Data Processing Agreement

Last updated November 8, 2026

Summary: when Ten10 handles personal information inside your account (drivers, contacts, customers), it does so only for you and on your instructions, keeps it secure, uses vetted service providers, and helps you answer privacy requests.

1. Roles

For personal information in Customer Data, Customer is the controller (or "business") and Ten10 is the processor (or "service provider") under applicable US state privacy laws, including the Texas Data Privacy and Security Act and the California Consumer Privacy Act as amended by the CPRA where they apply. This DPA is part of the MSA.

2. Instructions

Ten10 processes personal information only to provide the Service, as described in the Agreement, and on Customer's documented instructions (including the settings and features Customer uses). Ten10 will not sell or share personal information, retain, use or disclose it outside the direct business relationship, or combine it with information from other sources except as the law allows for service providers.

3. Types of data and people

Contact details of Customer's users, drivers, carriers, brokers, shippers and their staff; driver license, medical card and qualification information Customer uploads; driver GPS location during loads; documents and messages; and payment or tax details Customer collects through carrier packets (stored encrypted).

4. Confidentiality and security

People who process personal information for Ten10 are bound by confidentiality. Ten10 maintains the safeguards in the Information Security and Access Control Policy.

5. Subprocessors

Customer authorizes Ten10 to use these subprocessors: Railway (hosting and database), Stripe (payments), Resend (email delivery), Google (maps, routing, Firebase notifications and website analytics), Apple (push notifications), Anthropic (AI document reading; data is not used to train its models), Microsoft Clarity (website analytics, website only), Twilio or Plivo (text messages, when enabled), and integrations Customer connects. Ten10 will update this list before adding a new subprocessor; Customer may object by email within 15 days, and if the objection can't be resolved, Customer may cancel.

6. Assistance

Ten10 will help Customer respond to requests from individuals to access, correct, delete or port their data, and with data protection assessments, to the extent Customer can't do so itself in the Service.

7. Incidents

Ten10 will notify Customer without unreasonable delay after confirming a security incident affecting Customer's personal information, with the information Customer reasonably needs to meet its own legal duties.

8. Deletion and return

At the end of the Service, Customer can export its data and Ten10 will delete it as described in the Data Ownership and Confidentiality Agreement, unless the law requires keeping it.

9. Audits

On reasonable written request (no more than once a year), Ten10 will answer Customer's security questionnaire and provide information needed to show compliance with this DPA.