1. The short version
- Our public information pages set no cookies and use no analytics, advertising or tracking tools.
- On our website we collect what you send us through forms and the booking page, and our host logs your IP address and browser details to serve each page.
- Inside RailOps, each railroad decides what is collected about its people and customers. We process that information for the railroad under its subscription agreement and use it only to provide, support, secure and improve RailOps for that railroad.
- Some RailOps features send information to an AI provider (Anthropic or Google Gemini) when someone uses them. AI features lists each one and exactly what it sends.
- We do not sell personal information and do not share it for targeted advertising.
- Our service providers, what they do and where they operate are listed below.
To ask a question or make a request, write to sales@clearlineprotocol.com with "Privacy" in the subject line.
2. Who we are
This policy is published by Clearline Protocol LLC, a Texas limited liability company doing business as Clearline Protocol Rail ("we", "us"). It covers our website, clearlineprotocolrail.com; our demonstration and call-booking pages; RailOps, our software for railroads, including the RailOps portal, the Rail Customer Builder customer application and the crew application; and the Clearline support channel. Our company site, clearlineprotocol.com, and the other Clearline Protocol products sold there are not covered by this version.
Contact: sales@clearlineprotocol.com, with "Privacy" in the subject line. We will publish a dedicated privacy address on this page once it exists.
3. Our two roles
We handle personal information in two different capacities. Which one applies decides who makes the decisions about it and who you should ask.
| Information | Our role | Who decides, and who to ask |
|---|---|---|
| What you send us on our website, demonstration requests and access, call bookings, and your messages to us | Controller: we decide why and how it is used | Us, at sales@clearlineprotocol.com |
| Information a railroad keeps in RailOps about its employees, its customers and its operations | Service provider (processor) for the railroad, under its subscription agreement | The railroad. If you work for a railroad that uses RailOps, or are one of its customers, ask the railroad; we help it answer. |
| Railroad data our staff and the AI support assistant see while helping a railroad | Service provider (processor) for the railroad | The railroad, which controls support access |
Under its subscription agreement, a railroad's data belongs to the railroad. We use it only to provide, support, secure and improve RailOps for that railroad, to comply with law, and as the railroad directs in writing. We do not sell it, and we share it only with service providers bound by obligations no less protective than ours.
4. Our website and forms
| When | What we collect | Why | Where it goes |
|---|---|---|---|
| You visit a page | Your IP address, browser and device description (user agent), the page requested and the time | To deliver the page and protect the site from abuse | Netlify, our host, in its server logs |
| You ask for demonstration access | Name, company, e-mail address, phone number, your message, and the page you sent it from | To reply and, if we agree, issue you a demonstration login | Our database on Supabase, plus a copy e-mailed to us through Netlify Forms |
| You e-mail or call us | What you choose to tell us, and your contact details | To answer you | Our mailbox |
Our public information pages, including this one, set no cookies, use no analytics or advertising tools, and load nothing from other companies' servers. Forms are protected against automated submissions with a hidden field rather than with a tracking service.
5. Demonstrations and invitations
- Invitations. When we invite you by e-mail, we record your first name, company and e-mail address with a one-time link. The code in the link is stored only in scrambled (hashed) form. Anyone who opens the link sees the first name, company and e-mail address it was sent for, so forwarding the invitation shares those details.
- Demonstration logins. If we issue you a login, the demonstration records your name and e-mail address on the account, which level of access you have, when you sign in and from which browser (user agent), and your acceptance of the Non-Disclosure & Evaluation Notice. We are told of each demonstration sign-in (your name, e-mail address and level of access) through Netlify Forms.
- Demonstration data is fictitious and is reset every hour. Do not enter real operational data, personal information or confidential information into the demonstration.
6. Call bookings
When you book a call from a link in one of our e-mails, we collect your name, company, e-mail address, phone number, an optional note, your time zone and the time you choose. The booking is stored in our database on Supabase. Resend sends a confirmation e-mail with a calendar invitation to you and to us; the invitation includes your name and phone number, so they appear in both calendars. Your confirmation contains a private link for cancelling the call.
We use booking details only to hold the call and to contact you about it.
7. Inside RailOps
Each railroad that uses RailOps has its own environment, and its Director decides who has an account and which features are switched on. On the railroad's behalf, RailOps holds:
| Category | Examples | Notes |
|---|---|---|
| Accounts | Names, employee IDs, e-mail addresses, roles and account status | Created by the railroad's Director or Trainmaster. |
| Sign-in records | The browser and device description (user agent) of each sign-in, recorded about once every six hours per person per device, and the version and time of each acceptance of the Terms of Use | Shown to the railroad's management; kept for 2 years under the retention schedule. |
| Operations | Reports, switch lists, orders, car movements, inspections and other records, with the name of the person who recorded each one | For regulated records, the database itself stamps who recorded them and when. |
| Training and qualification | Training progress, exam results, evaluations and Part 243 records | Visible only to the roles the railroad allows. |
| Safety | Incident reports and safety concerns | A safety concern raised confidentially is stored without a name, both in the record and in its change log. |
| Location (Job Tracking add-on only) | Where each job is, worked out from the reports crews already file; a crew check-in when someone taps "Where we are"; and, only after a crew member accepts the location notice (recorded with its version, the time and the device), their phone's position every few minutes while signed on | Crew members can turn sharing off on their own screen. Positions are deleted every night once they are older than the period the Director sets (30 days unless changed). A railroad may let a customer see the job carrying its cars. |
| Customers of the railroad | Facility names, and contact names, e-mail addresses and phone numbers | Entered by the railroad. |
| Photos and files | Photographs of switch lists, and documents people upload | Kept with the railroad's records. |
Two optional features send railroad data to a destination the railroad chooses. If a Director sets up the Google Sheets export, every submitted report and delay is sent to the Google Apps Script address the Director enters. Where switch lists and other documents, such as positive transfers and interchange orders, are e-mailed from RailOps, Resend delivers them to the recipients the sender enters.
If you work for a railroad or one of its customers, the railroad is responsible for telling you about this processing and for answering your requests; we help it do so.
8. AI features
Some features send information to an AI provider to produce an answer. Each runs only when someone uses it; nothing is sent in the background. Requests go through RailOps' own server functions, so your browser never contacts an AI provider directly. We do not train AI models on your information.
| Feature | Provider | What is sent |
|---|---|---|
| RailOps AI, the operating assistant (optional module) | Anthropic | Your question and a snapshot of the railroad's operation: yards and tracks with the cars on them (including commodities, hazmat details and bad orders), customers, jobs, the notes written under Industry Info and the yardmaster's operating rules. The assistant never sends training-program content. |
| AI Transcription, reading a switch list from a photograph (optional module) | Anthropic | The photograph |
| AI briefings on the Analytics and Efficiency screens | Anthropic | Figures RailOps has already calculated. The Efficiency briefing includes employees' names with each person's average work times and safety flags, and trainees' names with their progress and evaluation results. |
| Ask AI and AI quiz generation in Training | Anthropic | Ask AI sends the railroad's whole training program with the trainee's question; quiz generation sends the lessons of one module. These are the only features that send training-program content. |
| AI analysis of a trainee's evaluations | Google Gemini | The trainee's name, evaluation scores by competency area, evaluators' votes on retaining the trainee, and evaluators' comments |
| AI help in the Demurrage Calculator (customer application) | Google Gemini | Your conversation, tariff text, photographs of demurrage statements you add, and calculation results |
| The Clearline AI support assistant (see section 9) | Anthropic | Our staff's questions, the RailOps Documentation, and railroad data read under a Director's time-limited grant, with names cut to initials (in full only when our staff open one specific account) and e-mail addresses, employee numbers and phone numbers masked |
RailOps AI uses the Anthropic API key that the railroad's Director enters in Settings, or a key we set on the server; the Google Gemini features use a key held on the server. The RailOps AI server function does not store questions or answers. The Demurrage Calculator stores each AI answer, with the account that asked but not the question, in the railroad's database where that log has been set up, so that a disputed answer can be reproduced.
The AI notice and the generation log (from 2026-10-29). Before a person first uses an AI feature, RailOps shows them a notice (version ai-2026-10-29) saying what the AI is, that it can be wrong and never acts by itself, what is recorded, what each feature sends, and that every AI screen can be done by hand. Their acceptance is recorded (who, which version, when, from which browser) and can be withdrawn under Settings, after which the AI refuses them until they accept again. Every AI request is logged by the server: who asked, their role, the feature, the purpose the screen named, the provider and model, the size and a fingerprint (SHA-256) of the request and of the answer, which notice was in force, and what a person then did with the answer. The words of the request and the answer are not kept in the log. A Director of the railroad can read the log; each person can read their own entries. Log entries are kept for two years unless the railroad sets another period.
9. The Clearline support channel
When a railroad asks us for help, we handle the contact details and messages of the people involved as controller, and any railroad data we see as the railroad's service provider. Our staff and our AI support assistant look at a railroad's RailOps data only while its Director has granted support access (for at most 90 days, ending on its own, revocable at any time and recorded in RailOps) or with the railroad's written permission. The assistant is read-only, and it is barred from evaluation, training and qualification, incident, safety-concern, hazmat, waybill, location and sign-in records.
We log each assistant session (which tools ran, which tables and columns were read, row counts, times, the grant and the staff member involved), never the data itself, and keep those logs for 2 years. Our Terms of Use set out the full rules of the support channel.
10. Service providers and where they operate
We use these companies to run our website, RailOps and support. Each receives only what its job needs.
| Provider | What it does for us | Personal information involved | Where |
|---|---|---|---|
| Supabase, on Amazon Web Services (AWS) | Database, sign-in and server functions for RailOps, and for demonstration requests, invitations and call bookings | Everything RailOps stores, including account details and password hashes; server function logs | United States: AWS us-east-2 (Ohio) |
| Netlify, including Netlify Forms | Hosting for our website and the RailOps web applications; form submissions | IP address and browser details in server logs; the contents of demonstration requests and demonstration sign-in notices | United States company; pages are served from its global network |
| Anthropic | AI model for RailOps AI, AI Transcription, AI briefings, Ask AI and quiz generation in Training, and the Clearline support assistant | What each feature sends (see AI features) | United States company; processing location under its terms |
| Google Gemini (Google's AI service) | AI model for the Demurrage Calculator and trainee-evaluation analysis | What each feature sends (see AI features) | United States company; processing location under its terms |
| Google Apps Script | Google Sheets export, only if a railroad's Director sets it up | Every submitted report and delay | The railroad's own Google account |
| Resend | E-mail delivery: call-booking confirmations and calendar invitations, and switch lists and other documents e-mailed from RailOps | Names, e-mail addresses and phone numbers in calendar invitations; the contents and recipients of e-mailed documents | United States company |
| Backblaze B2 | Encrypted storage for nightly database backups | A full copy of the production database, including accounts | United States (US East) |
| GitHub | Source code, and the automation that makes the nightly backups | Backups pass through GitHub's build machines; if the upload to Backblaze B2 fails, that night's backup is kept as a private GitHub file for 14 days | United States company |
| OpenStreetMap tile servers | Map images on the RailOps jobs map and rail map | Your IP address and browser details, and the map area you view | OpenStreetMap Foundation's servers |
| Google Fonts | Typefaces on the RailOps rail map page only | Your IP address and browser details | Google's global network |
| Cloudflare cdnjs | Delivers the pdf.js library to the Demurrage Calculator in the customer application | Your IP address and browser details | Cloudflare's global network |
Our public information pages use none of the last three. Build tools we use to produce demonstration narration receive script text only, never personal information.
11. How long we keep information
| Information | How long |
|---|---|
| Demonstration requests, invitations and call bookings | Until we delete them or you ask us to; no fixed period is set yet. |
| Hosting and server function logs | As long as Netlify and Supabase keep them under their own policies; we do not copy them elsewhere. |
| Records a railroad keeps in RailOps | As the railroad decides. RailOps shows a retention schedule, with the governing rule for each kind of record, on its Records page. Regulated records are kept for between 1 and 6 years depending on the rule, and RailOps never deletes a regulated record on its own. |
| Sign-in records and Terms of Use acceptances | 2 years, under the RailOps retention schedule. Deleting a person's account also deletes these records; suspending the account keeps them. |
| Job Tracking positions | Deleted every night once older than the period the railroad's Director sets (30 days unless changed). Location consents are kept. |
| A railroad's data after its subscription ends | The railroad has 60 days to export or move it. After that we may delete it, and we will on written request, except for copies in backups and records the law requires us to keep. |
| Nightly backups | A full copy of the production database is made every night and stored encrypted with Backblaze B2. Backups do not yet expire automatically. |
| Demurrage Calculator AI answers | In the railroad's database, where that log is set up, with no fixed period yet. |
| Clearline support assistant logs | 2 years. |
12. How we protect information
Connections to our website and to RailOps are encrypted (TLS 1.2 or 1.3). RailOps data is stored with our hosting provider, which encrypts it at rest. Each railroad runs in its own environment, row-level security in the database limits what each login can read, and vendor support access is controlled by the railroad's Director. Backups are encrypted and stored with a separate provider.
No system is perfectly secure. Our Security page describes these controls in detail, what we do not yet have, and how to report a problem.
13. Your choices and rights
- Website, demonstration and booking information. You can ask us for a copy of what we hold about you, ask us to correct it or delete it, and ask us to stop contacting you. Write to sales@clearlineprotocol.com with "Privacy" in the subject line. We may need to confirm your identity first, and we will not treat you differently for asking.
- Information in RailOps. Ask the railroad you work for or deal with; it controls that information. If you write to us instead, we will pass your request to the railroad and help it respond.
- Crew location sharing. Turn it off at any time on your own screen in RailOps.
- E-mail from us. Reply to any of our messages and ask us to stop.
- No sale. We do not sell personal information and do not share it for targeted advertising.
Depending on where you live, privacy laws may give you further rights. We are reviewing which laws apply to us and will set out the details here:
14. Children
Our website and RailOps are for businesses and the people who work for them. They are not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, write to us and we will delete it.
15. Cookies and storage on your device
The full statement is our Cookies Policy; the short version follows.
- Public pages. Our public information pages set no cookies and store nothing on your device. We use no analytics, advertising or tracking tools.
- Demonstration pages. Once you sign in to the demonstration, your browser keeps your sign-in session, and the time your visit was last recorded, in its local storage.
- RailOps. The RailOps applications keep your sign-in session in your browser's local storage. So that crews can keep working without signal, they also keep copies of recently viewed records and any changes waiting to be sent on the device, and keep server responses for up to 24 hours. Signing out does not yet clear these copies; on a shared or lost device, clear the browser's data for the site or remove the app.
- Content from other providers inside RailOps. The maps load images from OpenStreetMap, the rail map page loads Google Fonts, and the Demurrage Calculator loads pdf.js from cdnjs. Those providers receive your IP address and browser details when that happens. We set no cookies for them.
16. Changes to this policy
When we change this policy, we publish the new version on this page with a new version string in the form privacy-YYYY-MM-DD and a line in the change log below. If a change materially affects how railroad data is handled, we will also tell subscribing railroads directly.
| Version | Effective | Change |
|---|---|---|
| privacy-2026-10-23 | 2026-10-23 | First version. |
17. Contact
Write to sales@clearlineprotocol.com with "Privacy" in the subject line. When a dedicated privacy address exists we will move to it and update this page. For our postal address for legal notices, see Contact and notices in our Terms of Use. To report a security issue, follow the disclosure policy on our Security page.
Questions: sales@clearlineprotocol.com. See also our Terms of Use and our Security page.