Privacy Policy
Last updated: 24 September 2026
This policy explains how Company name SRL ("we", "us"), the company behind TIR40, handles personal data when you visit our website, create an account or use the app at https://app.tir40.eu.
TIR40 is a business tool for road hauliers. It holds two kinds of personal data, and we play a different role for each: (1) data about the people who use TIR40 and visit our pages — for that we are the controller, and this policy applies; (2) data that a haulier puts into its own workspace about its drivers, customers and loads — for that the haulier is the controller and we are its processor; see our Data Processing Agreement.
1. Who is responsible
Company name SRL, registration number registration number (CUI / J-number), registered address, Romania. Privacy questions and requests: privacy contact email.
2. What we collect and why
| Data | Examples | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Account data | Email address, password (stored only as a hash by our sign-in provider), name, role in the company, language | To create your account, sign you in and run the app for you | Contract (Art. 6(1)(b)) |
| Company details | Company name, address, VAT number, phone, trial dates | To set up your workspace, print your invoices and manage the pilot or subscription | Contract (Art. 6(1)(b)) |
| Technical data | IP address, browser type, time of request, error reports | To keep the service secure, prevent abuse (for example the access-code check at sign-up), and find and fix errors | Legitimate interests (Art. 6(1)(f)) — running a secure service |
| Messages to us | Emails you send to us, support requests | To answer you and keep a record of what was agreed | Contract or legitimate interests |
We do not sell personal data, we do not use it for advertising, and we do not build profiles of visitors.
3. Data your company puts into TIR40
Loads, trucks, trailers, drivers (names, phone numbers, working-time records, positions captured when a driver taps “Arrived” or shares their location), customer contacts, invoices and uploaded documents such as CMR photos and transport orders belong to the haulier that entered them. We host and process them only on that haulier's instructions, as its processor, and do not use them for our own purposes. If you are a driver or a contact at a customer and want to exercise your rights over such data, please contact the haulier first; we will help them respond.
4. Cookies and similar storage
TIR40 uses only what is strictly necessary to work: a sign-in session cookie set by our sign-in provider, a cookie remembering your chosen language (tir40_locale), and small items in your browser's storage for interface settings such as the size of the board panels. The driver page may also keep a small offline queue in the browser so a photo can be sent once the phone is back online. We use no analytics, advertising or tracking cookies, so there is no cookie banner.
5. Who we share data with
We use the service providers below to run TIR40. Each acts on our instructions (or, for workspace data, on the haulier's instructions through us) under a data-processing agreement.
| Provider | What it does for TIR40 | Where | Data involved |
|---|---|---|---|
| Supabase (Supabase, Inc.) | Database, sign-in (authentication) and file storage — where all TIR40 data lives. | EU — Ireland (AWS eu-west-1) | All data in the workspace: accounts, fleet, loads, customers, documents and photos. |
| Vercel (Vercel Inc.) | Hosting of the application and its network edge. | Application runs in Dublin, Ireland; requests pass through Vercel's edge network | Requests and responses while the app is used, short-lived technical logs (e.g. IP address). |
| Anthropic (Anthropic PBC) | AI features: reading an uploaded transport-order PDF or a pasted order email into a load, reading a photographed signed CMR (is it signed, are there remarks), and drafting delay and demurrage emails from the note you type. | United States | Only what you send to an AI feature: the uploaded document, pasted email text or CMR photo, or the load details and note for a draft. Anthropic's commercial terms state that data sent through its API is not used to train its models. |
| Resend (Resend, Inc.) | Sending sign-up confirmation and password-reset emails, and error alerts to the operator. | United States / EU sending regions | The recipient's email address and the content of that email. |
| Google (Google Ireland Ltd / Google LLC) | Places search for nearby repair shops and truck parking; Google Fonts for the typefaces on our pages. | EU / United States | For Places: the search text and a map position (a truck's last position or the map centre) — no name or account. For Fonts: your browser's IP address when a page loads. |
Some AI features send a document, text or photo to Anthropic when a person uses that feature. The one automatic case is a photo of a signed CMR: when it is uploaded (by a driver from their link or by the office) it is sent to Anthropic straight away so it can be checked for a signature, a stamp and remarks written on it. Nothing else is sent to an AI service in the background. We may also disclose data where the law requires it.
6. Transfers outside the EU/EEA
Workspace data is stored in the EU (Ireland). Some of our providers are US companies or use US-based systems (for example Anthropic and Resend, and support access at Supabase and Vercel). Where personal data is transferred outside the EU/EEA, we rely on the safeguards those providers offer under the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
7. How long we keep data
- Account and company data: for as long as the account exists. After the account is closed we delete it within 30 days, except what we must keep by law (for example accounting records).
- Workspace data (loads, documents, drivers, customers): kept until the haulier deletes it or the account is closed, then deleted as set out in the DPA.
- Backups: deleted data can remain in our provider's encrypted backups for a short time (up to 7 days) until they roll over.
- Technical logs: kept for a short period, normally no longer than 30 days.
8. Security
Every company's data is separated from every other company's at database level, connections are encrypted, uploaded files sit in private storage that can only be opened through the signed-in app, driver links contain a long random code, and changes to loads are recorded in an audit log. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.
9. Your rights
Under the GDPR you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time. A company administrator can also export the company's data from Settings. To use any of these rights write to privacy contact email. You can also complain to a data-protection authority — in Romania the ANSPDCP (dataprotection.ro), or the authority in the country where you live or work.
10. Children
TIR40 is a business service and is not aimed at anyone under 18.
11. Changes to this policy
If we change this policy in a way that matters to you we will tell you in the app or by email before the change takes effect. The date at the top shows when it was last updated.