Privacy Policy
Language: Română · English
1. Data controller
NeuroGround (Petre Gagiu) · contact@neuroground.ro · tollcargo.neuroground.ro
Trucking companies (B2B customers) may act as independent or joint controllers for driver data they enter in the dispatcher panel. NeuroGround processes that data to provide the contracted service.
2. What TollCargo is
B2B service for Romanian road-transport firms: Flutter driver app (ro.neuroground.tollcargo), web dispatcher panel, HTTPS webhooks on a VPS, and EU Supabase storage. No public sign-up — phones activate with a dispatcher-issued code. No ads and no advertising/analytics tracking SDKs.
3. Data we process
- Driver / firm data (entered by the firm): driver name, phone, optional email, internal IDs, assigned truck plate/model, activation-code hashes, device token (secure storage on device; hash only on server).
- Document images (locally compressed JPEG): CMR and fuel/toll receipts, from camera or optional gallery pick.
- Upload metadata: order/trip number, document type, capture time (UTC), app version, device id linked to activation.
- Approximate GPS (lat/lng): only if the driver enables “attach location” (off by default). No background location.
- OCR output from Google Gemini Vision (fields, stamp/signature presence, confidence) stored in the database.
We do not sell data, use ads, or request broad file-storage or microphone access.
4. Purposes & legal bases
- Contract performance with the transport firm (activation, uploads, OCR, dispatcher view) — Art. 6(1)(b) GDPR.
- Legitimate interests for security and reliability — Art. 6(1)(f).
- Legal obligations for document retention where applicable — Art. 6(1)(c).
- Consent for optional GPS attach — Art. 6(1)(a), withdrawable in-app.
5. Processors
- Supabase (EU project) — Postgres + Storage.
- Google Gemini API — document OCR/Vision (may involve transfers outside the EEA under the provider’s SCCs).
- VPS host — Caddy + n8n orchestration for HTTPS webhooks.
6. Retention
Device tokens until revocation; driver profile for the B2B relationship plus legal archives; document images/OCR typically up to 5 years when fiscal/transport rules apply, unless the firm requests otherwise. Local queues on the phone can be cleared by the driver; deactivation removes the local token. We aim to complete erasure requests within 30 days where legally possible.
7. Your rights
Access, rectification, erasure, restriction, objection, portability (where applicable), and complaint to the Romanian DPA (ANSPDCP). Contact contact@neuroground.ro or use the data deletion page.
8. Children
Professional use by adult drivers only; not directed at anyone under 16.