Privacy Policy

This policy explains how D Shchupak, LLC, trading as IAI Logistics ("we", "us"), handles personal data in connection with our transport management software and this website. We take it seriously because our product handles data about people who never signed up for it themselves — professional drivers — and they deserve to know what happens to it.

1. Two different roles

The law distinguishes between deciding why data is processed (a controller) and processing it on someone else's instructions (a processor). We are both, in different situations, and it changes who you contact about what.

• We are the controller for data about our own customers: the account details of the people who register a company with us, billing information, support correspondence, and website analytics.
• We are a processor for everything a customer puts into the system about their own business — their drivers, vehicles, trips, documents and vehicle positions. The transport company is the controller of that data. If you are a driver and want to know why your position is recorded, your employer decides that, and we act on their instructions.

2. What we collect

As controller, from customers and website visitors:

• Name, work email address, company name, country and VAT number
• Authentication data (password hashes are held by our authentication provider, never by us in readable form; optionally a Google account identifier if you sign in with Google)
• Billing details, handled by our payment provider — we do not see or store card numbers
• Technical logs: IP address, browser type, pages visited, error reports

As processor, on behalf of the customer:

• Driver records: full name, phone number, driving licence number, assigned vehicle
• Telegram identifiers, when a driver or dispatcher links their Telegram account
• Vehicle location data: coordinates, speed and timestamps, collected from the customer's telematics provider while a vehicle is in service. Because a vehicle is assigned to a driver, this is personal data about that driver.
• Driving and rest times used for EU Regulation 561/2006 compliance
• Trip records, expenses, photographs of cargo and proof of delivery, consignment notes and invoices

3. Why we process it, and on what basis

• To provide the service — performance of our contract with the customer.
• To keep the service secure and working — our legitimate interest in preventing abuse, diagnosing faults and protecting accounts.
• To bill and to meet accounting obligations — legal obligation.
• Location and driving-time data is processed on the instructions of the employing transport company. That company is responsible for having a lawful basis, for informing its drivers, and for any consultation with employee representatives its national law requires. Position history can be switched off entirely in the application settings.

4. Who else is involved

We use a small number of service providers. Each processes data only to deliver its part of the service:

• Supabase — database, authentication and file storage, hosted in the EU (Frankfurt)
• Vercel — web application hosting, EU region (Frankfurt)
• Railway — hosting for the Telegram bot and background jobs
• Telegram — delivery of messages to drivers and dispatchers, and storage of the photographs they send
• The customer's telematics provider (for example Geotab, Wialon or Webfleet) — the source of vehicle positions, under the customer's own account and contract
• OpenRouteService and OpenStreetMap / Nominatim — route calculation, geocoding and map tiles
• Open-Meteo — weather at loading and unloading points
• Resend — transactional email
• Stripe — subscription payments

Some of these are established outside the European Economic Area. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses or another recognised safeguard. The database holding customer and driver data is located in the EU.

We do not sell personal data and we do not use it for advertising.

5. How long we keep it

• Vehicle position history: 90 days by default. Each customer can shorten this in the application settings, and older records are deleted automatically. This is a deliberate limit — continuous location data should not accumulate indefinitely.
• Account and trip records: for as long as the account is active
• Invoices and accounting records: as required by applicable tax law, typically several years
• After an account is closed, remaining data is deleted or anonymised within 90 days, except where law requires us to keep it

6. How we protect it

• All traffic is encrypted in transit (HTTPS)
• Data is separated per company at the database level, so one customer cannot reach another's records
• Credentials that customers enter for their telematics providers are encrypted before being stored
• Access to production systems is limited to those who need it

No system is perfectly secure. If a breach occurs that is likely to affect people's rights, we will notify the affected customers without undue delay so they can meet their own notification duties.

7. Your rights

If you are in the EEA or the UK you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a copy in a portable format, and you may object to processing based on legitimate interests. You may also complain to your national data protection authority.

Drivers: if your employer uses our software, please contact your employer first — they decide what is collected about you and can act immediately. If you contact us directly we will forward your request to them and assist, but we cannot alter their records on our own initiative.

Write to contact@iailogistics.com for any privacy request. We respond within one month.

8. Cookies

We use only the cookies needed to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies.

9. Changes

We will update this page when our processing changes and will move the date at the top. Significant changes affecting customers will also be notified by email.