Privacy policy
Superseded on November 8, 2026 by version 2026-11-08. Kept unchanged for the record.
Scope and roles
BAI Copilot LLC (“BAI,” “we,” or “us”) provides the public BAI website and fleet software. This policy explains how we handle information in those services; it does not activate a feature, authorize a provider connection or mean production acceptance has already occurred. For records a carrier supplies for its operations, the carrier directs the permitted use and is responsible for its workforce notices and authority. BAI also handles its own account, business-contact, security and support records. Applicable contracts and law determine the parties’ precise responsibilities. This policy does not govern a separate provider’s website after you open it.
Information collected
Depending on the features actually enabled, information may include business and user names, email addresses, phone numbers, workspace membership and roles; company and fleet records; driver qualifications and authorized personnel records; loads, stops and locations; uploaded rate confirmations, proofs of delivery, receipts and other paperwork; received or forwarded email bodies, message headers and attachments when mail intake is enabled; broker, customer and factoring-company contacts and billing emails supplied for business workflows; invoices, credits, settlements and accounting records; provider identifiers and connection credentials; support messages; and sign-in, device, network and audit information. Records about a person may be supplied by their carrier or another authorized user rather than directly by that person. Access to restricted driver records is subject to their additional controls. Do not submit information that your enabled service does not need or that you are not authorized to provide.
Public website and demo requests
When you request a demo, the contact details and message you choose to submit are sent through the configured Formspree form service so BAI can respond. Formspree and the website host process associated delivery and technical metadata. Ordinary website requests may disclose an IP address, browser/device information and request details to the host and network providers. The current marketing source does not add advertising trackers or analytics scripts; this is not a claim that its hosting and form providers receive no technical information. Submitting a demo request is not permission to access a carrier workspace or connect QuickBooks.
Sign-in, browser storage and driver links
Auth0 provides the production sign-in flow. Sign-in passwords entered on the identity provider’s page are handled there, not requested through BAI support. BAI uses session and security information to authenticate users and enforce workspace permissions. The app may use necessary cookies and browser storage for sessions, preferences and device/link state; the driver experience may keep queued updates or photos locally until they can be submitted. Shared devices should be protected and signed out of appropriately. A driver link carries a restricted credential and may identify the intended driver and assignment; opening it can provide access to that assignment’s instructions and supported actions without a full account. Link use can record IP address, browser/device identifiers, opens, acknowledgements, progress and uploaded paperwork. Do not forward the link beyond its intended recipient.
Location, hours and driver records
Where a carrier separately enables and authorizes an ELD, tracking or driver feature, BAI can process the positions, times, hours and operational records that the feature receives. The particular source, permissions, notices and any on-duty/off-duty rules must be provided for that feature; possession of a driver link alone is not blanket consent to continuous location tracking. The carrier must give required workforce notices and obtain any consent it is responsible for. A driver may contact the carrier about its operational records or contact BAI about BAI’s own handling and access questions.
Why information is used
BAI uses information to deliver requested operations and accounting functions, manage access and permitted communications, process and check documents, troubleshoot, support users, secure the service, maintain necessary audit and recovery records and meet applicable legal obligations. Customer content is not sold for another company’s unrelated use or used for targeted advertising. BAI does not use QuickBooks data to train general-purpose AI models. If optional AI, OCR or document-extraction processing sends customer content to an external processor, BAI must identify that processor and purpose in the applicable feature notice before enabling it and obtain the required authorization. The hybrid launch templates leave external AI and OCR off; this policy does not silently enable them. Ordinary technical service information may be used to maintain and improve reliability without granting permission to publish identifiable carrier, driver or broker records.
QuickBooks data and choices
QuickBooks is available only after the connection is enabled, required approval/setup is complete, and an authorized workspace user grants access through Intuit. Depending on approved scope and the user’s choices, BAI may read company settings, accounts, items, customers, invoices, payments and credit memos, and send supported accounting records. Connection credentials are used to maintain authorized access and must not be emailed to support. BAI is an independent application, not a processor acting on Intuit’s behalf. Use Connections to disconnect, with the confirmation shown there, or ask support if you cannot access the workspace. Disconnection stops new connected reads and writes and BAI’s use of that connection’s credentials; it does not cancel the Intuit subscription or delete data already in QuickBooks. Requests to delete BAI-held QuickBooks information are handled subject to applicable legal record-keeping obligations and provider requirements, not a blanket right to keep it for unrelated purposes.
Hosting and providers
The hybrid launch profile uses a BAI-controlled Mac for the application, database and workflow processing. Amazon Web Services supplies encryption-key services, stored documents and malware scanning, email, queues and isolated document rendering. Separate AWS accounts hold locked audit records and encrypted backups. Cloudflare carries public traffic and terminates the public TLS connection, so it can process request contents and network information. Auth0 handles sign-in, and Formspree handles the marketing demo form. Intuit and any ELD provider process data for a connection the carrier separately authorizes. An ordinary bank or factoring portal opened from a saved link is a separate site; BAI does not receive its login password through that link. Provider processing locations follow the applicable service arrangement; this policy does not promise that every provider’s data is confined to one country or that all records stay on the Mac. Additional providers require the applicable review and notices before receiving customer content.
Access, security and disclosures
BAI uses access controls, workspace separation, encryption and audit controls designed to protect information. Staff support access follows the consented support-session process and its permitted scope. Operational administrators and service providers may have the access necessary to maintain or recover the service; no claim of absolute isolation from every administrator or perfect security is made. Information may be disclosed to authorized users, contracted providers assisting the requested service, professional advisers as necessary, or where a lawful requirement or a security incident requires it, subject to applicable duties. BAI does not make customer records public merely because they are stored in the service. Incident notices follow the applicable legal and contractual requirements; this page does not invent a universal notification deadline or claim an unverified certification.
Retention, closure, backups and deletion
Customer operational records are kept while needed for the authorized service and applicable retention instructions or legal holds. Different record classes and short-lived technical records have different schedules; there is no promise that all records disappear on the day a workspace or connection closes. For the launch profile, the configured immutable archive default is 2,555 days for audit records, and the configured immutable backup default is 35 days. A retained object cannot be deleted before its own lock expires. Audit records can contain action times, actor identities, record references, changes and integrity hashes; encrypted backups can contain workspace records. A configured lock is not, by itself, a legal reason to retain information. Before activating a connected-data use, its backup/audit handling must meet applicable provider and legal requirements. Retained backup copies are restricted to permitted recovery/legal purposes; deletion requirements must be reapplied before a restored service reopens. Export or deletion requests are verified, legal holds and applicable instructions are checked, and the completion record identifies what was removed and any retained categories, reason and expiry. Deletion is not represented as complete while required file-removal verification remains blocked. Records already delivered to a separate provider are also subject to that provider’s own process.
Requests and your choices
Contact support@copilotbai.com for access, correction, export, deletion or privacy questions. State the business/workspace involved and the request without emailing passwords, keys or sensitive driver paperwork. BAI verifies identity and authority and may need to coordinate with the carrier that directs the records. Rights, response periods and lawful exceptions depend on the applicable law and role; BAI will handle the request accordingly and explain a refusal or retention restriction where required. If an authorized representative acts for you, BAI may request proof of authority. You may ask for a review of a response using the same support contact, and retain any right to complain to the relevant authority. The service is for business users and is not directed to children under 18.
Policy versions and contact
BAI will identify material policy changes and provide notice or obtain further authorization where required before a materially different use. A later publication does not create retroactive consent to a new data purpose. Contact: BAI Copilot LLC, support@copilotbai.com; support hours Monday–Friday, 9 AM–5 PM Eastern. These hours are not a promise that a privacy request or incident will be resolved within that period. The companion software agreement is at https://baicopilot.com/eula/.