1. Who We Are and What This Policy Covers
Infomax Consulting Inc. (“Infomax,” “we,” “our,” or “us”) operates INFOMAX TRAINING, a safety training platform for motor carriers, at training.infomaxci.com and in the INFOMAX TRAINING mobile app (together, the “Platform”). This Privacy Policy explains what personal information the Platform collects, how we use and share it, how long we keep it, and the choices you have.
The Platform is a business service. A carrier or other company (an “Organization”) signs up through a Trainer, who enrolls the Organization’s people as Trainees (Trainees include CMV operators and office staff). The Organization decides who is trained and uses the resulting training records for its own compliance purposes. Our marketing website, www.infomaxci.com, has its own privacy policy.
The Platform is intended for businesses and their personnel in the United States. It is not directed to individuals in the European Union or other countries.
2. Information We Collect
Information you or your Organization give us
- Account information: full name, email address and password. Passwords are handled by our authentication provider and stored only in hashed form.
- Organization information: organization name and type, the Trainer who created it, and Trainer team roles and permissions.
- Invitations: the name and email address a Trainer enters to invite a Trainee or another Trainer.
- Messages: if you use a contact form, your name, email, phone number, company, team size and message; and anything you send us by email.
- Compliance packet details: when a Trainer generates an English proficiency compliance packet, the Trainer may type details such as a CDL number and state, DOT number or hire date. These are used to build that document and are not saved by the Platform.
Information created as you use the Platform
- Training records: course enrollments, lesson progress and completion, time spent in timed slide and video lessons, quiz attempts and scores, course completion dates and certificates (certificate number and PDF).
- Commercial Driver English Proficiency Test (CD-EPT) records: voice recordings, camera video and still photos, transcripts, answers, scores and review notes, described in detail in Section 4.
- AI help requests: questions you type into the in-course help assistant and the recent conversation, plus requests for a quiz explanation.
- Payment records: what was purchased, amounts, discounts, promo codes and Stripe transaction identifiers (see Section 6). We do not receive or store card numbers.
- Security and audit records: logs of significant actions (for example, staff changes to accounts, test reviews and refunds), including the IP address of the person who took the action; records of when you gave consent for test recording, with your IP address and browser type; and records of your agreement to our Terms of Service and Privacy Policy (see Section 8).
Information collected automatically
- Technical data: IP address (used for security and to limit abusive request rates), browser and device type, and error reports when something breaks.
- Mobile app data: if you allow notifications, a push notification token, your device model or operating-system build identifier and the app version; and crash and diagnostic reports. See Section 12.
- Cookies and local storage: see Section 9.
What we do not collect
We do not ask for Social Security numbers, dates of birth, home addresses or bank account numbers, and we do not save driver’s license numbers. The only exception involving a license is the optional identity check described in Section 4, which uses a photo of the license.
3. How We Use Information
We use personal information to:
- create and secure accounts, sign you in, and give each person access suited to their role;
- deliver courses, track progress and seat time, grade quizzes and issue certificates;
- run, score and review CD-EPT tests (Section 4);
- show Trainers the training records of their Organization’s Trainees;
- process payments and refunds;
- send service emails and app notifications, such as invitations, password resets, enrollment and test assignments, and certificates;
- answer questions and provide support;
- keep the Platform secure, prevent fraud and cheating, protect course content, diagnose errors and keep audit trails;
- comply with law and enforce our Terms of Service.
We do not sell personal information, we do not share it for targeted advertising, and we do not send marketing email from the Platform. We do not use Trainees’ recordings, transcripts or training records to train AI models.
4. The Commercial Driver English Proficiency Test (CD-EPT): Voice and Camera Recording
An Organization can assign a Trainee the CD-EPT, a spoken English test: a simulated roadside conversation with an AI examiner, used as a pre-screening tool related to the English language requirement in 49 CFR 391.11(b)(2). This section explains what the test records. Before a test starts, the Trainee is shown a recording notice and must give consent; if the Trainee does not consent, the test does not start.
What is recorded
- audio of the Trainee and of the AI examiner, saved as recordings;
- video of the Trainee from the device camera, combined with the audio;
- still photos from the camera, taken about every 15 seconds during the test;
- a written transcript of the conversation, and any corrections made to it by a reviewer;
- the Trainee’s answers (including naming road signs), scores, reviewer notes and the final result;
- a record of the Trainee’s consent to camera recording, with the date, IP address and browser type.
How the recording is processed
- During the test, the Trainee’s voice is streamed through our servers to an AI voice provider that acts as the examiner and produces the transcript. Today that provider is Google (Gemini) or xAI (Grok).
- After the test, the transcript and measurements of the audio are sent to Anthropic (Claude), which produces a draft score. To produce the pronunciation and clarity measurements, short segments of the Trainee’s recorded audio are sent to Google (Gemini).
- The camera video and still photos are not sent to any AI provider. They are kept so that people can check, if needed, that the right person took the test.
- Every AI score is reviewed by a person on our team before a final result is recorded. The AI does not make the final decision.
No voiceprints or face recognition
We do not create voiceprints, face templates or any other biometric identifier from test recordings, and we do not use the recordings to identify anyone by automated means. The recordings are used to run, score and review the test and as evidence of the test.
Optional identity check
An Organization’s test can be set to require an identity check before the test. If it is, the Trainee receives a separate notice and consent request first. The check is run by our payment provider’s identity service (Stripe Identity), which captures a photo of the Trainee’s driver’s license and, if the test requires it, a selfie that Stripe compares with the license photo. We keep copies of those images, and the match result, for 30 days and then delete them automatically.
Who can see test records
- the Trainee, who can view their own results and play back their own recordings;
- Trainers in the Trainee’s Organization who hold the reporting permission: they can see results, scores and transcripts, play the audio and video, view the still photos and consent records, and generate a compliance packet for the Organization’s files;
- authorized members of our team who review and support tests;
- others only as described in Section 5, for example a regulator or auditor to whom the Organization gives a compliance packet, or where the law requires.
How long test records are kept
Our retention schedule for test recordings, still photos and transcripts is three years from the date of the test, a period chosen to support Organizations’ recordkeeping under the federal driver qualification file rules (49 CFR 391.51). At the end of that period we permanently delete the recordings and still photos. Identity check images are deleted after 30 days, as described above. A Trainee may ask us to delete their recordings sooner; see Section 11.
5. How We Share Information
With your Organization
Trainees’ training records belong to the Organization’s training program. Trainers in your Organization can see your name and email, your course enrollments, progress and completion, your certificates, and, for the CD-EPT, the records described in Section 4. What an individual Trainer can see depends on the permissions the Organization gives them. The Organization may keep and use these records under its own policies, for example in its driver qualification or training files.
With service providers
We use the following providers to run the Platform. They process information on our behalf, for the purposes described here.
- Supabase: database, sign-in and file storage.
- Railway: application hosting and caching.
- Cloudflare: network delivery, security, and aggregate site performance statistics.
- Stripe: payments, and the optional identity check.
- Resend: delivery of service emails.
- Expo: delivery of mobile app notifications.
- Sentry: error monitoring.
- Google (Gemini): the AI examiner and audio measurements in the CD-EPT, the in-course help assistant and quiz answer explanations.
- xAI (Grok): the alternative AI examiner in the CD-EPT.
- Anthropic (Claude): draft scoring of the CD-EPT.
- Telegram: delivering contact-form messages to our team.
- YouTube and Vimeo: some course lessons play videos hosted by these services, which receive your IP address and browser information when a video plays.
For legal reasons and business changes
We may disclose information if we believe in good faith that the law, a subpoena or a court order requires it, or to protect the rights, property or safety of our users, the public or us. If Infomax is involved in a merger, acquisition or sale of assets, personal information may transfer as part of that transaction, subject to this Policy.
6. Payments
Purchases are paid by the Organization through Stripe’s hosted checkout. Card details are entered on Stripe’s page and go directly to Stripe; we never see or store full card numbers. We send Stripe the Organization’s name and internal identifiers for the purchase (such as which course or test was bought, and for which Trainee). Stripe’s own use of payment information is governed by the Stripe Privacy Policy.
7. AI Features
The in-course help assistant sends your question, the recent conversation and the related lesson or quiz content to Google (Gemini) to produce an answer. We do not send your name or email with these requests, but anything you type is sent, so please do not include personal or sensitive information in your questions. AI answers can be wrong; see the Terms of Service.
8. How Long We Keep Information
- Accounts and training records (enrollments, progress, quiz results, certificates): for as long as the account or the Organization’s account is active, and after that for as long as needed for the Organization’s recordkeeping, unless deletion is requested under Section 11. Carriers often must keep training records for years after training (for example, 49 CFR 172.704(d) and 382.401), so we do not delete them automatically.
- CD-EPT recordings, still photos and transcripts: three years from the test date (Section 4).
- Identity check images: 30 days.
- Payment and refund records: kept for accounting, tax and dispute purposes.
- Audit trails and consent records: kept for as long as the records they document, because they show what happened to those records, except records of your agreement to our Terms, described next.
- Records of your agreement to our Terms of Service and Privacy Policy (the version, date and time, IP address, browser or device, and a one-way coded form of your email address): kept while your account exists and for six years after it is deleted, including when you ask us to delete your account, so we can show which terms applied if a dispute arises. Then we delete them.
- Short-lived data: cached copies of records expire within minutes; error reports are kept under our error monitoring provider’s retention settings.
10. Security
We protect information with encryption in transit, access controls based on role and Organization, private storage for certificates and test recordings with short-lived download links, rate limits on sign-in and other sensitive actions, and tamper-evident audit trails for CD-EPT tests. No system is completely secure. If a security breach affects your personal information, we will notify you and others as required by law.
11. Your Choices and Rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong;
- delete your account or specific information, including CD-EPT recordings.
To make a request, email [email protected] from the email address on your account, or tell us how to verify your identity. The Platform does not yet offer self-service download or deletion, so we handle requests by hand and will respond within 45 days.
Because Trainee records are kept for an Organization’s training program, we may tell the Organization about a deletion request before acting on it. We may keep information where the law requires us to, or where we need it to resolve a dispute, prevent fraud or complete a financial record. If you ask us to delete your account, we keep the record of your agreement to our Terms of Service as described in Section 8 and delete everything else the request covers. A copy that an Organization has already downloaded, such as a certificate or compliance packet, is in the Organization’s control, and you may need to ask the Organization about it. We will not treat you differently for exercising these rights.
Some state privacy laws give residents additional rights. If one applies to you, we will honor those rights as that law requires. If we decline your request, you may reply to our decision to ask us to reconsider it.
12. Mobile App
The INFOMAX TRAINING mobile app gives access to courses, quizzes, certificates and Trainer dashboards. You sign in with an account created on the web; accounts cannot be created in the app. The app sends us:
- Your account and training activity: your name, email and account ID (to sign you in and show your records), lesson progress and completion, video watch time, quiz answers, and your notification preferences. These sync to your account like the website.
- Push notification details, only if you allow notifications: the Expo push token, your device model or operating-system build identifier, and the app version. We use them only to deliver notifications. When you sign out, the app asks our servers to delete the token. You can turn notifications off in your device settings.
- Crash logs and diagnostics: crash reports and error details (such as operating system, device model and app version) sent to Sentry, with names, email addresses and sign-in tokens removed before sending, plus performance measurements from about 10% of sessions.
Course content you download for offline use, your pending progress and your sign-in session are kept on your device in the app’s own storage; the sign-in session is kept in the device’s secure storage.
The app does not collect your location, contacts, photos or videos, or files; it does not use the camera and does not record from the microphone. It contains no advertising and does not track you across other companies’ apps or websites. The app sells nothing and has no in-app purchases; purchases are made on the website. The CD-EPT runs in a web browser, not in the app. To protect course content, the app may block screenshots and shows your name over lessons.
To ask for deletion of your account and its data, follow Section 11.
13. Children
The Platform is for adults in the workplace. It is not directed to children, and no one under 18 may use it. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.
14. Changes to This Policy
We will post any change on this page with a new “Last updated” date. If we make a material change, such as using personal information in a new way or sharing it with a new kind of recipient, we will also notify affected users by email or in the Platform before the change takes effect. We will not apply a material change to information we collected earlier without the consent the law requires.
15. Contact Us
Questions or requests about this Privacy Policy: [email protected]
Infomax Consulting Inc.
2760 Forgue Dr, Suite 104
Naperville, IL 60564
www.infomaxci.com
See also our Terms of Service.