Legal
Privacy Policy
Effective October 3, 2026
PDI Industries LLC ("PDI", "we", "us") is a licensed property broker. USDOT 4316067. MC 1683157. Our address is 5473 Blair Rd, Ste 100, Dallas, TX 75231. Contact us at info@pdi-industries.com or 888-785-9387. This policy covers personal data on our website and carrier app.
Information we collect
You give us account and business details, names, email addresses, phone numbers, MC/DOT numbers, application details, documents, freight and driver contacts, offers, bookings, lane preferences, bids, messages and requests. Forms include factoring, legal protection, dispatch interest, fuel card applications and the repair waitlist, contact, inquiries and warehouse requests. Career contact links open your email app; this website has no separate resume submission form. We also receive public FMCSA records, public business and facility records, staff-entered CRM contacts and records you or your authorized team submit. We collect security and technical data such as request paths, browser information, hashed IP or email identifiers, sessions and error reports. Some operational audit and warehouse referral records can contain an IP address.
How we use your information
We use your information to verify carrier credentials through FMCSA, match you with relevant loads, refer factoring applications to our third-party factoring partner and keep you updated on their status, send load alerts and account notifications, and improve our platform. PDI advances no factoring funds and carries no factoring risk.
Information sharing
We share business and freight information with the carriers, shippers, brokers and warehouse partners involved in your request or load. This can include contacts, authority, insurance, quotes, shipment details and documents. We share application information with our factoring partner when you apply for factoring. Application handoff is staff-managed, not an automatic transmission when you submit the form. We do not sell your personal information to third parties.
Service providers
Replit hosts the app, database and file storage; its infrastructure includes Google Cloud services. Stripe processes platform payments and receives the billing and transaction details needed for them. FMCSA receives authority lookup identifiers. OpenAI processes assistant requests through Replit AI Integrations. Brevo or Resend receives recipient and message details to send account and notification emails when configured. We keep legacy mailbox records, but this version does not connect to Unipile or send staff email to an AI classifier. Expo and the device's push service receive tokens and notification content when push is enabled. Eagle Business Credit, LLC is our existing factoring partner. We disclose application information through the staff-managed referral process. The app contains no active campaign delivery worker. Optional integrations receive information only when enabled or used.
FMCSA data
We send MC or DOT numbers to FMCSA to check public authority, safety and insurance information. We store verification results and public carrier snapshots. FMCSA records can also contain business contact details. Staff review carrier signups; an FMCSA lookup does not approve an account.
Maps and location
We ask your browser for location only when you choose a location control and grant permission. We use it to center maps, show nearby places or start a route. The map keeps your device coordinates in page memory, not as a saved location history. OpenFreeMap tile requests reveal your IP and the area you view. Nominatim receives the place or address you search. OSRM receives route endpoints, including your device coordinates if you choose your location as the route start. Public map queries to PDI can include map bounds or a route corridor. Other map views can use Mapbox or the USGS National Map where configured. Opening directions in Google Maps sends the selected destination to Google. These providers apply their own privacy policies. Browser permission can be revoked in browser or device settings.
PDI Assistant
An outside OpenAI model processes the messages you send and relevant business context through Replit. Chat messages stay in browser memory and are not saved as conversation records in PDI's database. Closing or reloading the page clears that page memory. Contact details captured as a lead, or an inquiry, booking or alert you confirm, become ordinary business records with the retention described above. We retain aggregate assistant usage counters, not chat transcripts. PDI does not train AI models on your personal data. OpenAI says its API data is not used for training by default; the app does not enable training. This is not a zero-retention guarantee: OpenAI may retain abuse-monitoring logs for up to 30 days, or longer where its policies or law require. Replit also applies its provider policies. Do not enter sensitive information. AI responses can be wrong and are not financial or legal advice.
Marketing email
You can opt out of marketing by using the unsubscribe link in a marketing email or contacting us. Our marketing email path includes a postal address and one-click unsubscribe headers. We keep a suppression hash so future sends do not contact an unsubscribed address. The current campaign interface manages records and queues; it does not automatically deliver campaigns. Essential account, security and freight notices are separate from marketing and may still be sent when needed.
Sale, advertising and privacy signals
We do not sell personal data or share it for targeted advertising. We honor Global Privacy Control from your browser or the Sec-GPC request header, and Do Not Track. These signals block optional tracking and remove visitor identification from our first-party counts. We do not save the signals as a browser or account preference. No third-party advertising or analytics script is installed. Essential hosting, security, requested maps and payment functions still operate.
Visitor counts
We count visits and successful actions with a first-party tracker. It uses no tracking cookies or browser storage and stores no IP address in the visitor-count records. We hash the IP address and user agent with a random salt for each UTC day. We remove prior days' salts from the active database through midnight rotation and startup/hourly cleanup. The tracker does not use these daily keys to link visits across days. We cannot verify that database backups or development checkpoints exclude the salts; active-database deletion does not establish that all recovery copies are erased. Recovered salts and candidate IP addresses and user agents could allow daily keys to be matched across days. We respect Global Privacy Control and Do Not Track: page views are counted without a visitor key. We keep raw records for 13 months and daily totals indefinitely.
Data security
Our hosting uses TLS 1.2 or higher for data in transit. Replit reports AES-256 encryption at rest for its managed storage. The app also encrypts sensitive factoring application fields with AES-256-GCM and hashes passwords. Access rules restrict private records and files by role and ownership. No system can guarantee complete security. Do not send passwords, payment card details or sensitive documents through ordinary contact forms or chat.
Retention
The app has no general seven-year retention rule. Accounts remain until deletion or staff action. Most carrier, FMCSA, CRM, freight, offer, booking, billing, application, registered document, lead, waitlist, dispatch, RFP, inquiry, warehouse request, lane lookup, campaign and audit records have no automatic expiry. They remain until replaced, deleted through an available control, or removed after a records review. Factoring drafts are removed after successful submission. Registered files have no automatic expiry; unused upload requests expire after 15 minutes and their orphan files are removed by a cleanup job. Removing a file deletes its record and attempts to delete its stored object. Lane alerts and preferences remain until removed or eligible account deletion. Push tokens remain until replaced, cleared or the account is deleted. Marketing suppression hashes remain to honor opt-outs. Session cookies expire after seven days without activity; sessions have a 30-day absolute limit. Expired session rows are pruned. Expired rate-limit counters are cleaned every ten minutes. Login guard rows are eligible for removal after 24 hours of inactivity once unlocked. Vetting logs have no automatic expiry. Provider logs and backups follow the provider's retention rules; this app does not set their deletion periods.
Your rights
Email info@pdi-industries.com or call 888-785-9387 to request access, correction, deletion or a copy of your personal data, or to opt out of any sale, targeted advertising or profiling. We do not sell data, use targeted advertising or make AI-only carrier admission decisions. We may ask for information to verify your identity, but not your password. We will respond within 30 days. To appeal a decision, reply to our response with "Appeal" in the subject. Carriers can request account deletion in the app and confirm it with their password. If freight, offers, bookings or other operational records are linked, deletion stops without changing data and requires a staff records review. Eligible deletion removes the account, sessions, alerts and preferences, clears the linked carrier's personal details and removes personal identifiers from linked vetting entries. It does not erase retained business evidence or every provider log and backup.
Cookies
pdi.sid keeps you signed in. It is HttpOnly, uses SameSite=Lax and is Secure in production; its idle expiry is seven days. sidebar_state stores the sidebar setting for seven days where that control is used. The host can set GAESA for request routing; it is not an advertising cookie and its expiry is controlled by the host. Local storage keys are i18nextLng for language, pdi:rfp-draft:v1 for an unfinished bid request, and pdi-shipper-pinned-quotes for saved quote selections. Language and pinned quotes have no automatic expiry. Bid drafts are removed after submission, when empty or when you clear them; otherwise they have no automatic expiry. You can clear cookies and site storage in your browser, which may sign you out or remove drafts. The native carrier app uses device storage for its session, biometric preference, language/theme preference and bid draft. Biometric authentication is handled by the device; PDI does not receive biometric templates. There is no analytics-cookie setting in your PDI account.
Adults and business use
The platform is for businesses and adults 18 and over. It is not directed to children. Contact us if you believe a child has given us personal data.
Changes to this policy
We update this policy when our practices change and show the effective date here. Review it when you use a new feature. Contact us if you have questions about a change.
Contact
Privacy questions: PDI Industries LLC, 5473 Blair Rd, Ste 100, Dallas, TX 75231. Email info@pdi-industries.com or call 888-785-9387.