Transport Manager Privacy Policy

Brand: UBrise · Service: Transport Manager · Corporate site: https://ubrise.com
Provider: Reinaldo Victor Artidiello Gonzalez · Address: Valladolid, España · Privacy: privacy@ubrise.com
Version: November 7, 2026 · Effective date: 11/03/2026

1. Who this applies to and who decides

This Policy explains how personal information is handled in Transport Manager (the "Service"), software for trucking businesses. It applies to administrators and users of customer companies, to drivers who use the app and to website visitors.

The Service handles information in two different roles:

Customer data (the main role). The information each customer company (the "Customer") enters or generates in the Service — loads, documents, drivers, fuel, settlements, invoices, payments, locations, messages — is decided on and controlled by the Customer. For that data, the Customer is the business (or "controller") and the Provider acts only as a service provider (or "processor") following its instructions and the Data Processing Agreement. Questions and requests about that data should go first to the Customer (for example, the company the driver works for).
The Provider's own data. Account access data, billing for the Service, security, support and the website, which the Provider processes to provide and protect the Service. For these, the Provider is the business/controller.

2. Information we process

Account and access: name, user name, email, company, role, language, password stored only as a protected hash, two-step verification, sign-in dates and IP addresses, failed attempts and open sessions.
Customer Data: whatever the Customer chooses to enter: loads, stops and addresses, brokers and contacts, drivers and their percentages, trucks and trailers, fuel, settlements, invoices, collections and factoring, documents (BOLs, PODs, rate confirmations, receipts…) and notes. Documents may contain third parties' information.
Driver app: the driver's name and user name, phone model and system, app version, push notification identifier, "on duty" status, GPS location at the times explained in section 4, arrival and departure events at pickups and deliveries (geofences), photos and documents uploaded, messages with the office, and the record of their acceptance of the texts (version, date, phone and IP).
Billing for the Service: company name, contact, plan, invoices and payments. Card numbers are collected and stored by Stripe, not by us; we only see details such as card brand, last four digits and payment status.
Support: messages sent to the assistant or to support and their answers.
Technical and security data: IP address, browser, dates, pages requested, errors and activity logs (who changed what and when). One-time links and tokens are never stored in clear text or in logs; a load's tracking links are stored encrypted, so the Customer can copy them again (section 4).

3. How we use it

To provide the Service and its features under the Plan (including showing maps, calculating miles and reading documents when the user asks).
To create and protect accounts, verify identities, prevent fraud and abuse and protect the Service and other customers.
To bill for the Service and keep its accounts.
To send operational emails and notices (invitations, password recovery, billing notices, Service changes). We do not send third-party advertising.
To provide support, improve the Service with aggregated information that does not identify anyone, and comply with the law.

We do not sell personal information, we do not "share" it for cross-context behavioral advertising, and we do not use it for targeted advertising. We do not use Customer Data to train artificial intelligence models.

4. Drivers' GPS location

The app records the driver's phone location only when the Customer uses that feature and the driver has granted the phone permissions: while carrying an active load (from the scheduled pickup day until delivery) and, if the Customer uses it, while the driver is "on duty". Outside those times the app does not send their location.

Position history is kept for the period set by the Plan and the Customer's settings (for example, 7, 30 or 90 days) and then deleted; per-state, per-day mileage summaries for IFTA are kept while the Customer's data exists. The driver can withdraw the location permission in the phone settings, with whatever consequences that has in their relationship with the Customer.

The Customer decides on tracking and must inform its drivers and obtain whatever the law requires (for example, written electronic monitoring notices). Drivers also have, inside the app, their own privacy and tracking notice.

Tracking link for a load. When a broker, shipper or receiver asks for it, the Customer can create a link for one specific load and send it to them. Whoever opens the link, without an account, sees that load's status, its milestones (arrivals, loading, departures and delivery, with their time), its stops (city, state and appointment), the truck and trailer numbers, the truck's position and an estimated time of arrival. They do not see the driver's name or phone, speed, battery or route history, nor anything about other loads. The position is only the one the Service tied to that load, only if recent and, unless the Customer chooses the exact one, approximate (about 2 km); until the truck reaches the pickup no point is shown at all, only the approximate distance and a rounded estimated arrival time, so the place the driver starts from is not revealed; and it stops being shown if the delivery day passes without the load being recorded as delivered. The link stops showing the position when the load is delivered or cancelled, on the date the Customer chooses and, at the latest, after 30 days; the Customer can turn it off at any time. The driver gets a notice in the app when the location of one of their loads is shared. For each visit to the link we keep the time, the network (not the full IP address) and the type of browser, so the Customer knows it was opened; links and their visits are deleted 90 days after they end. Whoever receives the link should treat it as confidential: if they forward it, whoever opens it will see the same until it ends or is turned off.

5. «Transport Manager · myTCS» Chrome extension

If the Customer installs it, the extension reads in the user's browser, with the myTCS (TCS Fuel) session the user opens, the fuel transactions and cards of the Customer's myTCS account: date and time, place, product, gallons, amounts, card, driver or unit, and the myTCS user name or account number. It sends them only to that Customer's Transport Manager account, which uses them to deduct fuel in its drivers' settlements and in its reports.

The extension does not store or send the myTCS password, cookies or session tokens. To bring other dates it uses the session already open, inside the myTCS page itself.
It does not keep the session open nor open myTCS by itself: it brings data twice a day when myTCS is open, or when the user presses «Bring now».
In the browser it only keeps the Transport Manager address, the connection key, the number of days brought and the result of the last send.
It does not read other pages or the browsing history, and this data is not sold or shared with third parties.
The Customer can disconnect it at any time from Transport Manager, or remove it from Chrome.

6. Artificial intelligence

When a user asks to read a PDF or document with AI, or uses the assistant, the content needed is sent to an artificial intelligence provider to obtain the result. That provider processes the content on the Provider's behalf under commercial terms that, according to those terms, do not allow it to use the content to train its models. Results may contain errors and are shown for the user to review before saving.

Only with those we need to provide the Service, and only what is needed:

Service providers (subprocessors) working on our behalf: server hosting, encrypted off-site backups, email, payment processing (Stripe), artificial intelligence, maps, addresses and route/mileage calculation, and push notifications to phones (Apple, Google and Expo). The current list is available on request at privacy@ubrise.com.
The Customer itself and its users, according to the permissions the Customer sets. Users of one company do not see other companies' data.
The people the Customer sends a tracking link to for one of its loads (usually the broker, the shipper or the receiver), with what section 4 explains. The Customer decides and sends it.
Integrations the Customer turns on (for example, its fuel program, factoring company or accounting): governed by the Customer's own contracts with them.
Authorities, when a law, court order or valid request requires it, or to protect rights and safety or prevent fraud.
A buyer or successor of the business, if it is sold or reorganized, who must honor this Policy.

8. Cookies and similar technologies

The website uses only necessary cookies: the session cookie (to keep you signed in), the two-step verification cookie and the language cookie. The browser also stores a few local preferences (for example, whether the menu is collapsed). We do not use third-party advertising or analytics cookies. When a map is opened, the browser downloads the map images from their provider, which receives the browser's IP address as with any web visit. The page of a tracking link uses no cookies.

9. How long we keep it

Customer Data: while the account is active. After closing, the Owner may request an export for 30 days; after that it is deleted from active systems.
GPS history: per the Plan and the Customer's settings (for example, 7, 30 or 90 days).
Tracking links and their visits: deleted 90 days after the link ends.
Backups: encrypted; daily ones rotate in about two weeks and monthly ones in up to 12 months. While they exist they are used only to recover the system after a disaster.
Service billing, acceptance of texts and security logs: as long as the law requires or as needed for security or to defend claims.

10. Security

We apply reasonable measures, including: encrypted connections (HTTPS), passwords stored with PBKDF2, one-time tokens and links stored only as hashes (a load's tracking links, encrypted), two-step verification for administrators, a separate database per company, rate limiting, activity logs, external service keys stored encrypted, and encrypted off-site backups. No system is completely secure; if an incident affects personal information, we will notify the Customer and, where the law requires, the individuals and authorities.

Each user must protect their password and phone, and the Customer must remove access that is no longer needed.

11. Your rights

Depending on the law of your state or country, you may have the right to know what information we hold, to access it, correct it, delete it, take it with you in a usable format, or object to certain uses. We will not discriminate against you for exercising them.

If the information is part of a Customer's Data (for example, you are a driver, employee or contact of a company that uses the Service), contact that company, which decides about that data; we will help it respond.
For data we control, write to privacy@ubrise.com. We will verify your identity proportionately and answer within the period set by law (usually 45 days). You may act through an authorized agent.

12. Where data is processed

The Service is intended for U.S. businesses and its data is hosted on servers located in the United States unless stated otherwise. Some providers may process data in other countries with the safeguards the law requires.

13. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect children's data; if you believe there is any, write to us.

14. Changes and contact

If we change this Policy, we will publish the new version with its date and, for material changes, notify by email or within the Service before it takes effect. Privacy contact: privacy@ubrise.com · Reinaldo Victor Artidiello Gonzalez, Valladolid, España.

This Policy exists in English and Spanish; if they differ, the English version controls. Related documents: Terms of Service · Data Processing Agreement.