Privacy Policy

1. Who we are and this policy

TruckThrust is a driver-first platform for European road freight — compliance, routing, documentation and parking in one mobile app, with a companion dispatcher dashboard. This policy applies to the TruckThrust mobile app and the TruckThrust website, and explains what personal data we handle, why, who we share it with, and the rights and controls you have.

TruckThrust is operated by Kaaal Int Lda, [registered address], Portugal (“TruckThrust”, “we”, “us”). Contact us about privacy at samson@kaaal.eu.

Our role under the EU GDPR depends on how you use TruckThrust:

• Haulage operators and dispatchers using TruckThrust for a fleet are the controller of the driver and operational data they enter or generate; we act as their data processor for that data.
• Drivers using the app under an employer’s account: the employer is the controller and we process the data on their instructions.
• Our website, sign-ups, billing and direct messages: we are the controller.

Where we act as a processor, direct data requests to the controller (your employer) and we will assist them; this policy applies in full where we are the controller.

2. What data we collect

The data we handle depends on the modules you use:

• Account & contact data — name, work email, phone, employer/company, role, and login credentials.
• Driver & compliance data — driving, rest and break times, duty/availability status, tachograph and EU 561/2006 records, and cabotage and border-crossing events.
• Precise location (GPS) — your position, planned and driven routes, and secure-parking selections, in real time and as history, while the relevant feature is in use (see §3).
• Documents & records — CMR, proof of delivery, ADR and other transport documents, vehicle-inspection checklists and photos.
• Vehicle & telematics data — vehicle identifiers, toll-transponder registrations where supported, fuel and idle-time data, and derived emissions figures.
• Device & technical data — device model, operating system, app version, diagnostic and crash logs, and IP address.
• Usage data — how you interact with the app and website, for security and product improvement.

We collect this data directly from you and from your use of the app. We do not buy personal data about you from data brokers.

3. Device permissions

The app requests device permissions only for the features you use, and you can review or revoke them at any time in your device settings. Denying a permission disables the related feature, not the whole app.

• Location (precise) — to place you on your route, count cabotage and border-crossing events, and find nearby secure parking. Used while the relevant feature is active. If a feature needs location while the app is in the background (for example, continuous trip tracking), we explain why and request that permission separately.
• Camera — to photograph transport documents and inspection defects.
• Notifications — not used yet; the app does not send push notifications today. If we add them, they will alert you to breaks and deadlines, and you can turn them off.
• Files & storage — to attach documents and cache them for offline use.

4. How we use data, and our legal bases

Where we are the controller, we rely on these Article 6 GDPR legal bases:

• Performance of a contract — to create and run your account, deliver the modules you use, and provide support.
• Legal obligation — to help you meet, and to retain, records required by EU and national transport law (e.g. driving-time and tachograph records, transport documentation).
• Legitimate interests — to secure the service, prevent fraud and abuse, understand usage, and improve features, balanced against your rights.
• Consent — for optional analytics, marketing, and any processing that specifically asks for it. You can withdraw consent at any time.

We do not sell personal data, and we do not use your data for third-party advertising.

5. Biometric sign-off and sensitive data

Fingerprint sign-off. When you sign an inspection or document with a fingerprint, authentication is performed by your device’s built-in biometric hardware. TruckThrust receives only confirmation that authentication succeeded — your fingerprint and other biometric identifiers never leave your device and are not collected, transmitted or stored by us. A PIN or on-screen signature is always available as an alternative.

Activity status. A status such as “sick” can imply health information (a special category under Article 9 GDPR). We process it only to route the status to dispatch, HR and compliance as your operator’s workflow requires, on the operator’s legal basis, and for no other purpose.

Rest and fatigue suggestions are generated from your own driving history to prompt safe breaks; they are decision support, not medical assessments.

6. Offline-first operation

TruckThrust is designed to work without connectivity. Compliance logs, document capture, signatures and photos are stored securely on your device and synced to our servers when a connection returns. Data on the device is protected by the device’s own security and by app-level encryption.

7. Who we share data with

• Your employer / operator — driver and operational data is visible to the haulage company that operates your account, as the controller.
• Service providers (sub-processors) — vendors that process data on our instructions for hosting, maps and routing, app updates, error monitoring, integrations and AI. Each one is listed in §9, with what it receives and where.
• Your integrations— where your company connects a TMS or telematics provider through an integration we set up with you, data is shared on your company's instruction.
• Authorities — enforcement or tax authorities where we are legally required to disclose, or where you present records during a roadside or company check.
• Corporate transactions — a successor entity in a merger, acquisition or reorganisation, subject to this policy.

8. Where data is stored and international transfers

TruckThrust's core data is hosted in the EU: the database, file storage and sign-in run on Supabase in the European Union. Some of the services we use are based outside the EU or the European Economic Area (EEA), mainly in the United States. Each one is listed in §9 with its region.

Where personal data is transferred outside the EEA, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses. For some providers the transfer basis is still being reviewed, and the list says so.

9. Our sub-processors

These providers process personal data for us. “Under review” means we are still confirming that detail with the provider; we update this list when it changes.

• Supabase — database, file storage and sign-in for the app and dashboard. Data: all app data. Where: European Union.
• Mapbox — maps and address search. Data: map positions and searched addresses. Where: United States, under Standard Contractual Clauses.
• Expo — app delivery and updates. Data: device and app technical data. Where: United States, under Standard Contractual Clauses.
• PTV (xRoute) — truck route planning. Data: route positions and the vehicle's size and weight. Where: Germany.
• Anthropic — the AI assistant (see §10). Data: the messages you send it and the trip details it needs to answer. Where: United States, under Standard Contractual Clauses.
• Sentry — error and crash monitoring. Data: technical error reports and an internal user ID; we remove email, user name and IP address before sending. Where: under review.
• Opter — sending transport orders and documents to your company's Opter TMS, when your company has connected it. Data: the orders and documents, including addresses and contact names. Where: under review.
• TollGuru — toll and fuel cost estimates for a planned route. Data: the route and vehicle class. Where: under review.
• OpenStreetMap (Overpass API) — finding fuel and rest stops near a route. Data: the map area searched. Where: under review.
• Tankerkönig — live fuel prices in Germany. Data: the map area searched. Where: under review.
• Open-Meteo — weather along a route. Data: map positions. Where: under review.
• French government fuel-price service (data.economie.gouv.fr) — live fuel prices in France. Data: the map area searched. Where: France.
• Telematics providers your company connects — for example trailer telematics. Data: vehicle and trailer data from that provider. Where: depends on the provider.

10. Artificial intelligence (AI)

AI assistant — switched off. TruckThrust includes an AI assistant for drivers that answers questions about the current trip, documents and driving rules. It is switched off and not available in the app today. When we switch it on, your messages and the details needed to answer them — for example your name, the truck's plate, the current trip, document expiry dates and recent receipts — are sent to our AI provider, Anthropic, which processes them in the United States as our sub-processor under Standard Contractual Clauses. Under its terms, Anthropic does not use this data to train its models and deletes it after 30 days. How long conversations are kept in TruckThrust is under review, and we will state it here before the assistant is switched on.

AI answers can be wrong. Do not rely on the assistant alone for driving and rest times or legal questions; your tachograph and the rules in force come first. AI is never used to make decisions about you.

Reading receipts and documents (OCR). When you photograph a receipt or trip document, the text is read on your phone with Google ML Kit. The photo and the text it reads are then saved with the document, so your company's office can search them. Whether ML Kit sends usage data to Google is under review.

Reading order PDFs. In the dashboard, office users can read customer order PDFs into a form. This uses text recognition on our own system, with no external AI service; a person checks every field before anything is sent on.

11. How long we keep data

We keep personal data only as long as necessary:

• Compliance and transport records — retained for the periods required by applicable EU and national law, then deleted or anonymised.
• Account data — kept for the life of the account and a limited period afterwards to meet legal and accounting obligations.
• Diagnostic and usage data — kept for a short period for security and troubleshooting.

12. Deleting your data and account

You can ask us to delete your personal data and close your account at any time:

• In the app — Settings → Account → Delete account.
• By email — write to samson@kaaal.eu from your registered address.
• Online — follow the steps on our account deletion page.

We action verified deletion requests within 30 days. We delete or irreversibly anonymise your data, except records we are required to keep by law — for example, driving-time and transport documents kept for their statutory retention period — which we stop using, isolate, and delete once that period ends.

If we hold your data on behalf of your employer (as a processor), we act on their instructions; contact your employer or us and we will coordinate the request.

13. How we protect data

We encrypt personal data in transit and at rest, limit access by role and by company in the database, offer two-factor sign-in for the dashboard, and record changes in an audit log. No system is perfectly secure, but we protect your data proportionately to its sensitivity and will notify the relevant parties promptly in the unlikely event of a breach, as the law requires.

14. Your rights

Subject to conditions in the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances (see §12);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with a supervisory authority — for us, the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD), or the authority where you live or work.

To exercise these rights, contact samson@kaaal.eu. Where we process your data on behalf of your employer, please direct your request to them and we will assist.

15. Automated decisions

TruckThrust does not make decisions producing legal or similarly significant effects about you based solely on automated processing. Compliance checks, cabotage counts and rest reminders are decision support with human oversight; responsibility for acting on them rests with the driver and operator.

16. Children

TruckThrust is a professional tool intended for people aged 18 and over. It is not directed at children, and we do not knowingly collect their data.

17. Cookies and the website

Our website uses strictly necessary cookies to function, and — only with your consent — optional analytics cookies to understand how the site is used. You can manage optional cookies through the banner on your first visit and change your choice at any time.

18. Changes to this policy

We may update this policy as the product and the law evolve. We will change the “last updated” date above and, for material changes, give notice in the app or by email.

19. Contact us

For any privacy question or to exercise your rights, contact samson@kaaal.eu, or write to Kaaal Int Lda, [registered address], Portugal. TruckThrust is part of the Kaaal portfolio — kaaal.eu.