Privacy Policy

1. Scope

This Privacy Policy explains how Workforce DOT, LLC processes information through dot.screenings4u.com, subscription checkout, account creation, DOT agency portals, C/TPA, Employer, Employee and Driver portals, support interactions, email communications and connected services.

Where an Employer, C/TPA or other customer determines why and how workforce data is processed, that customer may be the primary controller or business responsible for the data, while screenings4u DOT acts as a service provider or processor for applicable activities.

2. Information we collect

Depending on your relationship with the Services, we may process:

• Account and identity data: name, email, phone, profile, authentication user ID, organization memberships, roles and access status.
• Organization data: legal name, DBA, EIN where provided, DOT/MC identifiers, business type, addresses, contacts, websites, billing information and DOT agency information.
• Employee and driver data: employee number, name, date of birth, contact details, address, job information, hire/termination dates, safety-sensitive status, DOT coverage, DOT agency, CDL number/state and related position information.
• Compliance and testing data: program enrollment, random pool membership and selections, testing orders, collection workflow status, result summaries, MRO-related result status, regulatory mode, test reason and related reports.
• Documents and credentials: uploaded files, document types, credentials, expiration dates, training records, acknowledgments, consent responses and related metadata.
• Billing and transaction data: plan, subscription status, order reference, invoices, payment status, payment processor identifiers and amounts. Full payment-card details are generally handled by the payment processor rather than stored in our application database.
• Technical and security data: audit events, user agent, IP address where logged, portal access, timestamps, browser/session storage used for authentication and workspace routing, and security or support-session metadata.
• Integration data: enabled integrations, provider information and credential references. Sensitive integration credentials may be stored through protected secret/vault references rather than exposed in ordinary application records.
• Contact and demo data: information submitted through contact and demo request forms.

3. How we use information

We use information to provide and secure accounts; administer subscriptions and access; operate DOT program, pool, testing, result, document, reporting, notification and billing workflows; provide C/TPA client-management functions; process purchases; deliver transactional emails; support customers; maintain audit history; prevent misuse; troubleshoot; satisfy legal obligations; and improve service reliability and usability.

4. Sensitive workforce information

Some portal data can be sensitive because it relates to employment, drug/alcohol testing, safety-sensitive work, regulatory status, credentials or personal identification. Access is intended to be limited by role, organization, portal entitlement and feature permissions. Customers are responsible for configuring authorized users and for ensuring they have a lawful basis to enter, view and use regulated workforce information.

5. How information is shared

We may share information with service providers that support hosting, authentication, storage, email delivery, payment processing, security, testing/fulfillment, training or integrations; with the customer organization and its authorized users; with a C/TPA or Employer where the portal relationship requires it; with regulators, courts or government authorities when legally required; and in connection with a corporate transaction subject to appropriate safeguards.

We do not sell personal information to advertisers, and the current DOT marketing site does not include advertising pixels identified in the deployed site files reviewed for this policy.

6. Service providers and platform components

Our current implementation uses Supabase for application database, authentication, Edge Functions and storage; Stripe for supported subscription checkout and payment processing; and Resend for transactional email delivery. The marketing site also loads Google-hosted font resources. Additional testing, training, laboratory, collection, fulfillment or integration providers may process information when a customer uses those services.

7. Data retention

Retention varies by record type, customer instructions, contractual requirements and applicable law. The platform currently contains a default document-retention setting of five years, but individual records may be retained for a different period where regulations, contractual requirements, legal holds, dispute preservation or customer instructions require it. Archived or backup information may persist for a limited period consistent with operational and legal requirements.

8. Security

Controls reflected in the platform include role-based memberships and permissions, organization/tenant scoping, private storage buckets for protected documents, signed URLs with limited lifetimes for certain file access, audit events, managed authentication and support-consent/session records. We also use third-party infrastructure safeguards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Cookies, local storage and similar technologies

The marketing website and portals may use essential browser storage for authentication, workspace selection, session continuity and branding cache. Stripe and other necessary service providers may use their own cookies or storage during checkout or authentication. See our Cookie Policy for more detail.

10. Your choices and rights

Depending on your location and relationship with the data, applicable law may provide rights to access, correct, delete or obtain information about certain personal data. Workforce users should often direct requests first to their Employer or C/TPA, because that organization may control the relevant workforce record. You may also contact us at the address below. We may need to verify identity and authority before acting on a request.

11. Children

The Services are designed for business and workforce compliance use and are not directed to children. We do not knowingly solicit children to create DOT workforce accounts.

12. International use

The Services are operated for U.S.-focused DOT compliance workflows. If information is accessed or submitted from outside the United States, it may be processed in the United States and other locations where our service providers operate, subject to applicable law.

13. Policy changes

We may update this policy to reflect changes in our Services, vendors, legal obligations or data practices. The effective date above shows the current version.