Privacy Policy

Who this policy covers

This policy covers three groups of people, and they are not treated the same.

• Visitors to TowSitePros: anyone reading this site, running a site preview, or sending us a message.
• Operators: towing companies with an account. For their own account data we are the controller.
• Motorists and other customers of an operator: the people whose jobs an operator records. For that data the operator is the controller and we are the processor. We act on the operator's instructions and we do not decide what they collect.

What we collect

Account and billing data, when an operator signs up: the email address used to create the account, a password (stored only as a hash by our authentication provider) or a sign-in through a provider you choose, and the business details entered during setup, meaning the company name, phone number, address, hours, services, service areas and the domain the site runs on.

Job and customer data, entered by an operator or submitted through their site: the customer's name and contact details, the vehicle, the pickup and destination, the price quoted, notes, photos, and an append-only timeline of everything that happened on the job.

Motorist data on an active job: the phone number the operator holds for them so status texts can be sent, whatever they type into the tracking page (a message to the driver, a cancellation, a rating), and, only while a driver's phone is actively sharing it, the location of the truck. The truck's location is the driver's device location, shared by the driver from the driver's job page, and it stops when the job does.

Site analytics, on published operator sites: page views, taps on a phone number, form submissions and button clicks, with the page, the referrer, the user agent, a device class and a session identifier. The visitor's IP address is hashed with SHA-256 before it is stored and the address itself is never written down.

Campaign attribution, on this marketing site: if you arrive through a link carrying campaign parameters we keep them, plus the referring site, in a single first-party cookie for 30 days, so we can tell which outreach produced a sign-up. It is read only by our own servers. See the Cookie Policy for the exact list.

Messages you send us: what you write in the contact form or the done-for-you form is stored in our database and emailed to our team, with your business name, contact name, email address, phone number and message, plus the campaign attribution described above when you arrived with any. We use it only to reply to your enquiry and follow up about the service, and you can ask us to delete it through the contact page.

Why we have it

• To run the product you asked for: build and host the site, record jobs, send the driver their link, send the customer their texts and their tracking page, and produce your reports.
• To bill you, and to tell you about your own account, your trial and your invoices.
• To keep the platform working and safe: rate limiting, abuse protection, error diagnosis and backups.
• To answer you when you write to us, and to follow up on a request to build a site.
• To understand which outreach and which pages produce sign-ups, using first-party data only.

We do not sell personal data, we do not share it with data brokers, and we do not use an operator's job or customer data to advertise anything to anyone.

Text messages and consent

Texts to a motorist are sent because the operator has that person's consent, and the consent record sits with the operator. The operator confirms this in writing inside the product before texting can be switched on. STOP and the other standard opt-out words are honoured automatically, and an opt-out applies immediately.

Texts leave either through the platform's own texting provider or through the operator's own GoHighLevel number, depending on which the operator chooses. Only the phone number and the message body reach that provider.

Who else processes data for us

We use a small number of vendors to run the product. Each one only receives what its job needs.

• Supabase: the database, file storage and authentication behind the product. Account, job, customer and analytics data live here.
• Vercel: hosting and content delivery for this site, operator sites, and the application. Request logs pass through it.
• Stripe: subscription billing. Card details are entered on Stripe's own checkout page and never reach our servers or our database; we hold a customer reference and the state of your subscription.
• Our email provider: the service configured to send transactional email, such as sign-in confirmations, review requests and the messages you send us. It receives the recipient address and the message.
• GoHighLevel or a texting provider, when an operator turns texting on: the recipient number and the message.
• A public business registry published by the United States government is read when someone runs a site preview. We send it the company name or registration number that was searched for. It is a source, not a place we send your data.

Site previews

A site preview is built from public business registration data: the registered name, trading name, town, state, phone number and fleet size on file. It carries a notice saying it is a sample built from public data and is not the company's official website, it is marked so search engines do not index it, and it expires automatically after 30 days.

If a preview exists for your company and you want it gone, ask and we will remove it. There is no form to fill in and no account needed: tell us here or email support@www.towsitepros.com. We take it down and it stops being reachable immediately.

How long we keep things

• Account, job and customer data: for as long as the account is active. When an account is closed we delete or anonymise it, except where we have to keep a billing record.
• Site previews: 30 days from the day they are built, or sooner on request.
• The campaign attribution cookie: 30 days from your last campaign visit.
• Site analytics: kept as part of the operator account it belongs to, and reported on over rolling windows of up to 90 days.
• Messages you send us: kept while we deal with them and for a reasonable period afterwards.

Your choices

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. An operator can export their own data at any time: every report exports to CSV and every job can be pulled out through the API.

If your request is about data a towing company holds about you as their customer, ask that company first, because it is theirs. If you cannot reach them, write to us and we will pass it on.

Write to support@www.towsitepros.com for any of it.

Children

The product is sold to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe we have, tell us and we will delete it.

Security

Access to data is enforced in the database itself rather than only in application code, links given to drivers and motorists are unguessable tokens that expire, and card details never touch our systems. What we do have and what we do not have yet is written out in full on our security page, including the certifications we do not hold.

Changes to this policy

If we change this policy we will change the date at the top. If a change materially affects how we handle an operator's data, we will email the account before it takes effect.