Privacy policy
Version 0.9 (draft for attorney review) · October 29, 2026
Draft for attorney review. Bracketed items are placeholders to fill in before publishing (3 left).
Who we are and our role
Tovarlo is trucking management software run by [legal company name], doing business as Tovarlo, [address]. It is used by motor carriers and owner-operators (“carriers”) to run loads, dispatch, invoicing, driver pay, expenses, IFTA and compliance.
- Carriers control their records. When a carrier adds its drivers, trucks, customers and loads to Tovarlo, the carrier decides what goes in and how it is used. Tovarlo stores and processes that information for the carrier, as its service provider.
- Tovarlo controls account and billing information for the people who sign up, and information about how the software is used.
- Drivers: if you drive for a carrier that uses Tovarlo, your carrier is responsible for the information it keeps about you. You can also contact us, and we will pass your request to your carrier or help where we can.
This policy covers the Tovarlo website, the office web app and the Tovarlo Driver app for iPhone and Android.
What we collect
| Who | What | Where it comes from |
|---|---|---|
| Office users (owners, dispatchers, accountants) | Name, email, password (stored hashed), company role and permissions, sign-in times, two-step sign-in settings (the authenticator app’s setup, never your codes), the language you signed up in, and your optional answer to “What do you want to do first?” at sign-up | You, when you sign up or are invited |
| Carrier company | Company name, MC and DOT numbers, address, phone, billing email, logo, factoring company, voided check for factoring, settings | The carrier |
| Drivers | Name, mobile number, email, company or owner-operator status, preferred language; CDL number, state and expiry; medical card expiry; dates of the last driving record review, drug test and Clearinghouse query (dates only, never results); roadside inspections and hours-of-service violations entered by the office; pay setup, pay statements, advances, deductions and escrow; the last 4 digits of a fuel card; for the carrier’s year-end summary, a mailing address, the last 4 digits of a tax ID (never the full Social Security or EIN number) and whether the carrier treats the driver as an employee or a contractor, with each change of that | The carrier, and the driver in the Driver app |
| Other payees (people the carrier pays through pay statements, such as office staff or a truck’s owner) | Name, pay setup and payments; for the year-end summary, a mailing address, the last 4 digits of a tax ID and whether they’re an employee or a contractor | The carrier |
| Location | The phone’s location at the moment a driver taps a trip step (start trip, arrived, loaded or unloaded, delivered). Never when accepting or rejecting a load, logging fuel, detours or odometer readings, or sending a message, and never in the background or between taps. Kept 1 year, then removed (the step and its time stay). | The Driver app, with the phone’s permission |
| Photos and documents | Paperwork scanned in the Driver app or uploaded by the office: rate confirmations, bills of lading, proofs of delivery, lumper and fuel receipts. Hidden location and camera details are removed from photos before they’re stored. | Drivers and the office |
| Trucks, trailers and fuel | Unit numbers, VIN, plates, odometer readings, registration, insurance and inspection dates, maintenance and repairs, fill-ups (gallons, price, state, station), the last 4 digits of a truck’s fuel card, and the card company’s transaction numbers from imported fuel card files | The carrier and drivers |
| Carriers’ customers (brokers and shippers) | Company name, contact name, billing email, phone, MC number, payment terms and history | The carrier |
| Loads and trips | Pickup and delivery places and times, rates and charges, miles by state, invoices and payments | The carrier, drivers and mapping services |
| Messages and alerts | Text messages between the office and drivers, and alerts the office sends, with when each was read and when a driver tapped “Got it”; the phone’s push notification token, so the Driver app can show “New message from [company]” | The office and drivers |
| Tracking links | When the carrier shares a tracking link for a load, a random link code, the email address it was sent to and when, and how often the page was opened (counted with a one-way code of the visitor’s network address in 10-minute windows, deleted after 8 days) | The carrier, and visitors to the tracking page |
| Billing (when billing starts) | Plan, truck count and payment status, and the automatic-renewal terms you agreed to at checkout (the wording and when); card and bank account details are held by our payment processor, Stripe, not by Tovarlo | The account owner |
| Usage | Device and browser type, IP address, pages used and errors, to keep the service working and secure | Collected automatically |
| Error reports and sign-in security | When something breaks, an error report goes to our error tracking service (Sentry) with names, emails, phone numbers, addresses and record contents removed and ids replaced by a one-way code. To protect accounts we count sign-in attempts per account with a one-way code of the network address (never the address itself) and the country; password sign-ins to an account under attack can be paused for an hour (a password reset by email lifts it). Kept 90 days. [Draft for the attorney review.] | Collected automatically |
| How you found Tovarlo | Your optional answer to “How did you hear about Tovarlo?” at sign-up, and the campaign tag in the link you arrived from (for example “fb-oct”), kept in a small cookie for up to 90 days until you sign up. The tag names an ad or campaign, not you. We use these only as totals to see which ads work. If you came through another carrier’s invite link, a cookie remembers that link for up to 90 days and we record who referred whom: the sign-up page shows you the inviter’s company name, and the inviter sees your company name and whether the free month was earned; to stop abuse of the free month, we compare both companies’ USDOT and MC numbers, owner emails, and the codes Stripe gives each card or bank account (never the number itself). | You, at sign-up, and the link you arrived from |
| Questions to Tovarlo Assistant | What you type in the website chat is sent to Anthropic to answer it. Tovarlo saves the questions and answers for 90 days to improve Tovarlo and its help pages, with emails and phone numbers removed and without your IP address, then deletes them (keeping only counts by topic). To limit how many questions can be asked each day, we keep a daily count per visitor as a one-way code made from your IP address, not the address itself, deleted after 2 days. | You, in the chat |
| Contact requests from the website chat | If you leave your email or phone number (and optionally your name) in the chat, we keep them with your question, the questions from that chat and the time and wording of the consent you gave, so we can answer you. A reply may be drafted by Tovarlo Assistant (AI), which sends your question and name to Anthropic; a person at Tovarlo checks every reply before it’s sent. We contact you by email, phone or text only if you ticked the consent box (consent isn’t required to buy). To stop, reply STOP to a text, use the unsubscribe link in our email, or tell us any other way, and we’ll stop within 10 business days. Kept for 1 year if you don’t become a customer (90 days after you sign up if you do), or until you ask us to delete it. If you ask us to stop or to delete it, we keep a keyed one-way code of your email and phone (not the email or phone itself; it can’t be turned back into them without Tovarlo’s secret key) so we never contact you again. Separately, we keep a record of your consent (when you gave it, the wording, and the same keyed codes of your email and phone; not your question) for [5 years, the attorney decides], in case it’s ever disputed. [Draft for the attorney review.] | You, in the chat |
| Questions to the in-app help assistant | Questions you ask the help assistant in the office app are sent to Anthropic to answer them, and saved for 90 days without your name or company (with emails and phone numbers removed) to improve Tovarlo’s help. If you choose “Email support”, your question, email and company name go to Tovarlo support so we can reply; the first answer may be drafted by Tovarlo Assistant (AI, through Anthropic). | You, in the office app |
| Support requests and Tovarlo’s support assistant | Your “Email support” requests (question, email, company name) and our replies, kept 1 year or until you delete your sign-in. Our support assistant (AI, through Anthropic) reads each request and drafts the reply; a person at Tovarlo checks it before it’s sent, unless we turn on answering general questions on its own (questions about money, your account or anything it can’t answer always wait for a person). To answer follow-ups it keeps the conversation for 1 year and looks at your last 5 (a coworker’s only as a date and topic, unless you’re the owner or manage Settings). It can look at the carrier’s records only while the carrier has turned on “Allow Tovarlo support”, only for the request it’s working on and only what the person who asked may see; each look is in the carrier’s support visit log, and the records go to Tovarlo staff, never to Anthropic. If you message Tovarlo on Facebook or Instagram, the same applies to those messages [not connected yet]. | You, by email, in the office app, or on social media |
How we use it, and what we never do
We use information to run Tovarlo and to:
- run loads, dispatch, trip steps, paperwork, messages and alerts
- send invoices, payment reminders, pay statements and tracking links by email
- text sign-in codes to drivers and notify them of new messages
- work out pay, IFTA miles and fuel, per diem, maintenance and compliance due dates, and the year-end summary for the carrier’s accountant
- keep accounts secure, prevent fraud (including abuse of referral rewards) and fix problems
- answer support requests; Tovarlo staff and our support assistant (AI) open a carrier’s records only while the carrier has turned on “Allow Tovarlo support”, and each look is logged where the carrier can see it
- answer questions in the website chat and the help panel, and get back to people who ask us to contact them
- improve Tovarlo and its help pages from saved questions (emails and phone numbers removed)
- count, as totals only, which ads and links bring new customers
- bill for the service and meet legal duties
We never:
- sell personal information or share it for advertising
- track drivers’ location in the background or between trip steps
- keep drug or alcohol test results (only the dates the carrier enters)
- use one carrier’s records for another carrier
Who we share it with
- Inside the carrier: people on the carrier’s team see what their role allows. Drivers see their own loads, pay statements and escrow.
- People the carrier sends things to: the carrier’s customers and factoring company receive invoices and paperwork that the carrier chooses to send. When the carrier shares a tracking link, anyone with the link sees the carrier’s name and contact details, the load number, each stop’s city, state and appointment, and the time of each trip step, plus the delivery paperwork only if the carrier chose to include it; never the driver’s name, the rate, street addresses or location points. A link stops working 30 days after delivery, or sooner if the carrier turns it off.
- Service providers that run parts of Tovarlo for us, only for that purpose and under contract:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Hosting the web app |
| Resend | Sending email |
| Twilio | Texting sign-in codes to drivers. Twilio receives the driver’s mobile number and the code only. Twilio also texts Tovarlo’s own staff about outages |
| Expo (with Apple’s and Google’s push notification services) | Notifying drivers of new messages and alerts. They receive the phone’s push token and a line saying “New message from [company]” or “New alert from [company]”, never the message text |
| HERE Technologies | Truck routes and miles by state (load stops only, no driver details) |
| FMCSA (U.S. Department of Transportation) | Checking a broker’s or carrier’s operating authority (the MC or USDOT number only, no personal details) |
| Stripe | Billing (when billing starts): Stripe holds the card or bank account and processes payments |
| Sentry (Functional Software, Inc.) | Error reports, so we can find and fix problems: the error, the page’s address without its details, the app and browser type, and a one-way code instead of the company. Names, emails, phone numbers, addresses and record contents are removed before a report is sent. [Draft for the attorney review.] |
| Anthropic | Tovarlo Assistant (AI): answering questions in the website chat and the app’s help, reading rate confirmations and receipts you upload, and drafting replies to support emails, website contact requests and messages to Tovarlo on social media. What you type or upload is sent to Anthropic to produce the answer. Anthropic deletes it within 30 days and doesn’t use it to train AI models (longer only if it’s flagged for a safety review or the law requires it). |
| Cloudflare | The “I’m human” check on sign-up, sign-in, password resets and the website contact form (it sees your browser and network address), and storing Tovarlo’s backups, which are encrypted with a key Cloudflare never has |
| GitHub (Microsoft) | Running Tovarlo’s weekly encrypted backup, storing Tovarlo’s code, and tracking fixes for errors (error reports with personal details removed, no customer records) |
| Meta Platforms (Facebook and Instagram) | If you message or comment on Tovarlo’s Facebook or Instagram pages, Meta passes the message to us so we can answer [not connected yet] |
- Legal reasons: when the law requires it, for example a valid court order or a tax audit request, or to protect people’s safety.
- Business changes: if Tovarlo is sold or merged, records move to the new owner under this policy.
Your information is kept in the United States. Our database is in Supabase’s East US region (Northern Virginia) and the web app runs in Vercel’s Washington, D.C. region; Stripe, Anthropic, Twilio, Expo, Resend, Sentry and Cloudflare’s backup storage also keep it in the United States. Cloudflare’s “I’m human” check runs on Cloudflare’s servers around the world.
Keeping and deleting data
Trucking records have to be kept for years, so Tovarlo never quietly deletes a carrier’s business records. Personal sign-in details are different and can be deleted at any time.
| Record | How long | Why |
|---|---|---|
| Loads, invoices, pay statements, expenses, fuel and trip records, messages and alerts, and the year-end tax details | While the carrier’s account is open, then 5 years after it closes (1 year for a free trial closed for inactivity, below) | IFTA requires 4 years from the last return filed, and tax, payroll and leasing rules also apply; 5 years covers them all |
| Driver and truck compliance dates | While the account is open, then as above | Audits and inspections |
| A free trial that ended without a subscription | Closed automatically after 6 months with nobody using it: no sign-ins, no one staying signed in, no driver taps, loads or expenses (the owner is emailed 30 and 7 days before, with a link to download everything), then deleted 1 year after closing | It never became a customer, and it can keep its own copy from the export |
| Location points from trip steps | 1 year, then removed (the step and its time stay) | So the carrier can check a stop for a while, without keeping where drivers were for good |
| Sign-in details (login, phone number, email, two-step settings, terms accepted) | Until the person deletes their account | Needed to sign in |
| Phone push notification tokens | Until the driver signs out, changes phone number or deletes their account | To notify the driver of new messages |
| Support visit log (who at Tovarlo looked at a carrier’s records, and when) | With the carrier’s records: while the account is open, then 5 years after it closes | So carriers can see who looked at their records |
| Support requests and support assistant conversations | 1 year (a support request goes sooner with the person’s sign-in); its working notes 90 days | To answer follow-ups |
| Questions to Tovarlo Assistant | 90 days (monthly counts by topic stay) | To improve the help pages and answers |
| Contact requests from the website chat | 1 year if you don’t become a customer, or until you ask us to delete it; if you sign up, 90 days after you sign up (only a count stays) | To get back to you |
| Do-not-contact list (keyed one-way codes of emails and phones only) | For good | So someone who asked us to stop is never contacted again |
| Proof of consent from the website chat (wording, time, keyed one-way codes) | [5 years, the attorney decides] | In case a consent is ever disputed (TCPA claims can be brought for about 4 years) |
| Referral records | Until either company’s records are deleted (5 years after it closes) | To give and check the free months |
| Sign-in security counts, and an account paused after a sign-in attack | 90 days (a pause: 90 days after it ended) | Security |
| Daily counts per visitor (a one-way code of the network address) for the website chat, the contact form and the tracking page | 2 days (the tracking page: 8 days, to spot unusual lookups) | To limit how often a page can be used |
| Request logs and error reports at our providers | Vercel’s request logs 1 day; Sentry’s error reports 30 days | Fixing problems |
| Backups | 8 weeks, encrypted with a key Tovarlo keeps offline; something deleted from Tovarlo can stay in a backup until it’s replaced | To restore Tovarlo after a failure |
Deleting your account
- Drivers: in the Tovarlo Driver app, open the menu and choose “Delete my account”. This deletes your sign-in and removes your phone number, email and app language. Your carrier keeps the business records it needs under trucking, tax and leasing rules, with your name: loads and trip steps, pay statements, fuel and receipts, messages you sent, your CDL and compliance dates (federal rules make the carrier keep a driver’s qualification file, including the license, for 3 years after the driver leaves), and the mailing address and last 4 digits of the tax ID it entered for your year-end summary. Location points are removed after 1 year. To ask your carrier to delete or correct those records, contact your carrier. You can also ask by email at [privacy@tovarlo.com] or on our account deletion page.
- Office users: Settings → “Delete my account”. A company’s last owner hands ownership to someone else first, or closes the company: the owner of a closed company can then delete their sign-in from the closed company’s page (with no owner left, the company can’t be reopened, and the reminder before its records are deleted goes to its billing email).
- Closing a company account: the owner can export all records first. After the retention period above, the company’s records are deleted.
Security, your choices and rights
- Security: each carrier’s records are kept separate at the database level, data is encrypted in transit and when stored, backups are encrypted with a key held offline, and staff access is limited and logged. No system is perfectly secure. If a security breach affects your information, we’ll tell you, or the carrier that keeps your records, as the law requires.
- Location: drivers can turn off location permission in the phone’s settings. Trip steps still work, without a location. Location points are removed after 1 year.
- Your rights: depending on where you live, you may have the right to know what we hold about you, get a copy, correct it or ask us to delete it. Email [privacy@tovarlo.com]. For records a carrier controls, we will pass the request to the carrier and help them answer it. We won’t treat you differently for asking.
- Children: Tovarlo is for businesses and is not meant for anyone under 18.
- Changes: we will post changes here with a new date, and tell account owners by email before important changes take effect.
- Contact: [legal company name], [address], [privacy@tovarlo.com].
Version date: October 29, 2026