Privacy Policy

1. Who is responsible for your data

CRAN LLC (d/b/a Cran Permits), 254 Chapman Rd, STE 208, Newark, DE 19702, is responsible for the personal information described here. Questions and requests go to support@cranpermits.com.

This policy covers our website and the client portal. It does not cover the sites of state permitting agencies or other third parties we link to.

2. What we collect

Information you give us

• Account details — name, email address, password (stored hashed, never in readable form), and any two-factor or passkey credentials you set up.
• Company details — company name, DOT and MC numbers, tax ID, IFTA license, billing address, phone, email, and your certificate of insurance.
• Fleet details — trucks and trailers with VIN, plate, registration state and expiration, dimensions and weights, and uploaded registration documents.
• Driver details — the driver's name, phone, and email, as needed to place them on a permit order.
• Load details — dimensions, weights, axle configuration and spacing, origin, destination, and the states you are permitting through.
• Enquiries — whatever you type into the contact form, including your name, company, email, phone, and message.

Payment information

Card payments are processed by Stripe. Your card number never reaches our servers. We store only what we need to show you which card is on file — brand, last four digits, cardholder name, and expiry — plus Stripe's identifiers for the customer, charge, and refund.

Information collected automatically

• Log data — IP address, browser and device type, pages requested, and timestamps, recorded by our servers for security and troubleshooting.
• Cookies — see section 6. Some keep you signed in and remember interface preferences. Others measure our advertising, and those are set only if you allow them.

We do not knowingly collect Social Security numbers, driver's license images, health information, or biometric data, and we ask you not to send them to us.

3. Why we use it

• to prepare and file permit applications with state agencies on your behalf, and to deliver the issued permits back to you;
• to price orders, take payment, issue invoices and receipts, and process refunds;
• to run your account — authentication, two-factor, password resets, and the fleet and order records in the portal;
• to send you transactional email about your orders (order received, payment required, receipt, permits ready) and to answer your enquiries;
• to secure the platform — detecting abuse, rate-limiting forms, and investigating incidents;
• to comply with law, and to establish or defend legal claims.

We do not send marketing email to our clients' addresses unless they ask for it, and we do not use your load or fleet data to build profiles about you.

4. Who we share it with

• State and local permitting agencies — the information required by the application, which typically includes the carrier's identity, the vehicle and trailer, the load, and the route.
• Stripe — for payment processing, under Stripe's privacy policy.
• Resend — our email delivery provider, which handles the transactional messages we send you.
• Escort, survey, and routing partners — only where your order requires one and only what they need to do the work.
• Google — if, and only if, you allow analytics or advertising cookies, the Google tag on our site reports your visit and whether it ended in a permit application, under Google's privacy policy. We send no name, email, phone number, or load data with it — only the fact that an application was submitted, its estimated value, and an order number that lets Google avoid counting the same one twice.
• Infrastructure providers — hosting, database, and backup providers acting on our instructions.
• Professional advisers and authorities — where the law requires it, or to protect our rights.
• A successor — if the business is sold or reorganized, subject to this policy.

We do not sell your personal information. Where you have allowed advertising cookies, the measurement described above may count as "sharing" for cross-context behavioral advertising under some state laws — which is why it is off until you switch it on, and why you can switch it back off at any time in cookie preferences.

5. How long we keep it

We keep account, order, permit, and payment records for as long as your account is open and afterwards for as long as we need them for tax, accounting, audit, and legal-claim purposes — generally seven years from the last transaction. Contact-form enquiries are kept for up to two years. Server logs are kept for a short operational period. When a retention period ends, records are deleted or anonymized.

6. Cookies

Necessary cookies

These are always on. Without them the site cannot do its job, so there is nothing to consent to:

• a session cookie that keeps you signed in and carries the CSRF token that protects our forms;
• appearance and sidebar_state, which remember your light/dark preference and whether the portal sidebar is collapsed;
• cookie_consent, which records the choice you make below so we do not ask again on every page. It stores only your answer, keeps it for a year, and is never sent anywhere else.

Blocking the session cookie in your browser will stop you from being able to sign in.

Analytics and advertising cookies

We run Google Ads campaigns, and we use Google's tag to see which of them bring carriers to us and which end in a permit application. These are the only non-necessary cookies on the site, and they are split into two categories you can accept or refuse separately:

• Analytics — Google's measurement cookies, which tell us which pages get used.
• Advertising — Google Ads cookies, which attribute a permit application back to the ad that led to it.

Neither is set until you allow it. Until then the Google tag runs with every advertising and analytics signal denied — it stores nothing on your device and we strip the ad click identifiers out of what it is still able to report.

Changing your mind

Your choice is yours to revisit whenever you like, here or from the "Cookie Preferences" link at the bottom of every page. Refusing costs you nothing: every part of the site and the portal works the same either way.

7. Security

Traffic is encrypted in transit. Passwords are stored hashed. Uploaded documents — insurance certificates, registrations, issued permits — are held on private storage and served only to authenticated users of the company that owns them. Access within our team is limited to staff who need it. Two-factor authentication and passkeys are available on every account and we recommend turning one on.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

8. Your rights

Wherever you are, you can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it where we are not required to keep it. Most of it you can view and edit yourself in the portal. Write to support@cranpermits.com and we will respond within the time the applicable law allows — forty-five days under California law, thirty days under most others. We will not discriminate against you for exercising a right.

California residents

Under the CCPA/CPRA you have the right to know what we collect and why, to request deletion or correction, to request a portable copy, and to limit the use of sensitive personal information. We have not sold personal information in the past twelve months, and there is nothing further to opt out of beyond the advertising cookies described in section 6, which stay off unless you turn them on. You may use an authorized agent; we will ask for proof of authorization.

Residents of the EEA and the UK

Where the GDPR applies, our legal bases are performance of a contract (running your account and filing your permits), legal obligation (tax and accounting records), and legitimate interests (securing the platform and answering enquiries). You may also object to processing, request restriction, and lodge a complaint with your supervisory authority. Our services are operated from the United States, and information you send us is processed there.

9. Other people's data

When you enter details about your drivers or staff, you are giving us personal information about other people. You confirm that you are entitled to do so and that you have told them their details are used to obtain permits for the loads they move.

10. Children

The platform is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.

11. Changes to this policy

We may update this policy. The "last updated" date at the top tells you when we last did; material changes will be communicated to account holders by email.

12. Contact