01Who we are
Truvio decides how the personal data in this policy is used. For anything about it, write to us.
02What this policy covers
This policy covers the people who visit our website, the people who use Truvio in a customer’s account, and the contacts we deal with at our customers.
Our customers also put personal data about others into Truvio: their drivers, their own customers and subcontractors, and the people named on transport documents. For that data the customer decides how it is used and we process it on the customer’s behalf, under the Data Processing Agreement. If you are a driver or a contact of one of our customers, write to that company first; we help them answer you.
03The data we collect
- Account. Your name, work email, password (stored only as a one-way hash), role and the company you belong to.
- Company and billing. Company name, address and VAT number, your plan and invoices. Card details go straight to Stripe; we never see or store card numbers.
- Security and use. Sign-in sessions with the device and IP address they came from, and a record of changes made in your account, kept to protect it and to show who did what.
- What you send us. Support emails, and the messages, files and voice notes you give the AI assistant.
- Your account's content. Orders, runs, vehicles, drivers, documents, positions and invoices, processed on your company's behalf as described above.
04Why we use it
- To provide Truvio, under our contract with your company: your account, the features you use, support and billing.
- To keep it secure, in our legitimate interest: preventing misuse, investigating problems and protecting accounts.
- To meet legal obligations, such as keeping invoices and accounting records for as long as tax law requires.
- To remember your preferences, with your consent, given and changed in the cookie choices described in the Cookie Policy.
05AI features
When you upload a transport document for reading, it is sent to Mistral AI, which returns the details it found. When you use the AI assistant, your messages and the files or voice notes you attach are sent to OpenAI to produce an answer. Both act as our sub-processors and use the data only to give us that answer. The assistant proposes changes; nothing is changed until a person confirms it.
07Transfers outside Europe
Some of these services are based in, or process data in, the United States. Where data leaves the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework where the service is certified under it, and otherwise by the European Commission’s Standard Contractual Clauses.
08How long we keep it
- While your account is open, we keep what it needs to work.
- When an account closes, we delete or anonymise its data within 90 days, unless the customer asks us to delete it sooner.
- Invoices and accounting records are kept for as long as tax and accounting law requires.
- Security records are kept for up to 12 months.
09Your rights
You may ask for a copy of your personal data, have it corrected or deleted, restrict or object to how we use it, take it to another provider, and withdraw consent you gave at any time. Write to us; we answer within one month.
You can also complain to the data protection authority where you live or work, or where we are registered.
10How we protect it
- Everything travels over encrypted connections.
- Passwords are stored only as one-way hashes; the key that renews your sign-in is replaced every time it is used and stops working as soon as you sign out.
- Credentials for the services you connect are encrypted before they are stored.
- Each person sees only what their role allows, and changes are recorded.
12Changes to this policy
When we change this policy we update the date at the top. When a change affects how we use your data, we tell account administrators by email before it applies.