that an incident can never occur.

13. Where information is processed

ITP operates in the United States. Information is processed in the United States and may also be processed in countries where relevant providers or support operations are located, subject to applicable protections and transfer requirements. This policy does not waive rights that apply where you live or constitute blanket consent to an international transfer.

14. Children and younger users

The Platform is intended for adults age 18 and older and is not directed to children. We do not knowingly collect personal information from children under 13 through the Platform. If you believe a child has provided information, contact us so that we can investigate and take appropriate action, including deletion where required. Do not upload unnecessary information about children in service messages or attachments.

15. Changes to this policy

We may update this policy as services, data practices, or requirements change. We will update the effective date and version and provide additional notice of material changes as required, such as a notice in the Platform or an email.

When a new use requires consent or another choice, we will provide it before the affected processing begins. We do not treat continued use alone as consent to a use for which affirmative consent is required. Changes to this policy do not alter the scope of an existing repair approval or decline.

16. Contact and request information

Platform operator: Inland Truck Parts and Service Privacy inquiries and requests: [PRIVACY CONTACT EMAIL] Privacy request form: [PRIVACY REQUEST WEB FORM] Privacy request telephone: [PRIVACY REQUEST PHONE] Account-deletion page: [PUBLIC WEB ACCOUNT-DELETION REQUEST URL] Mail: Attn: Privacy Requests, [BUSINESS MAILING ADDRESS] For questions about active repair work, contact the servicing location shown on your repair order. Privacy requests should use the channels above so they can be tracked and addressed.