Effective Date: October 2, 2026
MalcolmAI LLC ("MalcolmAI," "we," "us," or "our") is committed to protecting the privacy of our customers and the individuals whose data is processed through our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our AI-powered container inspection platform, mobile application, web admin dashboard, and related services (collectively, the "Service").
MalcolmAI provides a business-to-business (B2B) SaaS platform. Our customers are intermodal shipping terminals, container depots, and logistics companies ("Customers"). This policy applies to Customer employees and authorized users who interact with the Service, as well as individuals whose information may be captured during the container inspection process (such as truck drivers). When we process personal information on behalf of Customers, we do so under the Data Processing Agreement that forms part of the Master Terms of Service.
When Customers register for the Service, we collect:
During the container inspection workflow, the Service captures:
The Service captures photographs of driver's licenses or commercial driver's licenses (CDLs) for operator verification purposes. This may include:
Important: Driver credential data is collected by the Customer as part of their gate operations. MalcolmAI processes this data on behalf of the Customer. The Customer is responsible for ensuring that appropriate notice is given to drivers and that collection complies with applicable law.
Customers using the yard management and invoicing modules may store additional business records in the Service:
Important: This data is collected and controlled by the Customer as part of its own business operations. MalcolmAI processes it on behalf of the Customer.
Customers using the payments module can collect card payments from drivers for yard services. In connection with these payments, the Service processes:
Card data never touches MalcolmAI systems. Card numbers are entered directly into payment surfaces hosted by Stripe, our payment infrastructure provider (see Section 4.2). We store only the transaction outcome and non-sensitive metadata returned by Stripe.
When using the mobile application, we collect:
We automatically collect information about how the Service is used, including:
A Customer may turn on driver identity verification for its driver self-service gate check-in. When it is on, the driver is asked to take one photograph of their own face (a "selfie") with their phone, immediately after photographing their driver's license, and the Service compares the selfie with the portrait on that license photograph to confirm that the person checking in is the license holder. For this feature the Service processes:
Notice and consent come first. Before any selfie is taken, the driver is shown a written notice explaining what is collected, why, and how long it is kept, and must actively agree. A driver who does not agree is not asked for a selfie; the Customer's staff check the driver's license in person instead.
How the comparison works. The two images are compared by Amazon Rekognition, an Amazon Web Services face-comparison service (see Section 4.2), which measures facial features in both images to produce the similarity score. Each comparison is one-to-one, between the selfie and the license the driver just presented. Neither MalcolmAI nor the Service stores facial measurements, face templates, or face vectors, and selfies are never added to a face collection or searched against other people's faces. Selfies are not sent to Google Gemini.
Limited use. Selfies and comparison results are used only to verify the driver's identity at the Customer's gate, and to let the Customer's staff review a result the Service could not confirm. They are not used for any other purpose or to train AI models, and MalcolmAI does not sell, lease, trade, or otherwise profit from them.
Short retention. Selfies are deleted automatically 30 days after they are taken (see Section 6.5). The result and similarity score, but not the image, stay with the Customer's gate record.
Important: As with other driver data, the Customer decides whether to use this feature and is the controller of the data; MalcolmAI processes it on the Customer's behalf. The Customer is responsible for complying with biometric privacy laws that apply to its gates, such as the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and Washington's biometric identifier law.
We use the information we collect for the following purposes:
| Purpose | Data Used |
|---|---|
| Providing the Service. processing container images, extracting data, delivering results to Customers | Inspection data, driver credentials, device/location data |
| AI Processing. analyzing images using multimodal AI models to extract container, chassis, plate, seal, and driver information | Photographs submitted through the inspection workflow |
| Driver Identity Verification. where the Customer turns it on, confirming that the driver checking in at a self-service gate is the person on the license they presented | Driver selfie, license photograph, comparison result, consent record |
| Quality Assurance. confidence scoring, review queue management, and accuracy improvement | Extracted data, confidence scores, manual correction history |
| Account Management. user authentication, access control, and subscription management | Account information, credentials, billing data |
| Customer Support. responding to inquiries, troubleshooting issues, and providing technical assistance | Account information, usage data, error logs |
| Service Improvement. analyzing usage patterns, optimizing performance, and developing new features | Aggregated usage and analytics data |
| Security and Compliance. detecting fraud, preventing unauthorized access, and maintaining audit trails | Access logs, device information, usage patterns |
| Gate Payments. creating payment charges, delivering receipts, processing refunds, and reconciling transactions on behalf of the Customer | Payment transaction records, payer contact information |
| Yard, Booking & Invoicing. tracking yard inventory, managing bookings, and generating storage invoices on behalf of the Customer | Yard operations data, shipping-customer records, booking and invoice records |
| Communications. sending service notifications, maintenance alerts, and product updates | Account contact information |
All inspection data, extracted results, and associated metadata are accessible to the Customer organization that initiated the inspection. Customers control access through their own user management and role-based permissions.
We share data with the following categories of service providers who assist in delivering the Service:
At the Customer's direction, we make Customer Data available to the Customer's own systems, such as a TMS, WMS, or accounting system: through our API, when a system holding an API key the Customer has issued requests it, and by sending webhooks and accounting-export invoice data to endpoints the Customer configures.
We may disclose information when required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect the rights, safety, or property of MalcolmAI, our Customers, or others.
In the event of a merger, acquisition, or sale of assets, Customer data may be transferred to the successor entity, subject to the commitments made in this Privacy Policy.
We do not sell, rent, or trade personal information to third parties for their marketing purposes.
We also do not share personal information for cross context behavioral advertising as defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and effective in its 2026 form. To confirm, update, or revoke your preferences regarding the sale or sharing of personal information, visit our Do Not Sell or Share My Personal Information page. We honor verified opt out requests and Global Privacy Control browser signals on a forward looking basis.
Per the 2026 CCPA opt out confirmation rule, when you submit an opt out request through that page or via the unsubscribe link in any MalcolmAI marketing email, we provide a confirmation that the request has been recorded. If you submit a request from California and we cannot honor it for any reason, we will reply within fifteen business days with the reason and any path to remediation.
All data is stored and processed on Amazon Web Services (AWS) infrastructure in the United States, in the US-East-2 (Ohio) and US-East-1 (N. Virginia) regions. Our infrastructure includes:
We implement the following security measures:
In the event of a data breach affecting personal information, we will notify affected Customers without undue delay and in accordance with applicable law, consistent with our obligations under the Data Processing Agreement. Customers are responsible for notifying their own employees and any affected individuals as required by applicable data breach notification laws.
Customer Data is retained for the duration of the Customer's active subscription. Customers may delete individual records or request bulk deletion at any time through the web admin dashboard or API.
Upon subscription termination, Customer Data remains available for export for thirty (30) days. After the export period, Customer Data is deleted from our active systems within a commercially reasonable timeframe. Backups containing Customer Data are purged within ninety (90) days of deletion from active systems.
Anonymized, aggregated statistical data that does not identify any individual or Customer may be retained indefinitely for analytics and service improvement purposes.
We may retain certain data for longer periods as required by applicable law, regulation, or to establish, exercise, or defend legal claims.
Driver selfies (Section 2.8) are not kept for the length of the subscription. They are deleted automatically 30 days after they are taken, and any remaining stored copy is removed within one further day. This is far sooner than the identity check needs and well within the limits set by biometric privacy laws. They are deleted earlier on request (see Section 7). A selfie is kept longer only where the law requires it, for example under a court order or subpoena.
Depending on your jurisdiction, you may have the following rights regarding personal information:
For individuals whose data is captured during the inspection process (such as truck drivers): your employer or the terminal operator is the data controller and is responsible for responding to your rights requests. Please contact them directly. If you contact MalcolmAI, we will direct your request to the appropriate Customer.
If you took a selfie for driver identity verification and want it deleted before the 30 days are up, ask the terminal operator or email us at info@malcolm-ai.com, and we will delete it.
To exercise any rights, please contact us at info@malcolm-ai.com.
The Service is designed for business use by adults in the intermodal shipping industry. We do not knowingly collect personal information from children under 13 years of age. If we become aware that we have inadvertently collected information from a child under 13, we will take steps to delete it promptly.
The Service is hosted and operated in the United States (AWS US-East-2 region, Ohio, and US-East-1 region, N. Virginia). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We process data in accordance with applicable data protection laws, and Customers operating in jurisdictions with specific transfer requirements (such as the EU/EEA) should contact us to discuss appropriate transfer mechanisms.
The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
Continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.
For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:
MalcolmAI LLC
Iowa City, Iowa
Email: info@malcolm-ai.com
Web: malcolm-ai.com
We aim to respond to all privacy inquiries within thirty (30) days.