Privacy Policy

This Policy is written for RoadKept's current web service and is forward-compatible with optional mobile location tracking and connected-account features. Those features apply only if launched and enabled by the user.

U.S.-first SaaS policy for independent drivers and tax professionals

1. Scope and Roles

This Privacy Policy explains how Aven Crest Technologies LLC, doing business as RoadKept ("RoadKept," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you use our websites, web application, future mobile applications, communications, reports, exports, and related services (collectively, the "Service").

This Policy applies when RoadKept determines why and how personal information is processed. If an employer, accounting firm, tax professional, or other organization provides or administers your access under a separate agreement, that organization may control some information and RoadKept may process it on the organization's behalf. Direct questions about organization-controlled data to that organization first. A separate data processing addendum may apply.

This Policy does not govern third-party websites, work platforms, financial providers, app stores, tax professionals, or services that link to RoadKept or that you connect to the Service. Their privacy notices govern their independent practices.

2. Information We Collect

Information categories

Sensitive information

Some information may be legally sensitive, including precise geolocation, taxpayer or government identifiers, financial information, account credentials, and data that reveals tax, business, health-related purchase, or other private circumstances. Tax forms, 1099s, receipts, and imported documents may contain sensitive values even when RoadKept does not request them. RoadKept processes sensitive information only as reasonably necessary for requested features, security, legal compliance, or another purpose permitted by law. Mask values the feature does not require, and do not upload full Social Security numbers, full financial-account credentials, health records, biometric identifiers, or unrelated highly sensitive material unless a RoadKept feature clearly requests it and is designed for that data.

Information not collected as raw values

RoadKept uses a trusted authentication service and does not store raw passwords. When payments are offered, Stripe processes full payment-card details; RoadKept generally receives only limited billing information such as plan, status, card brand, last four digits, expiration month/year, processor customer ID, and transaction status. If financial-account connections are offered, supported connection providers collect the credentials or authorization needed to connect the account; RoadKept receives provider tokens and authorized account data rather than full online-banking credentials.

3. How We Collect Information

• Directly from you, when you register, configure a tax profile, enter trips or expenses, scan receipts, upload files, ask AI questions, contact support, subscribe, or change settings.
• Automatically from your browser, device, cookies, and use of the Service, including diagnostics, security events, and feature interactions.
• From location or device permissions, only when a location-enabled feature is available and you enable the relevant permission.
• From services you connect or files you import, such as platform earnings reports, CSV/PDF files, financial providers, storage services, or accounting tools.
• From an authorized organization or professional, such as a tax preparer who creates or manages a workspace for you.
• From service providers and public or commercial sources used for fraud prevention, address/time-zone normalization, tax-rule maintenance, customer support, or legal compliance.

4. How We Use Information

• Provide the Service, authenticate users, maintain accounts, process subscriptions, and deliver support.
• Record and organize trips, mileage, earnings, expenses, receipts, tax assumptions, documents, and audit evidence.
• Extract information using OCR; classify records; calculate estimates using versioned rules; identify gaps; generate reports and exports; and provide AI-assisted responses.
• Remember user-selected rules and preferences, reconcile imported information, prevent duplicates, and preserve provenance or event history so changes can be reviewed and reversed.
• Communicate about security, transactions, trials, renewals, deadlines, product changes, support, and optional marketing.
• Secure, monitor, debug, test, improve, and measure the Service; prevent fraud, abuse, unauthorized access, and tenant-data leakage.
• Comply with law, respond to lawful requests, enforce agreements, resolve disputes, and protect users, RoadKept, and the public.
• Create aggregated or de-identified information for analytics, research, service improvement, and lawful business purposes.

Where a law requires a legal basis, our bases may include performing a contract, your consent, compliance with law, and legitimate interests such as security, support, and product improvement, balanced against your rights. You may withdraw consent for future processing where consent is the basis, without affecting prior lawful processing.

5. How We Disclose Information

We disclose personal information only as described below, at your direction, or as otherwise disclosed when collected:

• Service providers. Hosting, database, storage, authentication, email, customer-support, error-monitoring, analytics, OCR, AI, security, and payment providers process information under contractual restrictions to perform services for RoadKept.
• Professionals and authorized users. We disclose information to a tax professional, accountant, team member, client, or recipient when you invite them, join their workspace, generate a share or export, or otherwise direct the disclosure.
• Connected services. We exchange information with a third-party service when you connect it or request an import, export, or other integration.
• Legal and safety. We may disclose information when reasonably necessary to comply with law or valid process; protect rights, safety, and security; investigate fraud or abuse; enforce agreements; or establish, exercise, or defend legal claims.
• Business transfers. Information may be disclosed in due diligence or transferred in a merger, financing, reorganization, bankruptcy, acquisition, or sale of assets, subject to appropriate confidentiality and notice obligations.
• With consent. We may disclose information for another purpose when you give informed consent.

Service providers receive only information reasonably necessary for their role and are restricted by contract and, where applicable, service-provider or contractor terms. RoadKept does not authorize them to use personal information for their own unrelated marketing, cross-context behavioral advertising, or independent profiling.

6. Our Sale and Advertising Commitments

RoadKept does not sell personal information for money or other valuable consideration. RoadKept does not share personal information for cross-context behavioral advertising and does not process personal information for targeted advertising as those terms are defined by applicable U.S. state privacy laws. Analytics providers, if used, must act for RoadKept under appropriate restrictions rather than combine RoadKept data for their own advertising. We do not use sensitive information to infer characteristics for advertising.

If our practices change, we will update this Policy, provide any required notice, and offer legally required opt-out or consent controls before the new practice begins. We will honor legally recognized universal opt-out signals for processing that is subject to an opt-out right. Because we do not currently sell or use data for targeted advertising, such a signal ordinarily will not change the core Service processing described here.

7. Location and Mileage Data

RoadKept's current web service supports entered, odometer, bulk, and imported mileage records. If we make automatic GPS or background tracking available, RoadKept will provide a feature-specific notice and require a clear user action and relevant device permission before collection begins. Collection will follow the permission and feature state you select. Depending on platform capabilities, this may include precise or approximate location, route points, timestamps, speed or motion signals, and derived trip information.

• Purpose limitation. We use location to detect or reconstruct trips, calculate mileage, support business/personal classification, identify recurring locations, prevent fraud, troubleshoot the feature, and generate records you request.
• User control. You can disable a tracking session, revoke device permission, or turn off a location feature in the Service or operating-system settings. Disabling collection stops new device-location collection but does not automatically delete prior trip records.
• No location advertising. We do not sell location data or use precise location for cross-context behavioral advertising.
• No sensitive-place profiling. We do not use trip or location data to infer health conditions, religious beliefs, political activity, union membership, or other sensitive traits.
• Retention separation. Raw precise route points and derived trip records may have different retention periods. The applicable periods and deletion controls are described in Section 10 and any feature-specific notice.
• Accuracy. GPS and derived mileage may be incomplete or inaccurate. You should review trip records and may correct or delete them.
• Other people. Do not use RoadKept to track another person or vehicle without authority and any legally required notice and consent.

8. AI, OCR, and Automated Processing

We may use AI, machine learning, OCR, and deterministic rules to extract receipt data, categorize trips and expenses, identify missing information, answer questions, and generate estimates or reports. Relevant prompts, documents, images, extracted text, account context, and feedback may be sent to vetted providers to perform the requested function.

We contractually restrict providers from using RoadKept personal information for their own advertising or unrelated purposes. RoadKept does not permit third-party AI providers to use User Data to train generalized models for other customers, and RoadKept does not use identifiable User Data to train a generalized or foundation model, unless we first provide a separate clear disclosure and obtain any consent required by law. We may use de-identified or aggregated information to evaluate and improve features, and we maintain it in de-identified form as described in this Policy.

AI outputs may be inaccurate. We log selected inputs, outputs, confidence signals, corrections, and provenance when reasonably needed for safety, support, auditability, and improvement. Human personnel may review limited information when necessary to investigate an error, abuse, security incident, or support request, subject to access controls and confidentiality obligations.

9. Cookies and Similar Technologies

We and our service providers use cookies, local storage, pixels, SDKs, and similar technologies for authentication, session continuity, preferences, security, performance, diagnostics, and analytics. Essential technologies are required for the Service. RoadKept does not currently deploy third-party advertising cookies or pixels for cross-context behavioral advertising. Where required, we obtain consent before using nonessential analytics or marketing technologies.

You can manage available choices through https://www.roadkept.com/privacy#9-cookies-and-similar-technologies, browser settings, and any consent controls we provide. Blocking essential technologies may prevent login or other features. Browser "Do Not Track" signals are not interpreted consistently across the industry; RoadKept responds to legally recognized opt-out preference signals as described above.

10. Data Retention

We keep personal information only as long as reasonably necessary for the purposes described, including providing user-controlled historical records, satisfying tax and accounting obligations, resolving disputes, enforcing agreements, protecting security, and complying with law. Actual periods depend on the record, account state, legal duties, backup cycles, and whether information is needed for an active investigation or claim.

When retention ends, we delete, anonymize, or securely isolate the information. Deletion may not remove information already exported by you or disclosed at your direction. We may retain de-identified information without a time limit if it cannot reasonably be linked to you and is maintained in de-identified form.

11. Security

We use administrative, technical, and physical safeguards designed for the nature of the information we process. Measures may include encryption in transit and at rest where appropriate, role-based and tenant-scoped access, authentication controls, least-privilege practices, logging, monitoring, backups, vendor review, secure development, incident response, and deletion procedures.

No system is perfectly secure. You are responsible for protecting your credentials and devices and for promptly reporting suspected compromise to [email protected]. If a security incident affects your information, we will investigate and provide notices required by applicable law.

12. Your Choices and Privacy Rights

Account controls

• Access and correction. Review and update available profile, trip, expense, and preference data in the Service.
• Export. Download available records in supported formats, which may include CSV, PDF, Excel, JSON, or a preparer-ready package depending on your plan.
• Deletion. Permanently delete your account and associated data through supported settings, subject to verification and limited legal, security, billing, dispute, and backup retention.
• Location. Disable tracking, end a session, revoke operating-system permission, or delete prior trip data.
• Communications. Unsubscribe from marketing using the message link. Essential account, billing, security, and legal communications will continue while relevant.
• Connections. Disconnect supported integrations. This stops future access but does not automatically delete data already imported.

Privacy requests

Depending on where you live and subject to legal exceptions, you may have rights to know or access personal information; correct inaccuracies; delete information; obtain a portable copy; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; withdraw consent; and appeal a denied request. You will not be discriminated against for exercising a privacy right.

Submit a request through https://www.roadkept.com/app#account or email [email protected]. Describe the right and identify the account email. We will verify the request using information appropriate to its sensitivity and will not ask for more information than reasonably necessary. An authorized agent may submit a request where permitted, but we may require signed authority and direct identity confirmation. We will respond within the time required by applicable law. If we deny a request, our response will explain any appeal method available.

13. U.S. State Privacy Disclosures

California notice at collection and privacy rights

In the preceding 12 months, RoadKept may have collected the categories described in Section 2: identifiers and customer records, including taxpayer or government identifiers if contained in an uploaded document; commercial and subscription information; financial information and authorized connected-account data if enabled; internet or electronic activity; precise or approximate geolocation if enabled; professional or employment-related information supplied for tax records; visual or electronic information in receipts and documents; sensitive personal information; and inferences. We collect these categories from the sources in Section 3, use them for the purposes in Section 4, and disclose them to the recipients in Section 5.

We do not sell personal information or share it for cross-context behavioral advertising. We do not sell or share personal information of consumers we know are under 16. We use and disclose sensitive personal information only for purposes reasonably expected to provide the Service, security, legal compliance, and other purposes not subject to the statutory right to limit; if that changes, we will provide the required control. California residents may request access to specific pieces and categories, sources, purposes, and recipients; correction; deletion; and portability, subject to exceptions. California law may also permit a private action for certain security breaches; this Policy does not limit nonwaivable rights.

Other U.S. state rights

Residents of states with comprehensive privacy laws may exercise applicable rights described in Section 12, including an appeal where required. If a state requires consent before processing sensitive data, RoadKept will request consent or limit processing to an exception allowed by law. We recognize applicable universal opt-out mechanisms for sale, targeted advertising, and covered profiling; RoadKept does not currently engage in those activities. Nevada residents may submit a verified request regarding covered-information sales to [email protected], although RoadKept does not currently sell covered information as defined by Nevada law.

State request metrics and notices

If RoadKept becomes subject to jurisdiction-specific reporting, notice-at-collection, financial-incentive, data-protection-assessment, or request-metrics requirements, we will provide the required supplemental notice or report. A subscription discount or free tier is not intended as payment for personal information. If we offer a program that is treated as a financial incentive under law, we will provide separate terms and obtain any required opt-in consent.

14. Children

The Service is not directed to children and may be used only by people at least 18 years old. We do not knowingly allow accounts for people under 18 or knowingly collect personal information online from children under 13. If we learn that an ineligible minor created an account or a child under 13 provided personal information, we will take appropriate steps to investigate, close the account where applicable, and delete the information subject to legal requirements. Contact [email protected] with a concern. Do not create an account for a minor or upload a minor's information unless a specific future feature expressly permits it and supplies any legally required notice and consent process.

15. International Use and Transfers

RoadKept is designed for users in the United States and U.S. tax recordkeeping. Personal information may be processed in the United States and other countries where our service providers operate. Those countries may have different privacy laws. Where required for a supported international transfer, we use an approved transfer mechanism and supplemental safeguards. The Service is not currently offered to residents of the European Economic Area, United Kingdom, or Switzerland unless RoadKept expressly states otherwise in writing.

16. Changes to This Policy

We may update this Policy to reflect changes in the Service, law, vendors, or practices. We will post the revised Policy and update the date above. If a change is material, we will provide reasonable advance notice through the Service, email, or another appropriate method and obtain consent where required. We will not use previously collected personal information for a materially different, incompatible purpose without providing required notice or consent.

17. Contact Us

Privacy questions and requests: [email protected]

Security reports: [email protected]

Request portal: https://www.roadkept.com/app#account

Mail: Aven Crest Technologies LLC, d/b/a RoadKept, Chicago, IL 60659

Website: https://www.roadkept.com

If you have a disability and need this Policy in an alternative format, contact us using the methods above.