Privacy Policy

1. Who We Are

1.1 Controller. CouthActs Incorporated, a Texas corporation ("CouthActs", "we", "us"), 1412 Main St STE 609, Dallas, TX 75202, United States, is the controller of the personal data described in this Privacy Policy, and the "business" for the purposes of the California Consumer Privacy Act.

1.2 Contact. Privacy questions and requests: privacy@couthacts.com. Post: CouthActs Incorporated, Attn: Privacy, 1412 Main St STE 609, Dallas, TX 75202, United States.

1.3 Scope. This policy covers www.couthacts.com, the CouthActs apps for iOS, iPadOS, macOS, tvOS, visionOS and Android, the CouthActs APIs, MCP server and OAuth connectors, the Academy, and our emails and support (together, the "Services"). It does not cover the practices of Providers, Customers, Stripe, app stores or AI assistant platforms, which act as independent controllers of the data they receive.

2. Personal Data We Collect

2.1 Information you choose to include. Job descriptions, messages and reviews are free text. Please do not include sensitive information, such as health details, unless it is necessary for the Job (for example, mobility needs for a medical transport). See Section 6 for consumer health data.

2.2 Information about others. If you give us information about another person (for example, a passenger or consignee), you must have their permission and tell them about this policy.

3. How We Use Personal Data and Our Legal Bases

We do not use personal data for targeted advertising, we do not make decisions based solely on automated processing that produce legal or similarly significant effects (verification outcomes are determined by Stripe's checks and may be reviewed by CouthActs staff on request), and we do not use your Content to train generative AI models.

4. Location Data

4.1 Providers. When a Provider starts location sharing for a Booking, the Provider's device reports its location: on iOS about every ten (10) seconds when the device has moved at least fifty (50) meters, including in the background during an active Booking; on Android about every fifteen (15) seconds through a foreground service with a visible notification; and on the web while the Booking page is open. Sharing stops when the Provider stops it, signs out, or the Booking ends. We do not collect location from Providers outside an active Booking, and we do not collect Customers' device location.

4.2 Who sees it. The Customer and the Provider on a Booking, when signed in, see the exact location and the full tracking history for that Booking. The Customer can also share a public tracking link, which uses a separate, randomly generated token that the Customer can replace or turn off at any time. Anyone with that link sees only the city or region of the pickup and delivery, an approximate position (rounded to about one kilometer) while the job is moving, and a timeline without coordinates or notes. A public link stops working twenty-four (24) hours after the Booking completes, or as soon as it is canceled or disputed. Tracking pages are not indexed by search engines and are rate limited. A location checkpoint, rounded to about one meter, is added to the Custody Record at most every five (5) minutes; Custody Records are signed and are kept as described in Sections 8 and 10.4.

4.3 Jobs. Providers who can bid on a Job, and visitors to the public load board (which lists freight-mode Jobs only), see the transport mode, the city or region of the pickup and delivery, dates, budget and a summary of the goods, with contact details removed from free text. Exact addresses, coordinates, special instructions and the Customer's identity are shown only to the Customer, the booked Provider and authorized CouthActs staff. Medical transport Jobs never appear on the public load board or activity feed, and bidders see only a generic description until the Job is booked.

5. Identity Verification and Biometric Information

5.1 What happens. CouthActs uses Stripe Identity, provided by Stripe, Inc. and its affiliates ("Stripe"), to verify identity. Stripe asks you to photograph a government-issued identity document and take a live selfie, and uses facial recognition technology to compare the selfie with the photo on the document. Data derived from this comparison may be a "biometric identifier" or "biometric information" under the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's biometric identifier law (RCW 19.375), the CCPA and other laws, and special category data under the GDPR.

5.2 What CouthActs receives. CouthActs receives only the result of the check (verified or not, with any reason) and the session ID. We read the first and last name on the document to compare it with your Account name, and, where Stripe returns it, the date of birth to confirm that you are 18 or older; we do not store either. We store only whether the age check passed. CouthActs does not receive, store, sell, lease, trade or profit from your ID images, selfie, face geometry or other biometric data.

5.3 Consent. Before the check starts, CouthActs shows you a written notice of the purpose, retention and destruction of your biometric data and asks you to give your written consent by ticking a box, for the purposes of the laws in Section 5.1, to have Stripe, as our service provider, collect, use and store your biometric identifiers and information for the sole purpose of verifying your identity and preventing fraud on the Services. The check does not start without that consent. Stripe also asks for your consent before capturing your selfie. We keep a record of your consent (the time, notice version, IP address, device and app). You may decline, or withdraw your consent at any time in Settings; if you do, any check in progress stops, we ask Stripe to destroy the data under Section 5.4, and you will not be able to use features that require verification.

5.4 Retention and destruction. Biometric identifiers and information are retained only as long as needed to complete the verification, resolve any challenge to it and meet legal obligations, and are permanently destroyed no later than the earliest of (a) when the purpose for collecting them has been satisfied, (b) one (1) year after that purpose expires, as required by Texas law, and (c) three (3) years after your last interaction with CouthActs. To meet this schedule, CouthActs instructs Stripe to permanently redact each verification session, which destroys the ID images, selfie and biometric data: thirty (30) days after the check reaches a final result (so that a result can be reviewed if challenged); ninety (90) days after the last activity on a verification that was not completed; immediately if you withdraw consent or the check shows you are under 18; and when you delete your Account. If a redaction request fails, we retry it daily. Stripe's own handling of this data is described in the Stripe Privacy Policy (opens in a new tab) (https://stripe.com/privacy) and its Stripe Identity disclosures.

5.5 Disclosure. Biometric data is not disclosed to anyone other than Stripe, except where required by law or valid legal process.

6. Consumer Health Data

Some Jobs, such as medical transport, may reveal information about a person's health. We ask for mobility and care needs, not diagnoses, and limit care notes to five hundred (500) characters. We use this information only to provide the Booking you request and for the related safety, support, dispute and legal purposes in Section 3. Medical transport Jobs are never shown on the public load board or activity feed, bidders see only a generic description, and the care details are shown only to the booked Provider. We delete free-text care details thirty (30) days after the Job ends. We share consumer health data only with the booked Provider and the service providers listed in our Subprocessor list, and with others only with your consent or as required by law. We do not sell it. Our Consumer Health Data Privacy Policy explains your rights under the Washington My Health My Data Act, Nevada law and similar laws, including the rights to access, delete and withdraw consent. CouthActs is not a covered entity under HIPAA; a medical transport Provider may be, and handles your information under its own obligations.

7. How We Share Personal Data

7.1 With other Users. We share information with other Users as needed for the marketplace:

• Jobs: Providers who can bid, and visitors to the public load board for freight-mode Jobs, see only the information described in Section 4.3. The Customer's identity, exact addresses and special instructions are shared only with the booked Provider.
• Bookings: the parties to a Booking see each other's names, contact details needed for the Job, messages and Booking details. The delivery PIN is shown only to the Customer. Each Provider sees only its own Bid on a Job.
• Public provider profiles show the Provider's business name, the name, city and country of the person who runs it, member-since date, CouthActs Score, tier, verification status, modes and reviews, including the reviewer's name. Provider credentials and badges are public and can be checked by anyone.
• Tracking and custody pages: the public tracking link shows only the information described in Section 4.2. The public custody page shows event types, times, hashes and signatures, but not amounts, locations or people.

7.2 Service providers (processors). We use service providers who process personal data on our behalf under contracts that limit their use of it. They are listed in our Subprocessor list. For push notifications, we send your device's push token and the notification's title, text and link to Apple Push Notification service (Apple Inc.) for Apple devices and to Firebase Cloud Messaging (Google LLC) for Android devices, which deliver them to your device.

7.3 Stripe as an independent controller. Stripe processes payment, payout and identity data both as our service provider and, for its own legal, fraud-prevention and compliance purposes, as an independent controller under the Stripe Privacy Policy.

7.4 AI assistants you connect. If you connect an AI assistant (such as Claude or ChatGPT) or another application through an Agent Key, OAuth or the MCP server, we send it the data its scopes allow, at your direction. Its use of that data is governed by its provider's terms and privacy policy.

7.5 Legal and safety. We may disclose personal data to comply with law or valid legal process, to respond to government requests as described in our Law Enforcement Guidelines, to protect the rights, property or safety of any person, to investigate fraud or violations of our terms, and in connection with a dispute or claim.

7.6 Corporate transactions. Personal data may be transferred to an acquirer or successor in a merger, acquisition, financing, reorganization or sale of assets, subject to this policy.

7.7 No sale, no sharing for advertising. We do not sell personal data, and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA and other U.S. state laws, and have not done so in the past twelve (12) months. We have no actual knowledge of selling or sharing the personal data of anyone under sixteen (16).

8. Retention

We keep personal data only as long as we need it for the purposes in Section 3, then delete or anonymize it. A daily automated job applies this schedule.

We may keep data longer where needed to comply with a legal obligation, to resolve a dispute or claim, or under a legal hold.

9. International Transfers

CouthActs is based in the United States, and our service providers process data in the United States and other countries. When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum and Swiss amendments) with our service providers, or on another lawful transfer mechanism. Data you send to CouthActs directly is processed in the United States as necessary to provide the Services you request. You may request a copy of the relevant safeguards by emailing privacy@couthacts.com.

10. Your Rights and Choices

10.1 Everyone. Wherever you live, you can: download a complete copy of your data in a machine-readable format, including your profile, Jobs, Bids, Bookings, messages, reviews, Wallet records, Custody Records, AI agent keys (without secrets) and their activity logs, OAuth connections, referrals, email preferences, and session and device information (web: Settings, then Data); correct your profile in Settings; delete your Account in the app (web: Settings, then Data; iOS and Android: Account, then Delete account); manage email preferences by category in Settings or from the link in any email; and turn off location sharing and push notifications in your device settings.

10.2 EEA, UK and Switzerland. You have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interests (including direct marketing), and to withdraw consent at any time without affecting earlier processing. You may complain to your data protection authority, for example in the UK the Information Commissioner's Office. We respond within one (1) month, which may be extended by two (2) months for complex requests.

10.3 U.S. state privacy rights. Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with comprehensive privacy laws have, as provided by those laws, the right to: know or access the personal data we process and obtain a portable copy; correct inaccurate data; delete data; opt out of the sale or sharing of personal data, targeted advertising and profiling with legal or similarly significant effects (we do not engage in these); and limit the use of sensitive personal data (we use it only for purposes permitted without that right). We will not discriminate against you for exercising your rights.

10.4 What account deletion does. When you delete your Account, we sign you out everywhere and delete: your sessions and push tokens; notifications; the messages you sent; your API keys and Agent Keys, their activity logs and your OAuth connections; your email preferences, referral code, availability notes and the people you've blocked (reports you filed are kept without your name); your bid messages and review text; the exact addresses and coordinates of your Jobs (reduced to city or region) and their free-text descriptions; tracking events, live position, delivery PINs and tracking links for your Bookings; your Provider business name, registration and license numbers (including USDOT, MC, FMCSA, IMO and FAA numbers), certifications, service area and verification documents; and your uploaded images and video, which are deleted from storage. We replace your name, email, phone, address and Stripe customer ID with anonymous values and ask Stripe to redact your identity verification session. We keep, without your contact details, the records the law or our legitimate interests require for seven (7) years: Bookings, payment holds, Wallet transactions and dispute records (with their narrative removed). Custody Records are also kept for seven (7) years; because each event is cryptographically signed and cannot be changed, the rounded location checkpoints in them are kept for that period, linked to the Booking rather than to your contact details. We also keep a one-way hash of your email address so that, if you register again, we do not send you marketing or any category of email you had turned off. Deletion cannot be completed while you have an open Booking, Job, dispute, Advance or Wallet balance; contact privacy@couthacts.com and we will help you close these out (see Section 2.3 of the Escrow and Payments Terms for refunds of unused balances).

10.5 How to make a request. Use the in-app tools above or email privacy@couthacts.com. We will verify your identity by confirming control of your Account email and, where needed, other information. An authorized agent may make a request for you with your signed permission; we may ask you to confirm it directly. We respond within forty-five (45) days, which may be extended by another forty-five (45) days where permitted.

10.6 Appeals. If we decline your request, you may appeal by emailing privacy@couthacts.com with the subject "Privacy appeal" within sixty (60) days. We will respond within the time required by your state's law (generally forty-five (45) or sixty (60) days). If we deny your appeal, you may contact your state Attorney General.

10.7 Global Privacy Control. We honor Global Privacy Control signals as a request to opt out of sale and sharing, although we do not sell or share personal data.

11. California Notice at Collection

In the past twelve (12) months we have collected the following categories of personal information defined in the CCPA: identifiers (such as name, email, phone, account and device identifiers, IP address); customer records (such as address and payment records); commercial information (Jobs, Bookings and transactions); biometric information (collected and processed by Stripe as our service provider, Section 5); internet or other electronic network activity (such as security logs); geolocation data (Provider precise location); audio, electronic or visual information (profile and fleet photos, uploaded documents); professional or employment-related information (Provider business, licensing and insurance information); education information (Academy records); and inferences (CouthActs Score). Sensitive personal information we collect includes account log-in credentials, precise geolocation, government identification and biometric information (through Stripe), the contents of messages for which we are not the intended recipient (chat, which we process to deliver it), and any health information you include. We collect these from the sources in Section 2, use them for the purposes in Section 3, disclose them for business purposes to the recipients in Section 7, keep them as described in Section 8, and do not sell or share them.

12. Children

The Services are for adults aged eighteen (18) and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an Account, contact privacy@couthacts.com and we will delete it.

13. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit (TLS), encryption at rest by our hosting and database providers, bcrypt password hashing, storage of API keys and Agent Keys only as keyed hashes (each key is shown to you once, when it is created), short-lived OAuth access tokens with rotating refresh tokens and reuse detection, HttpOnly and Secure session cookies, role-based access, private storage of Provider documents served only through short-lived signed links, rate limiting, and signed Custody Records. Error reports sent to our monitoring provider are scrubbed of request bodies, cookies, authentication headers, contact details and other personal data except an internal user ID. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as required by law. Report security issues to support@couthacts.com.

14. Communications

We send security and account emails (such as sign-in alerts, password changes, account status, data export and API key notices) whenever they are needed; these cannot be turned off. You choose by category whether to receive other emails: bookings, payments, messages, verification, AI agents, Academy, and marketing. Every optional email includes a link to manage your preferences without signing in and supports one-click unsubscribe (RFC 8058). In-app and push notifications about your Account and Bookings are part of the Services and can be turned off in your device settings.

15. Changes

We will post changes to this policy on this page, update the date above, and notify you by email or in the Services before material changes take effect. The version history below lists each version.

Version History