Government & Law Enforcement Request Policy

This policy governs how TrailerShopperAI ("TSAI," "we") responds when a government body, law enforcement agency, regulator, or other public authority asks us to disclose personal data about a dealer, a dealer's staff, or a buyer who contacted a dealer through our Service.

It applies to every category of data we hold, including Platform Data we receive from Meta — Facebook and Instagram account identifiers, access tokens, and the buyer comments and messages we surface in a dealer's inbox.

1. Every request is reviewed for legality before anything is disclosed

We disclose nothing on the strength of an informal ask. A request is actioned only after we have confirmed, in this order:

1. It is genuine. We verify the requesting agency and the identity of the officer through a channel independent of the request itself — a published agency phone number or official domain, never contact details supplied in the request.
2. It is the right instrument. Content of communications requires a warrant or an equivalent judicial order. Subscriber and account records require, at minimum, a subpoena, court order, or statutory demand valid under the law of the requesting jurisdiction.
3. It reaches us. The authority must have jurisdiction over TSAI or its operating entity. We are established in Wisconsin, United States.
4. It is specific. The request must identify the accounts or records sought. We reject bulk, exploratory, or open-ended demands.

Emergency disclosure — where there is a good-faith belief of an imminent risk of death or serious physical harm — is the sole exception to the instrument requirement. It is still logged under section 4, and still limited under section 3.

2. We challenge requests we believe are unlawful or overbroad

Where a request fails the review in section 1, or reaches further than the law permits, we do not comply as issued. Depending on the defect we will:

• Object and seek narrowing — ask the authority in writing to limit the scope, the date range, or the categories of data before any disclosure occurs.
• Require proper process — decline and state what instrument would be required instead.
• Move to quash or modify — instruct counsel to challenge the request before the issuing court or authority where objection and narrowing do not resolve the defect.
• Challenge gag provisions — where we are barred from telling the affected person, we will seek to have that restriction lifted or time-limited so notice under section 5 can be given.

3. We disclose the minimum information necessary

A valid request is not a general licence to our records. We produce only the specific fields the instrument compels, for only the accounts and the time period it names.

• We never respond to a request for one account by exporting a whole table, a whole dealer, or a whole date range.
• Where an identifier answers the question, we disclose the identifier rather than the underlying content.
• We do not volunteer adjacent records that were not asked for, and we redact unrelated third parties from any document produced.
• We never disclose access tokens or credentials. Meta access tokens are held encrypted and are not responsive to a request for a user's records.

4. Every request is documented

We maintain an internal register of authority requests. Each entry records:

• the requesting authority, the named officer, and the date received;
• the legal instrument relied on, and the jurisdiction;
• the accounts, data categories, and time period sought;
• the outcome — complied, narrowed and complied in part, challenged, or refused — and the exact data produced;
• the legal reasoning for that outcome, and who inside TSAI, and which external counsel, decided it;
• whether the affected person was notified, and if not, why not.

Entries are append-only and retained for at least seven years, so a request can be reconstructed after the fact.

5. We notify the affected person where we lawfully can

Our default is to tell the affected dealer or user before we disclose their data, so they have the opportunity to seek their own remedy. We withhold notice only where a court order or statute forbids it, or where notice would create a risk to life. When a gag expires or is lifted, we give the notice then.

6. Where the data actually sits

Some data a request seeks is not ours to produce. Content a dealer published to Facebook or Instagram lives with Meta, and a request for it should be directed to Meta. Payment records live with our payment processor. We will say so rather than reconstruct another controller's records from our own copies.

7. How to serve a request

Send legal process to Contact. Include the issuing authority, the instrument, the accounts sought, the statutory basis, and a contact we can independently verify. Requests sent through support channels are routed here, and the timeline in this policy starts on receipt at this address.

Related: our Privacy Policy describes what data we hold and who processes it, and our Data Deletion page describes how to have it erased.