Privacy Policy
Effective 13 October 2026. Supersedes the version of 12 October 2026.
Who we are
The DEF Rx platform is owned and operated by Hook & Haul LLC, a Texas limited liability company based in Houston, Texas. In this policy, "we," "us" and "DEF Rx" mean that company. It is the company that holds your data and the company you would deal with about it.
Notices and privacy requests: Hook & Haul LLC, 5105 Jefferson St., Unit 1, Houston, TX 77023, or privacy@defrx.com.
DEF Rx is a business product. Our users are motor carriers, service centers and mobile technicians. We do not sell advertising, we do not run an advertising network, and we do not sell personal information to anyone.
What DEF Rx does
DEF Rx tracks maintenance on heavy trucks. A carrier registers its trucks, drivers log mileage, and the system raises a warning when a truck is due for service. A carrier can raise a service request and assign a technician. We send text message reminders to drivers who have agreed to receive them.
What we collect, and why
| What | Whose | Why we hold it |
|---|---|---|
| Name, email address, phone number, role | Every account holder | Sign in and notifications. If you sign in with Google, Google gives us your name and email address |
| Personal mobile number, a record of consent with the date and time, the wording that was in force when it was given, and for drivers the device time zone | Drivers, technicians, staff, and anyone who raises a service request | To send the text messages that person agreed to receive, to keep mileage reminders inside their own daytime hours, and to prove the agreement was given |
| Mileage readings and truck assignment | Drivers | Service interval tracking |
| Business name, base address and map coordinates, working hours, services offered | Service technicians | Matching available work to location |
| Insurance carrier, policy number, expiry date, and the certificate document | Service technicians | We will not dispatch a technician whose insurance is missing or expired |
| Company name, USDOT number, MC number, physical address, phone number | Carriers and service centers | Identity and operating authority. We look up the USDOT or MC number you give us against the federal carrier register |
| VIN, plate, unit number, mileage, service history | Trucks | The core product |
| Truck location, mileage and DEF readings from your telematics provider | Trucks, only for companies that connect Motive | Keeping mileage current without a driver having to enter it |
| GPS coordinates and street address of a service location | Carriers | Sending a technician to the truck |
| Location while a job is active, sent from the technician's phone | Service technicians | So that the person who raised the request can see the technician approaching, and to confirm arrival |
| Signed name and signature image | Whoever signs for completed work | Proof of work |
| Photographs of completed work | Trucks and work sites | Proof of work |
| IP address, browser and device details, and pages visited | Every visitor | Running the site, keeping it secure, and blocking automated abuse |
What we do not collect
We do not collect Social Security numbers from anyone, for any reason.
We do not require a federal tax identification number to create a company record.
We do not store payment card numbers. Card details go straight to our payment processor and never reach us.
We run no analytics, no advertising tracking and no third-party error reporting on this site.
Text messages
We run three text message programs, and we send you messages from a program only if you have agreed to receive them. We record each agreement with the date and time and the wording that was in force at the time.
Mileage reminders, for drivers. Up to twice a week per truck, asking you to log mileage and engine hours, sent between 5am and 9pm in your own time zone.
Service updates, for whoever raised a service request. Dispatch updates, arrival times and completion notices.
Work alerts, for technicians and staff. New-job and assigned-job alerts, job chat messages, shop booking alerts and coverage alerts.
We never send marketing or promotional texts. Reply STOP to any message to stop all three programs on that number. Our text messaging terms describe all three in full.
Service providers that handle your information
These companies process data on our instructions in order to run DEF Rx. They are not permitted to use your information for their own purposes.
| Provider | What it handles |
|---|---|
| Lovable Cloud | Our database, sign-in and file storage. Everything in this policy is stored here |
| Lovable Hosting, which runs on Cloudflare | Every page visit and form submission passes through it, so it handles IP addresses and the contents of requests. Cloudflare also provides bot protection |
| Mailgun, which delivers the email we send from notify.defrx.com | The recipient's email address and the full text of the message, which can include names, job details, service addresses, phone numbers, invoice amounts and links. Delivery is handled in Mailgun's European region |
| Twilio | Mobile numbers, the text of each message, and your STOP or HELP replies |
| Stripe | Name, email address, card details entered directly into Stripe, billing address for tax, and amounts. Link, LLC is the merchant of record on subscription sales |
| Google Maps | Service addresses you enter and GPS coordinates, used for address lookup, distance, estimated arrival and time zone. The map shown in your browser loads from Google, so Google receives your IP address |
| OpenStreetMap | Service addresses and coordinates, used for address lookup only when Google's service is unavailable |
| Google Fonts | Every page loads fonts from Google, so Google receives your IP address and browser details. No account information is sent |
| Google Sign-In | Only if you choose to sign in with Google. Google receives the sign-in request and returns your name and email address |
| FMCSA, the federal carrier register | The USDOT or MC number being looked up. What comes back is stored on the company record |
| Motive | Only for companies that connect it. We send a truck identifier and receive that truck's location, mileage and DEF readings |
Server logs. Our hosting provider keeps server logs, and those logs can contain personal information. When a map or telematics lookup fails, the log records the full response, which can include a service address. When a notification email fails to send, the log records the error, which may include the intended recipient's address. We do not read these logs except to diagnose a fault.
Who else sees your information
The other party to a job. When a service request is assigned to a technician, the technician is shown the service location and the contact details of the person at the truck, so that they can find it and reach them. The carrier names that contact deliberately when raising the request, and is told at that point that the details will be shared.
The technician keeps access to the job's location and details for as long as they remain the assigned technician on it. The contact details remain available to them for seven days after the job is completed, and are removed immediately if the job is cancelled. We are working to narrow this so that access ends when the job does, and this page will say so when it is true.
The technician's own location, shown to the person who raised the job. If you are a technician, your position is shown on a live map to the signed-in person who raised the request, from the moment you are dispatched until the job closes, including while you are on site. It comes from your phone and only while location sharing is on for that job. People tracking a job as a guest, without an account, see the job's status but not your position.
When the law requires it. We will disclose information where we are legally required to, and we will tell you unless we are prohibited from doing so.
We do not sell personal information. We do not share it for cross-context behavioral advertising. We have no advertising partners.
How long we keep it
| What | How long |
|---|---|
| Account records | For as long as the account is open, and 90 days after it is closed |
| Service history, completion photographs and signatures | 7 years, as a maintenance record the carrier may need |
| Service location and job details, in the technician's view | For as long as that technician remains assigned to the job |
| On-site contact details, in the technician's view | Seven days after the job is completed. Removed immediately if the job is cancelled |
| Service location and contact details, in the carrier's own service record | 7 years |
| A technician's own location during a job | 90 days, then deleted. The live map stops when the job closes |
| Text message consent records | 5 years after the consent ends |
| Mileage readings | For as long as the truck record exists |
| Server logs | A limited period set by our hosting provider. We do not control that period and cannot extend it |
Cookies and what is stored in your browser
Sign-in does not use a cookie. Your session is kept in your browser's local storage, not in a cookie, and it is removed when you sign out.
Cookies this site sets.
| Cookie | Set by | Lasts | What it is for |
|---|---|---|---|
__cf_bm | Cloudflare | 30 minutes | Bot protection. Holds a security token and no personal information, and cannot be read by anything on the page |
__dpl | Our hosting platform | About 24 hours | Set by our hosting platform to direct your request to the correct version of the site. It holds no name, email address or other detail that identifies you. Part of its value differs between visitors, so for as long as it lasts it could tell one browser apart from another |
__stripe_mid | Stripe | 1 year | Fraud prevention. A random device identifier that stays the same across visits |
__stripe_sid | Stripe | 30 minutes | Fraud prevention. A random session identifier |
m | Stripe, on Stripe's own domain | About 400 days | Fraud prevention. A device identifier |
Stripe's cookies are set on our site only on the screen where payment for a service is taken. Stripe treats them as necessary for fraud prevention, and we cannot accept payment without them.
When you buy or change a subscription, you are sent to a checkout page on Stripe's own site to enter your card details. That page belongs to Stripe, and any cookies it sets there are set by Stripe under Stripe's own privacy policy rather than this one.
Google Maps sets no cookies. Where a map appears, it loads from Google in your browser, so Google receives your IP address.
Other things kept in your browser, which are not cookies. Your light or dark mode preference. Your cookie choices. A flag recording whether you have seen the sign-in notice. None of these are shared with anyone and none are used for tracking.
We set no analytics or advertising cookies, and no tracking pixels.
You can block or delete cookies in your browser settings. If you do, you may not be able to stay signed in, some screens may not work, and payment will not work at all.
Security and who can see your data
Access to personal information is limited to people whose work requires it.
A small number of platform administrators have broad access to data across the platform in order to maintain and develop it. That access exists for maintenance and support, not for commercial use. We think it is better to tell you this plainly than to imply that nobody can see your records.
We protect information with measures appropriate to its sensitivity, but no system is perfectly secure, and we do not promise that ours is.
Your rights
Depending on where you are, you may have the right to see the information we hold about you, to correct it, to delete it, to receive a copy of it, and to object to how we use it. Several states, including Texas and California, give their residents rights of this kind.
To make a request, email privacy@defrx.com. We will respond within the time the applicable law allows. We will not treat you differently for making a request.
Many state privacy laws do not apply to information about people acting in a business capacity. We will not use that as a reason to refuse a reasonable request about your own information.
Children
DEF Rx is a business product and is not intended for anyone under 18. We do not knowingly collect information from children. If we learn that we have, we delete it.
Changes
We will update this policy when what we do changes. The effective date at the top will change with it. If a change is significant, we will tell account holders directly rather than relying on you to check.
Contact
privacy@defrx.com or (888) 603-3379
Hook & Haul LLC d/b/a DEF Rx 5105 Jefferson St., Unit 1 Houston, TX 77023