Privacy Policy.

1. Who we are

Vantage Yard Management ("Vantage", "we", "us") is a B2B SaaS product of NEUMAX LLC, a limited liability company organized under the laws of the State of New Jersey, United States.

Vantage is currently offered to customers in the United States and Canada only.

We act in different roles depending on the type of personal information:

2. Personal information we collect

2A. Driver license images — important clarification

We process driver license images solely for identity verification through optical character recognition (OCR). We do not:

• Use facial recognition or face matching;
• Generate biometric templates, faceprints, or any unique mathematical representation of a face;
• Match faces across images, sessions, or accounts.

License images are stored as image files, not as biometric data. We do not collect or use biometric identifiers as defined under the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), or the Washington Biometric Privacy Act.

2B. Sensitive Personal Information (California)

Under the California Privacy Rights Act (CPRA), some data we process may be classified as "Sensitive Personal Information":

• Driver's license numbers (when uploaded by Customer);
• Precise geolocation (when collected during inspection events);
• Account login credentials (passwords, in hashed form).

We use Sensitive Personal Information only to provide the Service requested by the Customer. We do not use or disclose it to infer characteristics about you. California residents may request that we limit use of Sensitive Personal Information by emailing dpa@vantageyms.com.

3. How we use it

• Provide the Service — operate gate transactions, run OCR, render the dashboard, send notifications.
• Billing and account management — invoice you, retry failed charges, send receipts.
• Improve the product — aggregate, anonymized usage data and OCR-correction logs help us improve OCR accuracy and identify bugs. Customers may request that their organization be excluded from this dataset by emailing dpa@vantageyms.com.
• Security and fraud prevention — detect unauthorized access, abuse, or non-B2B sign-ups.
• Communicate — service announcements (always), product updates and tips (only if you opted in).
• Comply with law — respond to lawful requests; retain records required by tax, audit, or customs regulations.

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA). Specifically, we do not engage in cross-context behavioral advertising, and we do not provide personal information to third parties in exchange for monetary or other valuable consideration.

We do not allow our service providers (sub-processors) to use your data for their own purposes.

4. Who we share data with

We work with the following categories of service providers to operate Vantage. Each is bound by a contract that restricts use of your data to providing the Service.

A current list of named service providers is available on request to dpa@vantageyms.com. We do not sell or share data with brokers, data resellers, or advertising networks.

5. Where data is stored

Vantage data is stored and processed in the United States.

Vantage is currently designed for customers in the United States and Canada. If you are located outside North America, please do not use the Service or upload personal information through it.

6. Retention

Data retention depends on data type and Customer plan:

7. Security

• Transport — TLS 1.2 or higher for all client connections; HSTS enforced on the marketing website and authenticated app surfaces.
• At rest — encryption applied at the database and file-storage layers as provided by our cloud-hosting provider's standard security controls.
• Application-level access — organization-scoped row-level security (RLS) in the database, so customers cannot see each other's data through the application.
• Staff access — restricted to authorized personnel under our internal access policy, on a least-privilege basis.
• Vulnerability disclosure — please report security issues to security@vantageyms.com. We follow a 90-day responsible-disclosure window and do not pursue legal action against good-faith researchers.
• Breach notification — no security system is perfect. We will notify affected Customers without undue delay after confirming a personal-information breach, in accordance with applicable U.S. state breach-notification laws.

8. Your rights

Depending on your state of residence, you have the following rights:

• Right to know — what personal information we collect about you, the categories of sources, the purposes for collecting it, and the categories of third parties we share it with.
• Right to access — receive a copy of the personal information we hold about you.
• Right to correct — correct inaccurate information.
• Right to delete — request permanent deletion, subject to legal exceptions (e.g., tax records).
• Right to portability — receive your data in a structured, commonly used format (CSV or JSON).
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising, so this right is satisfied by default.
• Right to limit use of Sensitive Personal Information — California residents (see Section 2B).
• Right of non-discrimination — we will not deny service, charge a different price, or provide a different level of quality because you exercised your privacy rights.

These rights are available to residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other U.S. states with comprehensive privacy laws.

To exercise any right, email dpa@vantageyms.com. We will verify your identity using information already associated with your account. We respond as soon as practicable, and within 45 days as required by California law (with a possible 45-day extension if reasonably necessary).

If your data was uploaded by your employer (the Customer) and we hold it on their behalf, we will forward your request to that Customer or instruct you to contact them directly.

9. Children

Vantage is a B2B service intended for use by employees of our customers in their professional capacity. The Service is not directed to children, and we do not knowingly collect personal information from children under 13 (under the U.S. Children's Online Privacy Protection Act, COPPA).

If you believe we have inadvertently collected information from a child, email dpa@vantageyms.com and we will delete it.

10. Cookies & tracking

We separate cookie practices between the Vantage application and the Vantage marketing website.

Inside the Vantage application (mobile app, app.vantageyms.com, carrier.vantageyms.com)

We use only essential cookies and local storage required for authentication, session management, and preference retention (e.g., language, dark mode). We do not use third-party advertising cookies, behavioral tracking, or cross-site tracking pixels inside the application.

On the Vantage marketing website (vantageyms.com)

We currently do not use analytics, advertising, or marketing cookies on the marketing website. The site relies only on the strictly necessary cookies our content-delivery and security provider sets to deliver and secure the page (e.g., DDoS protection, performance optimization).

If we add product analytics or marketing cookies in the future, we will update this section in advance, display a cookie consent banner, and respect the Global Privacy Control (GPC) signal where applicable.

11. Notice at Collection (California)

In addition to this Privacy Policy, California residents are entitled to a Notice at Collection at or before the point personal information is collected. We provide that notice as follows:

• At sign-up: in the registration form, with a link to this policy;
• When granting camera permission: in the OS-level permission dialog, with a link to this policy;
• When uploading driver information: in the upload flow, with reference to this policy and the Customer's own privacy notice.

The categories of personal information we collect, the purposes for which we use them, and the retention periods are described in Sections 2, 3, and 6. We do not sell or share personal information for cross-context behavioral advertising; therefore, we are not required to provide a "Do Not Sell or Share My Personal Information" link.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced at least 30 days in advance by:

• An in-app banner;
• An email to the billing contact on file;
• A notice on the marketing website.

The "Last updated" date at the top of this page reflects the most recent change. Continued use of the Service after the effective date constitutes acceptance.

13. Contact

NEUMAX LLC is organized in the State of New Jersey, United States.