Privacy notice

Not an emergency channel

Online forms are not monitored as emergency channels and do not confirm service, dispatch a truck, approve an account, establish vehicle custody, authorize a release, or create an appointment. For urgent roadside help, call 757-748-8285. Relay calls are welcome; dial 711 for Telecommunications Relay Service.

Planned-service requests

The planned-service form collects:

• Name and phone number
• Requested service, date, and time
• Pickup and drop-off information
• Vehicle details and notes you choose to provide

Do not include payment-card numbers, account passwords, medical information, or other unnecessary sensitive details in the notes field.

Support, account, release, transport, and career intake

The secure support and career forms may collect your name, phone number, email address, organization, property or service location, vehicle information, experience, availability, notes, a typed acknowledgment, the form version, and the time submitted. Only the fields relevant to the request are requested. The forms are for a personal response, not enrollment in a marketing list.

Commercial-account, property-manager, transport, and release-related submissions expire automatically after up to 730 days if they have not become records needed for an active customer or legal relationship. Career-interest submissions expire after up to 180 days. The owner may close or delete either sooner. If a submission becomes part of an accepted job, account, employment, dispute, or legally required record, the applicable business-record period may be longer.

Private photos and documents

After an eligible support intake is accepted, you may choose to attach up to four JPEG, PNG, WebP, or PDF files. Career-interest records do not accept files. Eligible files are stored privately for owner-only review and are not published in the website gallery. The site verifies the declared file type and file signature, limits file size, randomizes storage names, and removes common metadata from supported images. Those controls do not guarantee that a file is harmless. Do not upload payment cards, passwords, Social Security numbers, medical records, unrelated personal information, or a document you are not authorized to share.

Private attachments follow the intake record's retention and are deleted when that record is deleted or expires. A download made by the business for an accepted matter may become a separate business record.

Private request status

A planned-service or secure-intake confirmation may include a private status link. The link contains a random access key in the part of the address after #; that fragment is removed from the address bar when the page opens and is not sent with the page request. The server stores only a one-way digest of the key. A valid key returns only a reference, request type or requested date and time, manual status, update time, limited owner message, and any manually listed appointment information. It does not return customer contact details, route details, files, notes, a truck location, an automatic arrival estimate, or a dispatch assignment.

Anyone who receives the complete private link may be able to view that limited status until the credential is revoked or the underlying record expires. Keep it private and call the business if it may have been shared.

Private account and team portals

The owner may create a private commercial or property account record containing an organization or property name, contact name, work phone or email, role, operational notes, and that account's request history. An account contact can submit relevant property, vehicle, location, and request details plus optional private files. Account access does not verify authority, establish custody, dispatch service, or approve a price or release.

The owner may create a team-member record containing only a display name, role label, work contact details, and operational notes. The team portal may show announcements, text resources, and assigned schedules and may collect availability, time-off, schedule-change, or internal requests. A submitted timecard records the work date, start and end time, break minutes, calculated worked minutes, optional notes, attestation version, submission time, review status, manager notes, and review history. This website is a payroll handoff tool, not a payroll processor or complete wage-record system. Do not enter Social Security numbers, birth dates, home addresses, bank or tax information, medical details, pay rates, or payroll credentials.

Private team and account access links contain random bearer credentials. The server keeps only one-way digests, exchanges a valid link for an essential server-side session, and immediately revokes existing sessions when the owner rotates or deactivates access.

Electronic acknowledgments and service feedback

An owner-created electronic acknowledgment stores its recipient label, title, exact text, version, SHA-256 content hash, expiration, access-credential digest, status, and timestamps. If signed, it also stores the typed signer name and separate confirmations of electronic consent, ability to access and retain the record, intent to sign, and consent version. The record is immutable after creation and may be marked void rather than silently rewritten. This general module is not automatically a tow authorization, contract, identity or title check, or vehicle-release approval.

The optional private feedback form may collect a service reference, name, contact method, rating, message, contact permission, acknowledgment version, and timestamps. The feedback is not automatically published. Public review destinations are separate, optional, and shown without regard to rating or sentiment. The site does not enroll a feedback submitter in marketing.

Technical information

Like most websites, the server receives standard request information such as an IP address, browser type, requested page, request time, and whether the browser sends a data-saving preference. Network addresses are used for short-term rate limiting, security, and abuse prevention. Application rate-limit keys use a one-way digest rather than the raw address and are deleted after their short reset window; Cloudflare may independently process network information under its own service terms. The data-saving signal is used only to serve the low-data page; it is not stored in a customer profile. The public site does not use advertising pixels or cross-site behavioral tracking.

Photos, reviews, and public profiles

The authorized manager can publish business photos, captions, an About story, social profile links, review destinations, and selected review highlights. Published items are intentionally visible to anyone who visits the public website.

Uploaded PNG, JPEG, and WebP images are processed to remove common embedded location, comment, and camera metadata before publication. Identifiable people, minors, customer vehicles, testimonials, logos, and creative work should be published only with the permissions and releases appropriate to that use. Private paperwork, precise private locations, and unnecessary license-plate details should not be published.

Featured review text should reproduce genuine public customer feedback accurately. A customer may call 757-748-8285 to ask about correction or removal of a review highlight or identifiable image.

How request details are used

Planned-service details are used to review availability, estimate the time needed, manage the request, and contact you about the requested service. Support and account details are used to assess and answer the stated request. Career-interest details are used only to consider possible work opportunities and communicate about that interest. Team records support scheduling, internal requests, and payroll handoff; electronic acknowledgments record the specific transaction shown to the recipient; private feedback is used to understand and respond to the reported experience. A submission does not create a service, account, release, appointment, or employment commitment. The public website does not take payment.

Location details

Pickup and drop-off text is stored with the request for Jacob to review. The website does not send those locations to a public mapping or routing service. Available times use a conservative planning buffer; Jacob confirms the route and arrival estimate directly.

The “Send Location to Elliott's Towing” button runs only after the customer presses it and grants the browser's location permission. The coordinates and reported GPS accuracy are stored in the authenticated owner portal for up to two hours and can be dismissed sooner. The owner email contains only a notice and reference directing the owner to the portal; it does not contain the coordinates. A location share does not include a customer name, phone number, or device identifier. GPS accuracy depends on the device, signal, surroundings, and permission settings.

The website does not track a tow truck, driver, customer, or device after the one-time share. It does not automatically request a route from a public mapping provider. The authenticated owner portal offers a map link; opening it sends the coordinates to the mapping provider under that provider's terms.

Owner notifications

Website bookings, secure intakes, and customer-authorized GPS shares are delivered to Elliott's Towing's authenticated owner portal. Cloudflare's email service sends a minimized alert to the business's designated Google Gmail inbox with a reference and portal link, not the customer's full submission, attachment, or GPS coordinates. The website does not automatically send customer texts or marketing messages, use an SMS provider, or use an external dispatch webhook.

Storage and retention

The booking system stores request details while a request is active. Completed or cancelled booking records are kept for at least 365 days and may be kept longer for service, accounting, disputes, insurance, and legal recordkeeping. Customer-authorized GPS coordinates expire from the owner portal after two hours. Text-only career-interest intakes normally expire after 180 days; other unconverted intakes and their eligible attachments normally expire after 730 days. Private feedback normally expires after 730 days and may be deleted sooner by the owner.

Submitted timecards, schedules, and electronic acknowledgment records are retained for at least four years and do not have a routine hard-delete control. Team-member, partner-account, announcement, resource, and request records remain while operationally needed and may be archived or deactivated. Manager-published wording, links, verified review highlights, and rights-confirmed public image files remain until the manager unpublishes or removes them. A deletion request may be limited when a record must be retained for an active service, wage or employment recordkeeping, transaction, dispute, safety, fraud prevention, accounting, insurance, or legal obligation.

Security

Administrative and technical safeguards limit access to private records. These include encrypted HTTPS transport, canonical-host enforcement, same-origin checks, strict field and file limits, rate limits and honeypots, non-public file storage, secure response headers, owner-only downloads, short-lived single-use owner sign-in codes, one-way access-key digests, rotation and deactivation controls, and role-separated server-side sessions. Private dashboard, team, account, acknowledgment, and status pages are excluded from search indexing; private API and export responses disable browser caching. Manager exports omit credential digests, sessions, secrets, and private file bodies. No method of internet transmission or electronic storage can be guaranteed completely secure.

Cookies

The public website does not set advertising or analytics cookies. Cloudflare may set a strictly necessary cf_clearance cookie for bot detection and abuse prevention. The private manager, team, account, and acknowledgment workflows use separate essential sign-in cookies after successful verification. See the cookie notice for details.

Other services and links

The site serves its typefaces and interface assets directly. Cloudflare hosts and protects the site, stores the application data and files described above, and sends minimized owner alerts and sign-in-code emails. Google provides the business Gmail inbox that receives those alerts. These providers process information under their applicable terms and privacy practices. If you follow a review, directory, social-media, or map link, the destination receives the information your browser normally sends and applies its own privacy and cookie practices. The public forms do not include advertising trackers, use an external dispatch webhook, or take payment.

Your choices

You may call 757-748-8285 (relay calls welcome through 711) to ask whether a submission is held or request access, correction, a portable copy where practical, or deletion. The business may need to verify your identity and relationship to the record. Some records—including immutable acknowledgments, timecard history, and records subject to a legal or business hold—cannot be changed or deleted through routine website controls.

Children's privacy

The website and towing services are not directed to children under 13, and the business does not knowingly collect personal information from children through its public forms.

Changes to this notice

This notice may be updated as the booking workflow or service providers change. The effective date above shows the current version.

Privacy contact

Questions about this notice or a request you submitted can be directed to Elliotts Towing LLC by calling 757-748-8285. Relay calls are welcome through 711. Please do not send payment-card information or account passwords.