This Privacy Policy explains how Lucid ELD Inc. ("Lucid," "we," "us," or "our") collects, uses, shares, and protects information when you use our fleet compliance and telematics platform, websites, mobile applications, and hardware (the "Service"). It applies to our customers, their authorized users, and drivers in the United States and Canada. By using the Service, you agree to this Policy. This Policy is part of our Master Terms of Service.

1. Our Role

Our customers are commercial fleets and businesses. When a customer uses the Service to manage its drivers and vehicles, the customer decides what data to collect and how to use it, and the customer is responsible for its own privacy and recording obligations to its drivers. We process that data to provide the Service to the customer and as described in this Policy. We act on our own behalf for our website visitors and for operating, securing, and improving the Service.

2. Information We Collect

• Account and business information. Company name, contact name, email, phone number, business address, login credentials, and account settings.
• Billing information. Plan, billing history, and the information needed to process payments. Card and bank details are collected and processed by our third-party payment processor and are not stored by us.
• Usage, device, and telematics data. Vehicle and engine data, hours of service and ELD records, diagnostics, trip and route data, speed, events, and how users interact with the Service.
• Location data. Vehicle and asset location, including from ELDs, trackers, and the mobile application, as configured by the customer.
• Camera and video data. Footage from road-facing cameras, and, only if the customer enables driver-facing features, in-cab video.
• Biometric data. Only if the customer enables driver-facing features, facial geometry and related biometric identifiers derived from in-cab video, and in-cab audio. This is described further in Section 12 and in our Biometric and In-Cab Recording Policy.
• Communications. Information you provide when you contact support, including the content of your messages.
• Text messaging data. If you opt in to text messages, your phone number, opt-in records, and message activity.
• Cookies and similar technologies. As described in our Cookie Policy.

3. How We Use Information

We use information to provide, operate, secure, maintain, and improve the Service; to authenticate users and manage accounts; to process payments and billing; to provide hours of service, ELD, telematics, tracking, video, and reporting features; to provide customer support; to send account, service, and billing messages; to send marketing only where permitted; to detect, prevent, and address fraud, abuse, security, and technical issues; to create de-identified and aggregated data; and to comply with law and enforce our agreements.

4. How We Share Information

• Service providers. We share information with vendors who help us run the Service, such as hosting, payment processing, communications, and analytics providers, under contracts that limit their use of the information to providing services to us.
• Within your organization. Data is available to the Admins and users the customer authorizes.
• Aggregated and de-identified data. We may share de-identified and aggregated data as described in Section 6.
• Legal and safety. We may disclose information to comply with law, legal process, or government requests, to enforce our agreements, or to protect the rights, property, or safety of Lucid, our users, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.

We do not sell your personal information, and we do not share personal information with third parties for their own marketing purposes.

5. Text Messaging Data

If you opt in to receive text messages, we use your information only to operate our messaging program as described in our Terms. We do not share your information with third parties for marketing purposes. Text messaging opt-in data and consent are not shared with any third parties other than the messaging aggregators and service providers we use to deliver the messages, and those providers may use the information only to deliver our messages. You can opt out at any time by replying STOP.

6. Aggregated and De-Identified Data

We may create de-identified and aggregated data from use of the Service. We use and may share this data to operate, analyze, improve, secure, and benchmark the Service and for other lawful purposes. We maintain this data in a form that does not identify any person or customer, and we do not attempt to re-identify it.

7. Data Retention

We keep information for as long as needed to provide the Service and for the purposes in this Policy, then delete or de-identify it, subject to the following.

• Account and billing records. Kept for the life of the account and then for up to seven years to meet tax, accounting, and legal requirements, after which they are deleted or de-identified.
• Hours of service, ELD, and telematics data. Kept for at least the period required by FMCSA rules, which is a minimum of six months, and longer as needed to provide the Service and meet legal requirements.
• Camera footage. Event and incident clips are kept for about 90 days unless the customer saves them or they are subject to a legal hold. Routine, non-event footage is kept only on a short rolling basis.
• Biometric data. Handled under the destruction schedule in Section 12 and in our Biometric and In-Cab Recording Policy.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect information, including access controls and encryption in transit. No system is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and for the access you grant.

9. Where Your Data Is Stored

We store and process data on servers located in the United States. If you access the Service from Canada or elsewhere, you understand that your information will be processed in the United States.

10. Your Choices

You can update your account information in the Service or by contacting support. You can opt out of text messages by replying STOP and out of marketing emails using the unsubscribe link. You can manage cookies as described in our Cookie Policy. Customers control what data they collect from their drivers and the settings that govern it.

11. California Privacy Rights

This Section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA").

Business context. Much of the data we process is on behalf of our business customers about their personnel and drivers in a commercial context. Where the CCPA applies to that data, the customer is generally the business responsible for honoring rights, and we act as a service provider. We do not sell or share personal information as those terms are defined under the CCPA, and we do not use sensitive personal information, including biometric information, except to provide the Service and for the purposes allowed by law.

Your rights. Subject to the CCPA and to verification, California residents may have the right to know and access the personal information we hold about them, to request deletion, to request correction, to opt out of any sale or sharing for cross-context behavioral advertising (which we do not do), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.

How to exercise. To make a request, contact us at support@lucideld.com or +1 (717) 703-0377. If your data was collected by a customer through the Service, we will refer your request to that customer or assist them as their service provider. We will verify your request before responding and will not discriminate against you for exercising your rights.

12. Biometric and In-Cab Recording

Driver-facing features, including in-cab video, in-cab audio, and facial or biometric analysis, are off by default and are enabled only at the discretion of the customer. When enabled, the customer is the party that decides to collect this data and is responsible for providing notice and obtaining written consent from drivers.

Because biometric data may also reside in our cloud when these features are enabled, we maintain a public Biometric and In-Cab Recording Policy that describes what is and is not collected, how it is used, that it is not sold, and our retention and destruction schedule. In summary, we destroy biometric identifiers at the earliest of when the purpose for collecting them has been satisfied, within 30 days after the customer disables the driver-facing feature for the relevant vehicle or driver or the driver leaves, or within three years of the driver's last interaction with the Service. Please see that Policy for the full terms, the driver consent form, and the in-cab notice.

13. Children's Privacy

The Service is for commercial business use and is not directed to children under 13, and we do not knowingly collect personal information from children.

14. Do Not Track and Global Privacy Control

Some browsers send Do Not Track signals. There is no common standard for responding to them, so we do not respond to Do Not Track signals at this time. Where required, we will treat a recognized Global Privacy Control signal as a valid opt-out request for the browser or device that sends it.

15. Changes to This Policy

We may update this Policy from time to time. We will revise the effective date and, for material changes, provide notice. Your continued use of the Service after the change takes effect means you accept the updated Policy.

16. Contact

Lucid ELD Inc. 1000 Northbrook Drive, Suite 100, Trevose, PA 19053 support@lucideld.com +1 (717) 703-0377