Privacy Policy

RouteReady LLC ("RouteReady," "we," "us," "our") operates an operations platform for Amazon Delivery Service Partner (DSP) operators, including hiring pipeline management, performance and attendance tracking, scheduling, compliance, HR record-keeping, and fleet management tools. This Privacy Policy explains how we collect, use, and protect personal information in connection with our services.

RouteReady acts as a data processor on behalf of DSP operators, who serve as data controllers with respect to applicant personal information. Each DSP operator is independently responsible for ensuring their use of applicant data complies with applicable law. DSP operators agree to this Privacy Policy by executing a service agreement with RouteReady.

Driver applicants are subject to the data practices described in this policy by virtue of their interaction with a DSP's hiring pipeline powered by RouteReady. This policy is provided to applicants for transparency — it is not a contract between RouteReady and applicants.

Effective Date: April 18, 2026  |  Last Updated: May 2, 2026

We collect personal information across two phases of the DSP employment relationship: (A) hiring, when the individual is an applicant, and (B) active employment, after the individual has been hired by the DSP operator and is using the platform as a driver or being tracked through it.

A. Applicant data (hiring pipeline):

• Name, phone number, and email address
• Employment eligibility and availability responses
• Driving history and background check consent
• Interview scheduling data and confirmation status
• Message response history and engagement timestamps
• SMS opt-in consent records including timestamp, phone number, opt-in method, and opt-in reply text
• Optional video introductions (when video screening is enabled by the DSP operator)

B. Active driver data (operations platform):

• Employment status, station assignment, tenure, and role
• Schedule and shift assignments, including swap and time-off requests
• Attendance events (Present, Late, Callout, No-show, VTO) with timestamps and notes
• Performance scoring data, coaching events (SMS, 1:1, route pull, suspension)
• HR file entries — suspensions, written warnings, reinstatements, terminations — including reason, evidence references, and effective dates (immutable once recorded)
• Driver license expiry dates and renewal reminder send history
• Vehicle assignment, asset issuance, and document references (insurance cards, registrations, DOT inspections)
• Inspection submissions (pre-trip / post-trip), including photos, video, and GPS location at submission
• SMS communications between the DSP operator and the driver routed through the platform

Sensitive personal information: Driving history, background check consent, and any HR file entries documenting protected characteristics (e.g., medical leave, FMLA, workplace injury) are treated as sensitive personal information under applicable state law, including California CPRA, Virginia VCDPA, Texas TDPSA, and Washington state law. This data is collected solely for employment-eligibility screening or HR-record-keeping on behalf of the DSP operator and is not used for any other purpose. Drivers and applicants in states with heightened sensitive data protections may have additional rights as described in §§ 12–13.

We also collect limited information from DSP operators including contact details, station preferences, schedule rules, attendance policy configuration, screening criteria, and platform usage logs.

Applicant data sourced via Indeed enters our pipeline through DSP-authorized integrations and is subject to this Privacy Policy from the moment it is received by RouteReady.

Information collected from driver applicants is used exclusively to:

• Contact applicants on behalf of the DSP operator who received their application
• Screen, score, and schedule qualified applicants for orientation
• Send confirmation and reminder messages before interview day
• Recover no-shows and promote waitlisted applicants
• Generate pipeline reports and The 7AM briefing for DSP operators

Information collected from active drivers is used exclusively to:

• Operate scheduling, attendance tracking, and daily check-in workflows
• Compute composite performance scoring and surface accountability decisions to the DSP operator
• Maintain a timestamped, immutable HR record of disciplinary actions and significant employment events for the DSP operator's compliance and unemployment-defense purposes
• Send license renewal reminders, schedule reminders, and operational alerts via SMS
• Track vehicle, asset, and document assignment for DSP fleet management
• Provide drivers with self-service access to their schedule, performance data, and HR records

We do not use applicant or active-driver data for advertising, profiling, cross-client purposes, model training without explicit DSP consent, or any purpose unrelated to operating the DSP for which it was collected.

RouteReady contacts driver applicants via automated SMS on behalf of DSP operators using Twilio's messaging platform. All automated SMS communications are subject to the Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227.

Prior express written consent: Before receiving any automated SMS messages, every applicant receives an initial opt-in confirmation message that identifies both the DSP operator and RouteReady as the sending parties. Automated hiring communications commence only upon the applicant's affirmative reply. A sample opt-in message reads:

"Hi [First Name], this is [DSP Name]'s hiring team, powered by RouteReady. Reply YES to receive application updates by text. Msg&data rates may apply. Reply STOP to opt out anytime. Consent is not required for employment."

No affirmative reply means no further automated messages are sent. Consent records — including the opt-in reply, timestamp, and phone number — are maintained for a minimum of four years.

Sender identification: Every message sent through RouteReady's platform identifies both the DSP operator and RouteReady. Messages include language such as "[DSP Name] hiring, powered by RouteReady."

Message frequency: Varies based on application stage, typically 3–8 messages per hiring cycle.

Message and data rates may apply.

To opt out: Reply STOP to any message. Your opt-out is processed immediately at the carrier level and no further automated messages will be sent. Opt-out records are maintained for a minimum of five years. A STOP request submitted in connection with any DSP's pipeline will suppress that phone number from automated communications across all RouteReady-powered pipelines unless you subsequently provide fresh express written consent.

For help: Reply HELP or email support@gorouteready.com.

Transactional nature: RouteReady's automated SMS communications are sent for employment hiring and application-status purposes only. These communications are transactional in nature and are not marketing or promotional messages. RouteReady does not send messages unrelated to a specific active job application.

RouteReady maintains a global opt-out suppression list independent of any individual DSP client. RouteReady does not contact numbers listed on the National Do Not Call Registry for marketing purposes.

Applicant data is retained for up to 12 months following the applicant's last interaction, unless the applicant requests deletion before that date. For purposes of this policy, "last interaction" means the most recent of: (a) the applicant's last inbound SMS or email reply; (b) the applicant's attendance at or confirmed no-show for an orientation session; or (c) any other affirmative engagement with the hiring pipeline. Passive events such as message delivery or pipeline system updates do not reset the retention clock.

DSP operator account data is retained for the duration of the service engagement plus 24 months following contract termination.

Opt-out records (STOP requests) and consent records (opt-in replies and timestamps) are retained for a minimum of five years to ensure compliance with TCPA and FCC requirements and to prevent re-contact of opted-out numbers.

RouteReady does not sell, rent, or trade personal information to third parties.

We share applicant information only with the specific DSP operator whose posting generated the application. DSP operators are data controllers and are independently responsible for their use of applicant data in accordance with their service agreement with RouteReady.

We use the following third-party service providers to operate our platform. Each operates under a Data Processing Agreement (DPA) or equivalent data protection commitment with RouteReady and is bound to protect data and use it only as directed:

• Twilio — automated SMS delivery and carrier-level opt-out management
• Google Workspace — data storage, pipeline management, and reporting (SOC 2 Type II)
• Airtable — applicant data management and pipeline operations
• Cal.com — interview scheduling and booking management
• Indeed — applicant sourcing via DSP-authorized integration

We do not share data with any other third parties except as required by applicable law or valid legal process.

RouteReady accesses applicant contact information via DSP-authorized third-party admin access to the DSP's Indeed employer account. This access is granted by the DSP operator and governed by the DSP's agreement with Indeed. RouteReady uses this access solely to retrieve applicant contact information for hiring pipeline purposes on behalf of the authorizing DSP.

Applicants whose data originates from Indeed should be aware that their contact information may be accessed by service providers engaged by the DSP — including RouteReady — for hiring-related communications. Before any automated messages are sent, applicants receive an opt-in confirmation message and must affirmatively consent as described in §4. RouteReady does not retain Indeed access credentials and does not access Indeed accounts beyond what is necessary to retrieve applicant data for the specific DSP engagement.

Applicant data received via Indeed is subject to this Privacy Policy from the moment it enters our pipeline. Applicants should also review Indeed's Privacy Policy with respect to data they submitted to Indeed directly.

DSP operators maintain their own Indeed accounts and billing relationships. RouteReady does not access or store Indeed account credentials beyond what is technically necessary during active pipeline sessions.

We implement reasonable and appropriate technical and organizational security measures to protect personal information, including:

• Encrypted data transmission (TLS) for all data in transit
• Access controls limiting data access to authorized RouteReady personnel with documented access policies
• Multi-factor authentication required for all systems containing personal data
• Data storage within Google Workspace and Airtable, both of which maintain SOC 2 Type II compliance
• Regular review of data handling practices, documented annually

No transmission over the internet is 100% secure. We cannot guarantee absolute security but take all reasonable steps to protect the information we hold.

In the event of a security incident resulting in unauthorized access to, or acquisition of, personal information, RouteReady will notify affected individuals and relevant regulatory authorities as required by applicable state and federal law. Notification will generally be provided within 72 hours of confirmed discovery of the breach, to the extent practicable.

DSP operators will be notified promptly and provided with information necessary to fulfill their own breach notification obligations as data controllers. Notification to DSP operators will occur no later than 48 hours after RouteReady confirms a breach affecting their applicants' data.

Driver applicants may request:

• Access — to the personal information we hold about them
• Correction — of inaccurate information
• Deletion — of their data from our systems
• Portability — of their data in a commonly used format
• Opt-out — of SMS communications by replying STOP to any message
• Limit use — of sensitive personal information (where applicable under state law)

To exercise any of these rights, contact us at support@gorouteready.com with "Privacy Request" in the subject line. We will respond within 30 days. Because RouteReady acts as a data processor on behalf of DSP operators, certain requests (such as deletion) may require coordination with the relevant DSP operator as data controller. We will identify any such dependency in our response and facilitate the request on your behalf.

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe we have collected information from a minor, please contact us immediately at support@gorouteready.com.

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what personal information is collected, used, shared, or sold
• The right to delete personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information
• The right to limit the use and disclosure of sensitive personal information
• The right to non-discrimination for exercising these rights

RouteReady does not sell or share personal information as defined under CCPA/CPRA. Driving history and background consent data collected in the hiring context may qualify as sensitive personal information under CPRA; RouteReady limits its use of this data to employment screening purposes only.

To submit a CCPA/CPRA request, contact us at support@gorouteready.com with "California Privacy Request" in the subject line. We will respond within 45 days as required by law, with one 45-day extension if necessary and upon notice to you.

Residents of the following states may have additional privacy rights under their respective state laws:

• Virginia (VCDPA, Va. Code § 59.1-571 et seq.) — rights of access, correction, deletion, portability, and opt-out of profiling
• Colorado (CPA, C.R.S. § 6-1-1301 et seq.) — rights of access, correction, deletion, portability, and opt-out
• Connecticut (CTDPA, Conn. Gen. Stat. § 42-515 et seq.) — rights of access, correction, deletion, portability, and opt-out
• Texas (TDPSA, Tex. Bus. & Com. Code § 541 et seq.) — rights of access, correction, deletion, portability, and opt-out; sensitive data processing requires consent
• Washington (My Health MY Data Act, RCW § 70.372) — broad protections for health-related data including data that may reveal health conditions inferred from hiring or background data

RouteReady will honor applicable rights requests from residents of these and other states with privacy legislation in effect. To submit a request, contact support@gorouteready.com and identify your state of residence so we can apply the correct legal framework. We will respond within the timeframe required by your state's law.

The RouteReady dashboard and website may use cookies and similar tracking technologies to maintain session state and analyze usage patterns. We do not use tracking cookies for advertising purposes or cross-site behavioral tracking.

You may disable cookies in your browser settings; this may affect dashboard functionality. We do not respond to browser Do Not Track (DNT) signals at this time.

Our website may contain links to third-party sites including job boards and scheduling platforms. This Privacy Policy applies only to RouteReady's services. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies independently.

We may update this Privacy Policy from time to time. Changes will be posted at gorouteready.com/privacy.html with an updated effective date. Material changes will be communicated to active DSP clients via email at least 14 days before taking effect.

For driver applicants, continued interaction with a DSP's pipeline following a policy update constitutes acknowledgment of the updated terms. We encourage applicants to review this policy periodically at the URL above.

This Privacy Policy is governed by the laws of the State of Missouri, without regard to conflict of law principles, except where applicable federal or state privacy law mandates otherwise. Nothing in this section limits the rights of individuals under applicable federal or state privacy or consumer protection laws.

For questions about this Privacy Policy or to exercise your rights:

RouteReady LLC
support@gorouteready.com
GoRouteReady.com

Please include "Privacy Request" in your subject line and identify your state of residence where applicable. We aim to respond to all privacy inquiries within 5 business days.