Nexscan — Privacy Policy

Effective Date: 10/1/2026

Verve LLC, a Washington limited liability company ("Nexscan," "we," "us," or "our"), operates the Nexscan mobile application and web dashboard (collectively, the "Services"). This Privacy Policy describes how we collect, use, store, and protect your information when you use the Services.

By using the Services, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Services.

1. Information We Collect

1.1 Information You Provide

When you create an account, join a fleet, or use the Services, we may collect:

• Account information: email address, password (stored in encrypted/hashed form — we never see or store your plain-text password), first name, last name, and phone number.
• Fleet information: fleet name, Fleet ID code, and your role within the fleet (owner, admin, driver, or viewer).
• Scanned documents: images or PDFs of documents you upload through the Services, filed under one of seven fixed tags (POD, Fuel Receipts, Scale Tickets, Customs Documents, Repair Invoices, Safety / DVIR, Other Expenses). The paperwork itself may include proofs of delivery, bills of lading, scale tickets, customs forms, fuel receipts, repair invoices, inspection reports, and other business documents.
• Document metadata: document tag, load number if you enter one, upload timestamp, page count, and the confirmation code issued as a receipt.

1.2 Information Collected Automatically

The mobile application contains no analytics, advertising, or crash-reporting software. What is recorded automatically is limited to:

• Device description at acceptance: when you accept the Terms in the mobile app, we record a short text description of your device model and operating system version, together with the app version, alongside your acceptance. It is recorded once, is not a unique device identifier, and is not updated afterwards.
• Online/offline status: the app checks whether your device has connectivity so it can hold documents in the offline queue and upload them later. This check happens on your device and is not sent to us.
• Server logs: our hosting providers (Supabase and Vercel) keep standard server access logs, which include the IP address and time of each request to our servers.

We do not collect usage analytics (such as pages viewed or features used), and we do not receive crash reports.

1.3 Waitlist

If you ask to join the waitlist on our website, we collect your name, email address, and, if you choose to give them, your phone number and fleet size. We also record that you ticked the consent box, the exact wording you were shown, the time, and the IP address and browser the request came from.

We use this only to email you when access opens. We do not sell or share it, and we do not use it to call or text you. To be removed, email support@nexscan.app and we will delete your waitlist record.

1.4 Information We Do NOT Collect

• We do not collect your GPS location or track your movements.
• We do not access your contacts, photos, or files outside of documents you explicitly choose to scan.
• We do not collect biometric data.
• We do not read or analyze the content of your scanned documents for advertising or marketing purposes.

2. How We Use Your Information

We use your information solely to provide, maintain, and improve the Services:

We do NOT use your information for:

• Advertising or marketing by third parties
• Selling or renting to any third party
• Building marketing profiles about you
• Artificial-intelligence or text-extraction processing of any kind — we do not send your documents to any AI or text-extraction vendor

3. How We Share Your Information

We do not sell, rent, or trade your personal information. Period.

We share your information only in the following limited circumstances:

3.1 Within Your Fleet

Your scanned documents and profile information (name, email, role) are visible to authorized members of your fleet based on role-based access controls:

• Drivers can only see their own uploaded documents.
• Fleet owners and administrators can see all documents within their fleet and all team member profiles.
• Viewers can see all documents within the fleet (read-only).

No other fleet can see your information.

3.2 Service Providers

We use trusted third-party service providers to operate the Services. These providers access your data only to perform services on our behalf and are contractually obligated to protect your information:

The mobile app is distributed through the Apple App Store and Google Play. Apple and Google hold whatever account and download records their stores keep about you under their own privacy policies; we do not receive any of it, and they do not receive your documents or account data from us.

We do not allow these providers to use your data for their own purposes. They may only process your data as instructed by us and are subject to confidentiality obligations.

3.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to:

• Comply with applicable law or legal process;
• Protect the rights, property, or safety of Nexscan, our users, or the public;
• Detect, prevent, or address fraud, security, or technical issues; or
• Enforce our Terms of Service.

3.4 Business Transfers

If Verve LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

4. Data Storage and Security

4.1 Where Your Data Is Stored

Your data is stored on servers operated by Supabase, located in the United States. If you are accessing the Services from outside the United States, your information will be transferred to and processed in the United States.

4.2 How We Protect Your Data

We implement industry-standard security measures to protect your information:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: Your data is encrypted at rest on our database and storage servers.
• Authentication tokens: Session tokens on mobile devices are encrypted with a random 256-bit AES key generated on the device. Only that key is kept in the iOS Keychain or Android Keystore-backed secure storage; the encrypted token is kept in the app's private storage. Tokens are never stored in plain text.
• Row-Level Security: Database access is enforced through row-level security policies — your data queries are restricted to only the data you are authorized to see based on your fleet membership and role.
• Access controls: Role-based access ensures drivers can only see their own uploads, while fleet owners can view all fleet documents.
• No plain-text passwords: Passwords are hashed using bcrypt before storage. We never store or have access to your plain-text password.
• Signed URLs: Document images are accessed through time-limited signed URLs (1-hour expiry) rather than permanent public links.

4.3 What We Cannot Guarantee

While we take reasonable measures to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

5. Data Retention

• Account data: Retained for as long as your account is active. When your account is terminated, or you ask us to delete it, we delete your personal data without undue delay, and in any event within 30 days, except where we are required by law to retain it.
• Scanned documents: Retained for as long as your fleet account is active. Fleet owners and administrators may delete individual documents at any time; deleted documents are held for 30 days, during which they can be restored, and are then permanently removed. Upon fleet account termination, or on the fleet owner's written request, documents are deleted without undue delay, and in any event within 30 days, except where we are required by law to retain them.
• Waitlist records: Retained until you ask to be removed or until access opens and you are invited.
• Offline-queued documents: Documents scanned while offline are stored locally on your device until uploaded. We do not have access to documents stored only on your device.

6. Your Rights and Choices

6.1 All Users

You have the right to:

• Access your personal information through your profile and account settings.
• Update your account information at any time.
• Delete your account by contacting us at support@nexscan.app. We delete your personal data without undue delay, and in any event within 30 days, except where we are required by law to retain it.
• Export your data by contacting us at support@nexscan.app.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to Know: You can request that we disclose what personal information we have collected, used, and shared about you.
• Right to Delete: You can request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. There is nothing to opt out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise these rights, contact us at support@nexscan.app. We will respond within 45 days.

6.3 European Economic Area Residents (GDPR)

If you are located in the European Economic Area, you have additional rights:

• Right to access, correct, or delete your personal data.
• Right to restrict or object to our processing of your personal data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint with your local data protection authority.

Our legal basis for processing your data is the performance of our contract with you (providing the Services) and our legitimate interests in operating and improving the Services.

To exercise these rights, contact us at support@nexscan.app.

7. Children's Privacy

The Services are not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will promptly delete that information. If you believe a child under 18 has provided us with personal information, please contact us at support@nexscan.app.

8. Cookies and Tracking (Web Dashboard Only)

The Nexscan web dashboard uses only essential cookies required for authentication and session management. We do not use:

• Advertising cookies or tracking pixels
• Third-party analytics cookies (e.g., Google Analytics)
• Social media tracking cookies
• Cross-site tracking of any kind

The mobile application does not use cookies.

9. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Sending an email to the address associated with your account; and/or
• Posting a notice in the Services.

The updated Privacy Policy will be effective on the date stated at the top of the revised policy. Your continued use of the Services after the effective date constitutes your acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Verve LLC Email: support@nexscan.app

Last updated: 10/1/2026