DrvnOS Privacy Policy

Effective Date: October 6, 2026 Last Updated: October 25, 2026

This Privacy Policy describes how Devin Gregory Thompson ("DrvnOS," "we," "us," or "our") collects, uses, shares, and protects information in connection with the DrvnOS bookkeeping and back-office service (the "Service"), including our website, web application, customer portal, and related integrations.

DrvnOS provides automated bookkeeping and back-office services for trucking owner-operators and small fleets in the United States. By accessing or using the Service, you agree to the practices described in this Privacy Policy.

1. Introduction & Scope

DrvnOS is a business-to-business service. Our customers are businesses — owner-operators and small trucking fleets (typically 1–10 trucks) operating in the United States. The information we handle is primarily business information belonging to those companies, along with limited personal contact information for the individuals who administer those accounts.

This Privacy Policy applies to:

• Our public marketing website at www.drvnos.com.
• The DrvnOS customer portal and administrative application.
• Information we receive through our integrations with third-party services (described in Section 5).

This Privacy Policy does not govern:

• The privacy practices of the third-party services we integrate with (Intuit/QuickBooks Online, Stripe, Anthropic, and others). Their handling of your data is governed by their privacy policies.
• Information you provide directly to your own CPA, Enrolled Agent, bank, or other third parties.

2. Information We Collect

We collect the following categories of information.

2.1 Account & Contact Information

• Your name and the name of your business.
• Business email address and (optionally) phone number.
• Business mailing address.
• Business entity type and, where you provide it for bookkeeping purposes, business identifiers such as an Employer Identification Number (EIN).
• You can sign in with a one-time email link or with an email and password. Passwords are handled by our authentication provider (Supabase) and are stored only in hashed form; DrvnOS staff never see them.

2.2 Financial & Accounting Data

• Bookkeeping and accounting records, including transactions, categorizations, chart-of-accounts data, profit-and-loss and balance-sheet figures, and reconciliation data.
• Receipt and expense images you upload (via the in-app camera or a connected receipt service) and the data extracted from them.
• Fuel, mileage, and per diem expense data.
• Vendor and customer records associated with your books.

Most of this data resides in your QuickBooks Online company file (hosted by Intuit) and/or in our application database, depending on the feature.

2.3 Payment Information

• Subscription and billing status, plan, and transaction history (e.g., setup fee and monthly fee).
• We do not collect or store full payment card numbers. All card data is collected and processed directly by Stripe, our PCI-compliant payment processor. We receive only limited, non-sensitive payment metadata from Stripe (such as a customer ID, subscription status, last four digits, and payment outcome).

2.4 Integration Tokens & Credentials

• OAuth access and refresh tokens that authorize DrvnOS to connect to your QuickBooks Online file (where the QBO OAuth integration is enabled for your account).
• Configuration data for any receipt or automation integrations you connect.
• We do not receive or store your bank login credentials. Where a bank feed is used, those credentials are entered directly into the relevant third-party provider (e.g., the bank-feed connector within QuickBooks Online) — never to DrvnOS.

2.5 Usage & Technical Data

• Log data such as IP address, browser type, device type, pages or features accessed, and timestamps.
• Diagnostic and error data used to operate and improve the Service.

We do not intentionally collect "special categories" of personal data (such as health, biometric, or government-ID numbers beyond a business EIN you choose to provide for bookkeeping).

3. How We Use Information

We use the information we collect to:

• Provide the Service — set up and maintain your bookkeeping, categorize transactions, reconcile accounts, complete monthly closes, produce reports, prepare quarterly estimated-tax worksheets and year-end CPA handoff packets, and operate the customer portal.
• Process payments — bill the setup fee and recurring monthly subscription through Stripe and manage your subscription status.
• Communicate with you — send service emails (e.g., login links, close packets, reminders, support replies) and respond to your questions.
• Operate integrations — sync data to and from QuickBooks Online, process receipts, and run the automations needed to deliver the Service.
• Maintain security and prevent fraud — authenticate users, detect and prevent abuse, and protect the integrity of the Service.
• Improve the Service — analyze usage and diagnostic data to fix problems and enhance features.
• Comply with law — meet our legal, tax, accounting, and regulatory obligations.

We do not sell your personal information, and we do not use your QuickBooks Online data for advertising or for any purpose other than providing and improving the Service to you (see Section 5).

4. How We Share Information

We share information only as described below. We do not sell your personal or financial information.

4.1 Service Subprocessors

We share information with vendors that help us deliver the Service. These subprocessors are authorized to use the information only to provide services to DrvnOS and are bound by confidentiality and data-protection obligations. Our current key subprocessors are:

We may add, remove, or change subprocessors as the Service evolves; we will update this Policy accordingly.

4.2 At Your Direction

We share your information with third parties when you ask us to — for example, sending your year-end packet or books to your CPA, Enrolled Agent, or other tax professional at your written request.

4.3 Legal & Protective Disclosures

We may disclose information when we believe in good faith it is necessary to: comply with applicable law, regulation, subpoena, court order, or governmental request; enforce our agreements; or protect the rights, property, or safety of DrvnOS, our customers, or others.

4.4 Business Transfers

If DrvnOS is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy with materially similar protections.

5. Third-Party Integrations & Intuit (QuickBooks Online) — Specific Disclosures

The Service relies on third-party integrations. When you connect a third-party account, you authorize DrvnOS to access and use data from that service as needed to provide the Service, and that third party's own privacy policy and terms also apply to you.

5.1 Intuit / QuickBooks Online — Data Use Commitments

DrvnOS connects to QuickBooks Online ("QBO") through Intuit's authorized OAuth integration. We are committed to handling QuickBooks data in accordance with Intuit's API Terms of Service and applicable Intuit data-use and security requirements. Specifically:

• Limited purpose. We access and use QuickBooks Online data solely to provide the bookkeeping and back-office Service to you — for example, to read, categorize, reconcile, and report on your transactions and to produce closes, estimates, and year-end packets.
• No sale of QBO data. We do not sell, rent, or license QuickBooks data, and we do not use QuickBooks data for advertising or for building unrelated products.
• No unauthorized use. We do not use QuickBooks data for any purpose other than delivering the Service to the customer whose data it is, except as that customer directs or as required by law.
• Token security. OAuth access and refresh tokens are stored securely (encrypted) and are used only to make authorized API calls on your behalf. You may revoke DrvnOS's access at any time (see Section 8.4).
• Minimum scope. We request only the QuickBooks API scopes reasonably necessary to deliver the Service.
• Data retention/deletion. When you disconnect QuickBooks Online or terminate the Service, we stop accessing your QBO data and handle any retained copies in accordance with Section 7.

If there is any conflict between this Privacy Policy and Intuit's requirements as applied to QuickBooks data, we will handle QuickBooks data in the manner required by Intuit.

5.2 Stripe

Payments are processed by Stripe. Card details are entered directly with Stripe and are governed by Stripe's privacy policy. DrvnOS does not store full card numbers.

5.3 In-App Receipt Capture and AI Reading

Customers capture receipts with the DrvnOS in-app camera or by uploading a photo. Receipt images are sent to our AI provider (Anthropic) solely to read the receipt and suggest a category. High-confidence results are recorded automatically; lower-confidence results are shown to you to confirm. Our AI provider does not use your receipt data to train its models under our commercial terms, and receipt images and extracted data are used only to record and categorize your expenses.

6. Data Storage & Security

• Where data lives. Application data (your portal account, transaction metadata, messages, and receipt images) is stored in Supabase infrastructure provided through Lovable Cloud. Your accounting data primarily resides in QuickBooks Online (hosted by Intuit). Payment data is held by Stripe.
• Encryption. Data is encrypted in transit (TLS) and at rest using industry-standard methods.
• Access controls. We restrict access to your data to authorized personnel who need it to operate the Service, and we use authentication and access-control measures (including row-level security on our application database).
• Token handling. Integration tokens (such as QBO OAuth tokens) are stored securely and used only for authorized API calls.
• No absolute guarantee. No method of transmission or storage is 100% secure. While we work to protect your information using reasonable safeguards, we cannot guarantee absolute security. You are responsible for keeping your account access (e.g., email inbox used for magic-link login) secure.

7. Data Retention

• We retain your information for as long as your account is active and as needed to provide the Service.
• After you terminate the Service, we retain certain records (such as work product, books, and supporting documents) as needed to meet professional record-retention practices, tax/accounting obligations, and applicable law.
• Upon termination, and consistent with our engagement terms, we can provide you with an export of your QuickBooks Online file and the receipt images and supporting documents stored in your DrvnOS portal.
• When data is no longer needed for the purposes above, we delete or de-identify it. We stop accessing your QuickBooks Online data once you disconnect the integration or terminate the Service.

8. Your Rights & Choices

8.1 Access & Correction

You may request access to, or correction of, the personal and business information we hold about you. Much of your data is also directly visible to you in the DrvnOS portal and your QuickBooks Online file.

8.2 Data Export

You may request an export of your books and supporting documents as described in Section 7.

8.3 Deletion

You may request deletion of your personal information, subject to our need to retain certain records for legal, tax, accounting, and record-retention purposes.

8.4 Revoking Integration Access

You may disconnect any connected integration at any time. For QuickBooks Online, you can revoke DrvnOS's access from within your Intuit account settings and/or from the DrvnOS portal. Revoking access stops further data sharing through that integration.

8.5 Communications

We will send you service-related communications necessary to operate the Service. You may opt out of non-essential marketing emails at any time.

8.6 State Privacy Rights

Depending on your state of residence (for example, California under the CCPA/CPRA), you may have additional rights regarding your personal information, such as the right to know, delete, correct, and to opt out of "sale" or "sharing" (note: DrvnOS does not sell personal information). To exercise any of these rights, email us at the address below.

To exercise any of these rights, contact us using the information in Section 12. We may need to verify your identity (or your authority to act for the business account) before fulfilling a request.

9. Cookies & Tracking Technologies

Our website and application use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand how the Service is used. We use:

• Essential cookies — required for authentication and core functionality.
• Analytics/diagnostic technologies — to understand usage and improve the Service.

You can control cookies through your browser settings; disabling essential cookies may prevent the Service from functioning.

10. Children's Privacy

The Service is a business tool intended for use by businesses and individuals 18 years of age or older. The Service is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it. If you believe a minor has provided us information, please contact us.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, integrations, or legal requirements. When we make material changes, we will update the "Last Updated" date above and, where appropriate, provide additional notice (such as an email or an in-app notice). Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our handling of your information, contact us at:

Devin Gregory Thompson (DrvnOS) Attn: Privacy 2505 Iris Lane Crest Hill, IL 60403 Email: support@drvnos.com Website: https://drvnos.com

State of organization: Illinois (sole proprietorship — no separate registered entity)