LegalDraft

Privacy Policy

This policy explains what DrayBase collects, why, and what we will never do with it. It covers the DrayBase web platform and this website.

The DrayBase platform has not launched, so no carrier’s operational data is being processed yet. This website, however, is live and already processes personal data: if you join the waitlist or send us a message we store your name, work email, company, phone, home port, fleet size and message, together with a hashed IP address and your browser user agent used only to rate-limit abuse, and we email that submission to our own inbox. We use it to talk to you about early access and for nothing else, we do not add you to any other list, and you can have it deleted any day by writing to [email protected].

Anything tagged Planned below describes a part of the product that is not built — it is written down now so the policy does not have to change quietly on the day it ships.

1 · What we collect

• Account data — name, work email, role, carrier, MC and DOT numbers.
• Operational data — loads, containers, chassis, appointments, documents and rates you enter or import.
• Driver data — name, mobile number, and the status updates dispatch records against a load.
• Driver telemetry — GPS position while on duty, hours of service and proof-of-delivery photos. Arrives with the driver application. Planned
• Billing records — invoices, driver settlements and accounting exports. Planned
• Usage and diagnostic data — pages and actions in the product, device and browser, IP address, error traces.

2 · Driver location, specifically Planned

There is no driver application today, so DrayBase collects no location data from anyone.

When it ships, location will be collected only while a driver is on duty on a DrayBase load, because dispatch, dwell timers and settlement evidence depend on it. It will not be collected off duty, and a driver will be able to see on their own device exactly what is being recorded about them.

We do not sell driver location data. We do not share it with insurers, brokers or data resellers. That one is a commitment, not a roadmap item.

The intent is to keep location history for 13 months and then delete it. Saying so in a published policy requires a scheduled deletion job that does not exist yet, so the figure is not being promised in this draft: Not in force yet — the scheduled job that deletes location history at 13 months. We will not claim it here until it is.

3 · Why we process it

To run the service, to keep the platform secure, to comply with transport and tax record-keeping obligations, and to support you when you ask. Billing data will be processed to invoice you once paid plans open. Planned

Where we rely on legitimate interests, the balancing exercise against the individual rights at stake still has to be carried out and written down: Not in force yet — the documented legitimate-interest assessment behind it. We will not claim it here until it is.

4 · Agent features Planned

The AI agent features are not built. When they ship, they will process your operational data inside your own tenant, and your data will not be used to train models that serve other customers.

Where a third-party model provider is involved, its contract has to forbid training on your content — a promise that is worth nothing until the contract exists and the list of subprocessors can be shown to you: Not in force yet — signed contracts with the model providers and a sub-processor register. We will not claim it here until it is.

5 · Who we share with

Today the list is short enough to name every party in it: Cloudflare, which handles DNS, TLS and bot protection in front of every DrayBase hostname and therefore sees the IP address and request metadata of every visit; InterServer, the datacenter in Dallas, Texas where the platform and its database run; and our own mail server, which delivers transactional email. There is no fourth party. If that changes, this list changes with it.

As modules ship it will grow to include terminal and chassis-pool APIs, the ELD provider you connect, your accounting system, messaging carriers for SMS, and error monitoring. Planned Each needs a signed data-processing agreement before any of your data reaches it: Not in force yet — a signed DPA with every sub-processor. We will not claim it here until it is.

We also disclose where we are legally required to, and we will tell you unless we are prohibited from doing so.

6 · Where it lives and how long

Data is hosted in the United States, in Dallas, Texas.

The intended retention is: operational records kept while your account is active and for 60 days after it closes, except where a longer period is legally required for tax or transport records. Deletion is a manual operation today, so the 60-day figure is a target rather than an automated guarantee: Not in force yet — the automatic purge that runs when an account closes. We will not claim it here until it is.

7 · Security

Only what is true right now:

• An audit trail designed into the schema — every operational record has an audit_events row waiting for it: actor, action, entity and a before/after diff. It is not wired yet, and the dispatch board is read-only today, so there is nothing to record. The rule we hold ourselves to: no module ships a write path until that write is audited. Planned
• Tenant isolation in the database — enforced by PostgreSQL row-level security, not by application code remembering to add a filter.
• United States hosting — the platform and its database run in Dallas, Texas.

What we are not claiming. There is no SOC 2 report and none is in audit. There is no annual penetration test, no published backup and restore policy, no mandatory two-factor requirement for our own staff, and no encryption at rest. Those are objectives, and this page will keep saying they are missing until each one is real and can be shown to you.

8 · Your rights

You can ask us for a copy of your data, correct it, delete it, or object to a particular processing activity. Drivers can make these requests to us directly if their carrier will not act on their behalf. Write to [email protected] and we will respond within 30 days.

9 · Cookies

The product uses a session cookie to keep you signed in. There are no advertising trackers, no third-party pixels and no cross-site profiles — on the product or on this marketing site.

If we add product analytics, they will be first-party and the IP address will be truncated before storage. Planned

10 · Children

DrayBase is a business tool and is not directed at anyone under 18.

11 · Changes and contact

Material changes get 30 days’ notice by email. Questions, requests or complaints go to [email protected].

Controller: DrayBase LLC, based in Gainesville, Georgia — its full registered name and address appear in every agreement we sign, and we will send them to you the same day if you ask at [email protected].