Privacy policy

Last updated: 2026-05-26. This is a V1 template — finalised version requires sign-off from your legal counsel.

1. Who we are

{COMPANY_LEGAL_NAME} ("we", "us") operates the Adveho carrier-operations platform. Contact: {CONTACT_EMAIL}.

2. Data we collect

  • Account data: email address, name, role, tenant company name.
  • Operational data: trips, drivers, vehicles, shippers, GPS positions (when you connect a GPS provider), tachograph records (when uploaded), documents (PDFs, photos), messages exchanged with drivers and shippers.
  • Driver data submitted via Telegram or the driver PWA: photos, voice transcripts, status updates.
  • Billing data: company name, VAT id, billing address (held by Stripe).
  • Technical data: IP address, browser user agent, request logs, error traces.

3. How we use it

  • To provide the service (the contractual basis under GDPR Art. 6(1)(b)).
  • To send transactional emails (sign-in links, status notifications).
  • To meet legal record-keeping obligations (Art. 6(1)(c)).
  • To debug, secure, and improve the service (legitimate interest, Art. 6(1)(f)).

4. Sub-processors

We use the following sub-processors. Each is bound by a DPA:

  • Vercel Inc. — application hosting (US, EU regions).
  • Supabase Inc. — managed Postgres + auth (EU region by default).
  • Anthropic PBC — LLM inference (Claude) for PDF order extraction and message categorisation.
  • OpenAI LLC — voice transcription (Whisper) for driver voice notes.
  • Resend Inc. — transactional email delivery.
  • Stripe Inc. — billing and invoicing.
  • Sentry / Functional Software Inc. — error monitoring.
  • PostHog Inc. — product analytics.
  • Telegram Messenger Inc. — driver messaging.

5. Retention

Operational records are retained for the lifetime of your subscription plus 90 days. Tachograph data is retained per EU Reg. 165/2014. Account data is deleted within 30 days of subscription closure on written request.

6. Your rights

You may exercise GDPR rights of access, rectification, erasure, restriction, portability, and objection by emailing {CONTACT_EMAIL}. We respond within 30 days.

7. International transfers

Some sub-processors process data outside the EEA under Standard Contractual Clauses. A current list is available on request.

8. Contact

Questions, complaints, and DPO requests: {CONTACT_EMAIL}.