Privacy Policy

1.1 Account & Registration Data

When you register on Trux, we collect your mobile phone number (used as your primary login identifier and verified via one-time password), your full name, email address (optional), and account type (Individual or Company). For fleet operators, registration also captures your company name, GST number, PAN, and registered business address.

1.2 KYC & Verification Documents

To comply with applicable Indian law and to protect platform users, we collect the following verification documents: • Fleet operators: PAN card, GST certificate, Aadhaar, company registration documents, cancelled cheque / bank passbook for payout account setup • Fleet vehicles: RC (Registration Certificate), insurance certificate, National/State permit, fitness certificate, PUC (Pollution Under Control) certificate • Drivers: Driving licence (front and back), Aadhaar card • Shippers: PAN card, GST certificate, Aadhaar or company registration documents All KYC documents are uploaded via presigned URLs to encrypted AWS S3 storage. Documents are accessible only to authorised Trux admin personnel for verification purposes and are not shared with other users of the platform. Document verification statuses: PENDING (not yet submitted), UNDER_REVIEW (submitted, pending admin action), APPROVED, or REJECTED.

1.3 Transaction & Load Data

We collect information about every freight transaction processed through the platform, including: • Load details: pickup and drop locations (with GPS coordinates), material type, vehicle type, weight, agreed freight charge, load status, and full load lifecycle history • Assignment records: which vehicle, driver, and fleet operator handled each load • Proof of Delivery (POD): photos submitted by the fleet driver at each drop location, admin review status, and shipper approval records • Payment data: agreed payment amounts, tranche breakdowns, shipper-uploaded payment receipt images, admin verification records, fleet payout amounts, and UTR/reference numbers

1.4 Location & Trip-Tracking Data

For active loads, fleet drivers may share GPS coordinates via the portal to enable real-time shipment tracking. Location data is: • Shared only with the shipper who posted the associated load and with Trux admin • Used only for the duration of the active trip • Not retained after the load reaches COMPLETED or CANCELLED status • Never used for advertising or sold to third parties

1.5 Rating & Feedback Data

After a load is completed, shippers may rate the fleet operator and driver (1–5 stars with an optional text review), and fleet operators may rate the shipper. Ratings are associated with the specific load and are visible to platform users as part of the reputation system.

1.6 Dispute & Report Data

If you submit a dispute or report through the Issues module, we collect the report subject, description, the entity being reported (load, fleet, shipper, user, or payment), and all subsequent correspondence between you and the Trux support team.

1.7 Device & Usage Data

We collect standard server logs including IP address, browser type, device identifiers, and feature usage patterns. This data is used for security monitoring, performance optimisation, and platform improvement. It is not linked to your personal identity for advertising purposes.

2.1 Platform Operations

To create and manage your account, facilitate load posting and marketplace matching, process load assignments and confirmations, send OTP verifications via SMS, handle payment tranche verification and fleet payouts, and provide customer support.

2.2 KYC & Compliance Verification

To verify the identity of shippers and fleet operators, validate vehicle and driver documents, comply with the Motor Vehicles Act 1988, GST regulations, PAN verification requirements, and other applicable Indian laws governing transportation and financial transactions.

2.3 Real-Time Communication

We use Socket.IO WebSocket connections to deliver real-time notifications for load status changes, payment events, KYC decisions, driver document approvals, and other platform events. These are in-app notifications only. We also send transactional SMS messages for OTP delivery and may send WhatsApp messages for load updates and payment confirmations where you have opted in.

2.4 Payment Processing

To verify shipper-uploaded payment receipts against transaction records, facilitate tranche-based payouts to fleet operators, maintain financial audit trails, and generate GST invoices where applicable.

2.5 Safety, Security & Fraud Prevention

To detect and prevent fraudulent activity, duplicate accounts, unauthorised access, document forgery, and violations of our Terms of Service.

2.6 Analytics & Improvement

To analyse aggregate usage patterns (not individual behaviour), improve platform features, and develop new services. Aggregate analytics do not identify individual users.

3.1 Between Shippers and Fleet Operators

When a load is matched: • The assigned fleet operator sees the shipper's company name, contact name, and contact phone for the load location • The shipper sees the fleet operator's company name, the assigned driver's name, and the vehicle registration number • Full financial details, bank account information, and KYC documents are never disclosed between parties • GPS location of the assigned driver is shared with the load's shipper for the duration of the active trip only

3.2 Trux Admin

Trux admin personnel (Super Admin, Operations Admin, Support Agent) can access all platform data as necessary to verify documents, resolve disputes, manage payments, and maintain platform integrity. Admin access is role-based and logged.

3.3 Service Providers

We engage the following trusted third-party service providers: • AWS S3: encrypted document and image storage • SMS gateway: OTP delivery and transactional messages • Razorpay: payment processing infrastructure These providers access only the data necessary to perform their functions and are bound by confidentiality agreements. They do not use your data for their own purposes.

3.4 Legal Requirements

We may disclose information when required by Indian law, court order, or government authority, or when we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of Trux, our users, or the public.

3.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction. We will notify affected users via in-app notice or email before such a transfer and will require the successor to honour this Privacy Policy.

4.1 Technical Measures

All data in transit is encrypted using TLS 1.2+. Documents and images are encrypted at rest in AWS S3. JWT authentication tokens are short-lived (access token) with a separate long-lived refresh token. Production database access is restricted by role-based controls and requires multi-factor authentication.

4.2 File Upload Security

Document uploads use AWS S3 presigned URLs with 5-minute expiry. Files are not served publicly — URLs are generated on demand and expire automatically. Supported upload types are JPEG, PNG, and PDF only, with a 10 MB file size limit.

4.3 Operational Measures

We conduct regular security reviews and vulnerability assessments. We maintain an incident response plan and will notify affected users within 72 hours of any confirmed data breach that affects their personal data.

4.4 Limitations

No method of transmission over the internet is 100% secure. While we implement strong safeguards, we cannot guarantee absolute security. You are responsible for keeping your phone number and OTP codes confidential and for logging out on shared devices.

5.1 Active Accounts

We retain your personal data for as long as your account is active or as needed to provide the service.

5.2 After Account Closure

Upon account deletion, we delete or anonymise personal data within 30 days, except where retention is required by law. Financial transaction records (load payments, payout records, tranche receipts) are retained for 7 years as required under the Indian Income Tax Act and GST regulations.

5.3 KYC Documents

KYC documents (PAN, Aadhaar, GST, vehicle RC, driver licence) may be retained for up to 5 years after account closure to comply with Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations applicable to financial service facilitators.

5.4 Trip Location Data

GPS location data captured during active trips is not retained after the load is completed or cancelled. Historical trip route information (checkpoint timestamps and status updates) is retained as part of the load record.

6.1 Access & Correction

You may access and update your profile information, company details, and bank account information at any time from within your portal. For corrections to admin-reviewed KYC data, contact support@trux.in.

6.2 Data Portability

You may request a copy of your personal data in a machine-readable format by writing to our Data Protection Officer at privacy@trux.in.

6.3 Deletion

You may request deletion of your account and associated data by contacting support@trux.in. Deletion requests are processed within 30 days, subject to our legal retention obligations described in Section 5.

6.4 Opt-Out of Non-Essential Communications

You may opt out of non-transactional communications (marketing messages) at any time by contacting support@trux.in. Transactional messages such as OTPs, load status notifications, and payment confirmations cannot be disabled without affecting platform functionality.

7.1 Authentication Storage

The Trux portal stores your JWT access token and refresh token in browser local storage to maintain your session across page reloads. These are not transmitted to third parties.

7.2 Essential Cookies

We use session cookies for CSRF protection and security. These cannot be disabled without affecting platform security.

7.3 Analytics

We use privacy-respecting analytics to understand aggregate platform usage. Analytics data is anonymised. You may opt out via your browser's Do Not Track setting.

Trux is a commercial B2B logistics platform intended for use by businesses and individuals who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has registered an account, contact us immediately at support@trux.in.

We may update this Privacy Policy as our platform evolves. Material changes — such as new data collection categories or new third-party processors — will be communicated via in-app notice or email at least 14 days before taking effect. Continued use of Trux after the effective date constitutes acceptance of the updated policy.

Data Protection Officer

Trux Technologies Pvt. Ltd. Bengaluru, Karnataka – 560001, India Email: privacy@trux.in Phone: +91 80 0000 0000