Effective Date: July 4, 2026
MalcolmAI LLC ("MalcolmAI," "we," "us," or "our") is committed to protecting the privacy of our customers and the individuals whose data is processed through our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our AI-powered container inspection platform, mobile application, web admin dashboard, and related services (collectively, the "Service").
MalcolmAI provides a business-to-business (B2B) SaaS platform. Our customers are intermodal shipping terminals, container depots, and logistics companies ("Customers"). This policy applies to Customer employees and authorized users who interact with the Service, as well as individuals whose information may be captured during the container inspection process (such as truck drivers).
When Customers register for the Service, we collect:
During the container inspection workflow, the Service captures:
The Service captures photographs of driver's licenses or commercial driver's licenses (CDLs) for operator verification purposes. This may include:
Important: Driver credential data is collected by the Customer as part of their gate operations. MalcolmAI processes this data on behalf of the Customer. The Customer is responsible for ensuring that appropriate notice is given to drivers and that collection complies with applicable law.
Customers using the yard management and invoicing modules may store additional business records in the Service:
Important: This data is collected and controlled by the Customer as part of its own business operations. MalcolmAI processes it on behalf of the Customer.
Customers using the payments module can collect card payments from drivers for yard services. In connection with these payments, the Service processes:
Card data never touches MalcolmAI systems. Card numbers are entered directly into payment surfaces hosted by Stripe, our payment infrastructure provider (see Section 4.2). We store only the transaction outcome and non-sensitive metadata returned by Stripe.
When using the mobile application, we collect:
We automatically collect information about how the Service is used, including:
We use the information we collect for the following purposes:
| Purpose | Data Used |
|---|---|
| Providing the Service. processing container images, extracting data, delivering results to Customers | Inspection data, driver credentials, device/location data |
| AI Processing. analyzing images using multimodal AI models to extract container, chassis, plate, seal, and driver information | Photographs submitted through the inspection workflow |
| Quality Assurance. confidence scoring, review queue management, and accuracy improvement | Extracted data, confidence scores, manual correction history |
| Account Management. user authentication, access control, and subscription management | Account information, credentials, billing data |
| Customer Support. responding to inquiries, troubleshooting issues, and providing technical assistance | Account information, usage data, error logs |
| Service Improvement. analyzing usage patterns, optimizing performance, and developing new features | Aggregated usage and analytics data |
| Security and Compliance. detecting fraud, preventing unauthorized access, and maintaining audit trails | Access logs, device information, usage patterns |
| Gate Payments. creating payment charges, delivering receipts, processing refunds, and reconciling transactions on behalf of the Customer | Payment transaction records, payer contact information |
| Yard, Booking & Invoicing. tracking yard inventory, managing bookings, and generating storage invoices on behalf of the Customer | Yard operations data, shipping-customer records, booking and invoice records |
| Communications. sending service notifications, maintenance alerts, and product updates | Account contact information |
All inspection data, extracted results, and associated metadata are accessible to the Customer organization that initiated the inspection. Customers control access through their own user management and role-based permissions.
We share data with the following categories of service providers who assist in delivering the Service:
At the Customer's direction, we transmit extracted container data to the Customer's TMS, WMS, or ERP systems via webhooks, REST APIs, or direct database connections configured by the Customer.
We may disclose information when required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect the rights, safety, or property of MalcolmAI, our Customers, or others.
In the event of a merger, acquisition, or sale of assets, Customer data may be transferred to the successor entity, subject to the commitments made in this Privacy Policy.
We do not sell, rent, or trade personal information to third parties for their marketing purposes.
We also do not share personal information for cross context behavioral advertising as defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and effective in its 2026 form. To confirm, update, or revoke your preferences regarding the sale or sharing of personal information, visit our Do Not Sell or Share My Personal Information page. We honor verified opt out requests and Global Privacy Control browser signals on a forward looking basis.
Per the 2026 CCPA opt out confirmation rule, when you submit an opt out request through that page or via the unsubscribe link in any MalcolmAI marketing email, we provide a confirmation that the request has been recorded. If you submit a request from California and we cannot honor it for any reason, we will reply within fifteen business days with the reason and any path to remediation.
All data is stored on Amazon Web Services (AWS) infrastructure in the US-East-2 (Ohio) region. Our infrastructure includes:
We implement the following security measures:
In the event of a data breach affecting personal information, we will notify affected Customers without undue delay and in accordance with applicable law. Customers are responsible for notifying their own employees and any affected individuals as required by applicable data breach notification laws.
Customer Data is retained for the duration of the Customer's active subscription. Customers may delete individual records or request bulk deletion at any time through the web admin dashboard or API.
Upon subscription termination, Customer Data remains available for export for thirty (30) days. After the export period, Customer Data is deleted from our active systems within a commercially reasonable timeframe. Backups containing Customer Data are purged within ninety (90) days of deletion from active systems.
Anonymized, aggregated statistical data that does not identify any individual or Customer may be retained indefinitely for analytics and service improvement purposes.
We may retain certain data for longer periods as required by applicable law, regulation, or to establish, exercise, or defend legal claims.
Depending on your jurisdiction, you may have the following rights regarding personal information:
For individuals whose data is captured during the inspection process (such as truck drivers): your employer or the terminal operator is the data controller and is responsible for responding to your rights requests. Please contact them directly. If you contact MalcolmAI, we will direct your request to the appropriate Customer.
To exercise any rights, please contact us at info@malcolm-ai.com.
The Service is designed for business use by adults in the intermodal shipping industry. We do not knowingly collect personal information from children under 13 years of age. If we become aware that we have inadvertently collected information from a child under 13, we will take steps to delete it promptly.
The Service is hosted and operated in the United States (AWS US-East-2 region, Ohio). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We process data in accordance with applicable data protection laws, and Customers operating in jurisdictions with specific transfer requirements (such as the EU/EEA) should contact us to discuss appropriate transfer mechanisms.
The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
Continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.
For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:
MalcolmAI LLC
Iowa City, Iowa
Email: info@malcolm-ai.com
Web: malcolm-ai.com
We aim to respond to all privacy inquiries within thirty (30) days.