What we collect, why we have it, who else sees it, and how to get it back or removed. Written to be read, not to be survived.
Haulbase is software rental businesses use to run their yards. Two different sets of people put information into it, and they are not in the same relationship with us.
That distinction runs through everything below. If you rented a trailer and want your details changed or deleted, the fastest route is the business you rented from. We will help them do it, and we will act on a request sent directly to us, but they hold the relationship.
We never sell personal information, and we never have.
Depending on what the operator has switched on and what the booking involves, this can include:
We do not receive card numbers. Payments are handled by Stripe, on Stripe's own pages. What comes back to us is a reference and a status - paid or not, and how much.
Ordinary server logs, kept by our hosting providers: the pages requested, timestamps, and the IP address the request came from. We also store an IP address briefly against rate limits, so that a form that costs money to submit cannot be hammered by one source. That record is short-lived and is not used to build a profile of anyone.
We use a session cookie to keep operators signed in. The Haulbase marketing pages and the signup page load Google’s advertising tag, which sets a cookie so Google can tell us which of our ads led to a signup. It is not loaded anywhere else. There is no third-party analytics and no advertising tag on the operator dashboard or on operator storefronts, so a customer booking a trailer from a yard is not tracked by Google and is not followed anywhere else on the internet.
We do count four things on an operator’s booking page, so the operator can tell the difference between nobody finding their page and people finding it and leaving: that the page was opened, that a booking form was opened, that a request was sent, and that a payment page was reached. Alongside each we record which kind of product it was and, on the first one, whether the visit arrived from a search engine, a link, an ad, an email or by typing the address in. That last one is worked out in your browser and reduced to a single word before it is sent, so the address of the page you came from never leaves your device.
There is no name, no email, no IP address and no cookie in any of it. To tell one person opening four trailers from four people opening one each, the browser generates a random value and holds it in “session storage”, which the browser itself deletes when the tab is closed. It is not a fingerprint, it does not follow you to another site or another visit, and nothing in these records can be connected back to a person. They are deleted after 30 days. If you would rather not be counted at all, a browser set to block scripts, or private browsing with the tab closed afterwards, is enough.
Text messaging is the part of this product most likely to feel intrusive, so it is worth stating plainly.
We use a small number of service providers to run Haulbase. Each one only receives what it needs to do its job.
We will also disclose information where the law requires it, and to protect someone's safety or our rights. If Haulbase is ever sold, information transfers with it, and this policy continues to apply until it is replaced by one you are told about.
Haulbase is built and run from Nova Scotia. Our providers operate infrastructure in Canada, the United States and elsewhere, which means information may be stored or processed outside Canada and may be accessible to courts and authorities in those countries. We choose providers that commit to appropriate safeguards, and we keep the amount sent to each one as small as the job allows.
Under Canadian privacy law you can ask what personal information we hold about you, ask for a copy, ask us to correct it if it is wrong, and withdraw consent to things that are not required to deliver something you asked for. You can also complain to the Office of the Privacy Commissioner of Canada.
Ask by emailing hello@haulbase.ca. We will respond within 30 days. If the information belongs to a booking with a rental business, we will pass the request to that business and help them answer it, because it is their record.
There are limits. We cannot delete something we are required to keep, and removing a record of a signed agreement or a completed payment is usually one of those.
Every operator's data is isolated at the database level, so one business cannot read another's, and that isolation is enforced by the database itself rather than only by application code. Inspection photos live in private storage. Links sent to renters carry a signed, expiring token rather than a guessable identifier. Payment card details never reach us.
No system is perfectly secure, and we would rather say so than imply otherwise. If we discover a breach affecting personal information, we will notify affected people and the Privacy Commissioner as the law requires, and we will say what happened rather than the smallest thing we can get away with.
Haulbase is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child's information has ended up here, write to us and we will remove it.
We will update this page when what we do changes. The date at the top says when it last changed. If a change materially affects how personal information is handled, we will tell operators directly rather than relying on anyone noticing a new date.
This policy is governed by the law of Nova Scotia.
Questions about this document, or a request about your information, go to hello@haulbase.ca, or by post to 20 Tyler St, Enfield, Nova Scotia B2T 0A6.