LegalDraft

Privacy Policy

This policy explains what DrayBase collects, why, and what we will never do with it. It covers the DrayBase web platform and this website.

DrayBase has not launched. There are no external customers, so no third party’s data is being processed under this policy yet. Anything tagged Planned below describes a part of the product that is not built — it is written down now so the policy does not have to change quietly on the day it ships.

1 · What we collect

• Account data — name, work email, role, carrier, MC and DOT numbers.
• Operational data — loads, containers, chassis, appointments, documents and rates you enter or import.
• Driver data — name, mobile number, and the status updates dispatch records against a load.
• Driver telemetry — GPS position while on duty, hours of service and proof-of-delivery photos. Arrives with the driver application. Planned
• Billing records — invoices, driver settlements and accounting exports. Planned
• Usage and diagnostic data — pages and actions in the product, device and browser, IP address, error traces.

2 · Driver location, specifically Planned

There is no driver application today, so DrayBase collects no location data from anyone.

When it ships, location will be collected only while a driver is on duty on a DrayBase load, because dispatch, dwell timers and settlement evidence depend on it. It will not be collected off duty, and a driver will be able to see on their own device exactly what is being recorded about them.

We do not sell driver location data. We do not share it with insurers, brokers or data resellers. That one is a commitment, not a roadmap item.

The intent is to keep location history for 13 months and then delete it. Saying so in a published policy requires a scheduled deletion job that does not exist yet, so the figure is not being promised in this draft: Pendiente: job de borrado de GPS a los 13 meses antes de publicar el plazo

3 · Why we process it

To run the service, to keep the platform secure, to comply with transport and tax record-keeping obligations, and to support you when you ask. Billing data will be processed to invoice you once paid plans open. Planned

Where we rely on legitimate interests, the balancing exercise against the individual rights at stake still has to be carried out and written down: Pendiente: evaluación de interés legítimo documentada

4 · Agent features Planned

The AI agent features are not built. When they ship, they will process your operational data inside your own tenant, and your data will not be used to train models that serve other customers.

Where a third-party model provider is involved, its contract has to forbid training on your content — a promise that is worth nothing until the contract exists and the list of subprocessors can be shown to you: Pendiente: contratos con proveedores de modelos y registro de subencargados

5 · Who we share with

Today the list is short, because the product is small: cloud hosting, and the provider that delivers transactional email. That is all.

As modules ship it will grow to include terminal and chassis-pool APIs, the ELD provider you connect, your accounting system, messaging carriers for SMS, and error monitoring. Planned Each needs a signed data-processing agreement before any of your data reaches it: Pendiente: DPA firmado con cada subencargado

We also disclose where we are legally required to, and we will tell you unless we are prohibited from doing so.

6 · Where it lives and how long

Data is hosted in the United States, in Dallas, Texas.

The intended retention is: operational records kept while your account is active and for 60 days after it closes, except where a longer period is legally required for tax or transport records. Deletion is a manual operation today, so the 60-day figure is a target rather than an automated guarantee: Pendiente: purga automática de datos al cierre de cuenta

7 · Security

Only what is true right now:

• Audit log on every mutation — who changed what, when, and on which record.
• Tenant isolation in the database — enforced by PostgreSQL row-level security, not by application code remembering to add a filter.
• United States hosting — the platform and its database run in Dallas, Texas.

What we are not claiming. There is no SOC 2 report and none is in audit. There is no annual penetration test, no published backup and restore policy, no mandatory two-factor requirement for our own staff, and no encryption at rest. Those are objectives, and this page will keep saying they are missing until each one is real and can be shown to you.

8 · Your rights

You can ask us for a copy of your data, correct it, delete it, or object to a particular processing activity. Drivers can make these requests to us directly if their carrier will not act on their behalf. Write to [email protected] and we will respond within 30 days.

9 · Cookies

The product uses a session cookie to keep you signed in. There are no advertising trackers, no third-party pixels and no cross-site profiles — on the product or on this marketing site.

If we add product analytics, they will be first-party and the IP address will be truncated before storage. Planned

10 · Children

DrayBase is a business tool and is not directed at anyone under 18.

11 · Changes and contact

Material changes get 30 days’ notice by email. Questions, requests or complaints go to [email protected].

Controller: Pendiente: razón social, Pendiente: domicilio social.