Effective 2026-10-09 · Rev 20

Privacy Policy

CarrierScrub is operated by Hexoglyph Holdings, LLC, a Utah limited liability company, 829 W 25 N, Clearfield, UT 84015.

When you sign in with Google we store the name, email address and profile picture Google returns. When you sign in with an emailed link we store your email address, and a one-way hash of each link for a day so that it can only be used once. When you create a brokerage we store its name and the onboarding answers you give (approximate loads per month and freight type). We store the USDOT and MC numbers you look up, the verdict each returned, and the results of any batch upload including the file name. If you use the Compliance Assistant we store the questions you ask and the answers returned. If you write to us through the contact page, or by email to one of our @carrierscrub.com addresses, we store what you send, including any attachments.

If you run a Shield check we store the phone number you entered, the carrier you checked it against, and what the identity vendor returned about that number: whether it matched, the line type, an activity score and the vendor's match grade. If you also enter the email the caller wrote from, we keep only its domain (the part after the @) with the check, alongside what the vendor said about the address; the full address is not stored. We do not receive, and so do not store, the name of the person the number or email belongs to.

If you use the chat bubble on our public pages we store the conversation: your messages, the answers, the page you started on, your country, and a keyed hash of your IP address that we use only to enforce daily limits. If the chat asks for your email address so a person can follow up and you give it, we store that too. Giving it is optional. If you call our toll-free number, our telephone carrier receives the number you call from. If you choose to speak to someone, the call is forwarded to a phone on our team, which may show your number. If you leave a voicemail, it is recorded and transcribed, and an AI model reads the transcript to pull out the name, company, callback number and USDOT or MC number you give. We keep a copy of the recording, and the transcript, those details, your number and a link to the recording are emailed to us.

If you subscribe to the weekly FMCSA report, we store your email address, whether you subscribed from the form on our site or from your account, when you confirmed it, and when you unsubscribe. Nobody is put on that list without asking: the form only sends a confirmation link, and the report starts when you open it and confirm.

If you buy a Deep mover check, you pay through Stripe (see 03) and we keep nothing about you: the check is tied only to its Stripe receipt, which is kept in your own browser so you can open the check again for 24 hours. What the check finds about the moving company is worked out when you open it and is not stored.

We do not collect data on carriers beyond what FMCSA already publishes. The free public lookup writes nothing about you: anonymous lookups are not recorded against any account. CarrierScrub is a business tool for freight brokers, not directed at children, and we do not knowingly collect information from anyone under 18.

To run the checks you request, keep your lookup history and watchlist, generate and verify print packets, bill your plan, notify you when a watched carrier's verdict changes, send the weekly FMCSA report to those who asked for it, answer your messages, and hand a chat conversation to a person when you ask for one. We never sell lookup data, we never sell or share the phone numbers you run through Shield, and we never use your lookups to build a profile of any carrier.

• Google handles sign-in with Google. There are no passwords, so we never see or store one. Google also holds a copy of the email you send us, in our team’s mailbox.
• Cloudflare hosts the service and the database, receives the email you send to our @carrierscrub.com addresses, stores voicemail recordings, and runs the AI model that reads voicemail transcripts, so they are not sent to any other AI company.
• Stripe and Link handle payment. Purchases are sold through Link, Stripe’s checkout, with Stripe as merchant of record: Stripe and Link receive your name, email, billing address and payment details to take the payment, calculate and collect sales tax, send your receipt, and handle refunds and disputes. Your card statement shows LINK.COM* CARRIERSCRUB. Card numbers go to Stripe directly and are never stored by us. Stripe’s and Link’s own privacy policies (stripe.com/privacy, link.com/privacy) cover what they do with it.
• Amazon Web Services sends our email (sign-in links, watchlist alerts, the weekly FMCSA report and its confirmation links, invites, contact-form forwards, chat hand-offs, voicemail transcripts, and our replies to email you send us) and tells us when an address bounces or marks us as spam, so we can stop emailing it.
• DeepSeek answers Compliance Assistant questions and the public chat. Your questions are sent to it; carrier lookups are not. For the public chat, email addresses and phone numbers in your message are masked before it leaves us.
• Trestle checks the phone number, and the email if you add one, that you enter in a Shield check. We send them together with the carrier's FMCSA-registered officer name, legal name and address, and Trestle answers whether they are associated with the carrier, what kind of line the number is, how active it is, and whether the email is valid, deliverable and how old it is. On a paid lookup we also send Trestle the telephone number and physical address on the carrier's own FMCSA registration, which are public record, to check whether the number is in service and the address is a real postal address; nothing about you is sent with that check. A Deep check sends Trestle the carrier's FMCSA-registered phone number, officer name, legal name and address, and Trestle answers whether the number is linked to the carrier, the business it is registered to (never a person's name) and whether it is flagged for spam or fraud activity. Trestle's own use of these queries is governed by its privacy policy.
• Google Maps Platform runs the Deep mover check and the Deep check on carriers. We send Google the moving company's name and physical address as they appear on its FMCSA registration, which are public record, so Google can check the address against USPS data and find the company's Google listing; for a carrier we also send the phone number on its FMCSA registration, to find which business Google lists for it. A Deep check is recorded against your brokerage (who ran it, which carrier, when and what it cost) so it can be billed; what it found is not. Nothing about you is sent with it, and we do not keep what Google returns. The check also reads the moving company's own website home page and asks its domain registry when the domain was registered.
• Telnyx carries calls to our toll-free number, forwards them to our team when you ask to speak to someone, and records and transcribes any voicemail you leave.
• Google Analytics measures how the site is used: which pages are viewed, the rough location and the device and browser of each visit. It receives each page’s address without its query string, so the numbers you look up and your sign-in links are never sent to it. When a visit ends in a purchase, our server also tells it what was bought (a plan, lookup credits, Shield checks or a Deep mover check) and the price, so we can see which pages and campaigns lead to sales; it never receives your name, email or payment details. If you came to us by clicking one of our Google ads, Google Analytics also passes that click, and any purchase that follows it, to Google Ads, so we can tell which ads lead to sales. Nothing here is used to show you ads: ad personalization and Google signals are turned off, and in the EEA, the UK and Switzerland the ad-click measurement is off as well.
• Microsoft Clarity shows how the site is used, as heatmaps and session replays: clicks, scrolling, mouse movement and the text on each page, along with the page’s full address (on a lookup page, that includes the carrier you searched for), the device and browser, and a rough location. It is never loaded on the email sign-in page, and the signed-in app (dashboard, batch, history, notifications, admin and API keys, onboarding, the compliance assistant) and the chat window are masked, so what they show is never sent to it.

One session cookie keeps you signed in. Your light-or-dark theme choice is kept in your browser's local storage. We run our own analytics and two outside services. Our own first-party analytics keep a random visitor id in local storage, not a cookie, so we can join a lookup to the signup that followed it, alongside the page path, the referring site's domain, any campaign tags in the link you followed (utm_source, utm_medium and utm_campaign) and whether that link came from an ad click; they store no IP address, no user agent and no third-party identifier, and not an ad click's id. Google Analytics sets its own cookies on our domain (named _ga) to recognise a returning visit, and, outside the EEA, the UK and Switzerland, cookies named _gcl_ that remember a click on one of our Google ads so a later purchase can be matched to it. Google uses your IP address to estimate a rough location, under Google's own privacy policy. Microsoft Clarity sets its own cookies (named _clck and _clsk) to join the pages of one visit into one recording, under the Microsoft Privacy Statement. All three stop entirely if your browser sends Do Not Track or Global Privacy Control, and Google's opt-out browser add-on also blocks Google Analytics. Nothing on this site is used to target ads at you: the _gcl_ cookies only connect a click on our own ad to a purchase here. The public chat keeps a signed conversation token in your browser so the window can resume the same conversation; it identifies the conversation, not you. A Deep mover check keeps its Stripe receipt in your browser's local storage for 24 hours, so the check opens again on the mover page; it is taken out of the page address as soon as you return from checkout.

All traffic to CarrierScrub is encrypted in transit. There are no passwords: you sign in with Google or with a link that works once and expires after 15 minutes, so there is no password for us to store or lose. Access to a brokerage's lookups, watchlist, Shield checks and packets is scoped to the members of that brokerage. No system is unbreakable; if we learn of a breach affecting your data we will notify you.

Lookup history, Shield checks, watchlist, packets and notifications are kept for as long as your brokerage's account exists, because a print packet's verification link has to keep resolving. Print-packet verification pages show only the carrier, verdict, issuing brokerage and timestamps; load numbers, notes and the checker's name never leave your organization.

Public chat conversations are deleted 90 days after their last message. An email address that bounces, marks us as spam, or unsubscribes goes on a suppression list and stays there so we do not email it again; write to us if you want it taken off. Voicemail recordings and transcripts, and email you send us, are kept until we delete them. A weekly report subscription lasts until you unsubscribe; the address then stays on the list marked unsubscribed, so the report is not sent to it again, and we remove it entirely if you ask.

Wherever you're located, you may ask for a copy of your account data, or ask us to delete your account, by writing to privacy@carrierscrub.com from the email address on the account. Deletion removes your user record and, if you are the last member, your brokerage's data. It does not recall packets already handed to third parties, though their verification links will stop resolving. If you used the public chat without an account, tell us the approximate date and the email address you gave, if any, and we will delete the conversation. If you left us a voicemail, tell us the number you called from and roughly when, and we will delete the recording and its transcript. Deleting your account also deletes the email you sent us from its address, and our replies. Payment records are held by Stripe and Link: you can see your orders and manage a subscription at app.link.com, and ask Link to delete the payment data it holds, which also cancels any subscription bought through it. Every weekly FMCSA report has a one-click unsubscribe link, and a signed-in account can also turn it off on the Notifications page.

The effective date and revision number at the top of this page change whenever this policy does.

Questions about this policy: privacy@carrierscrub.com, or the contact page.