Privacy Policy

TranspoX (“TranspoX”, “we”, “us”) is operated by [REGISTERED COMPANY NAME], a company registered in India with CIN [CIN] and registered office at [REGISTERED ADDRESS]. GSTIN: [GSTIN].

This policy covers our website, the TranspoX web and mobile applications, and the support we provide. It is published under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and rules made under it.

TranspoX handles personal data in two capacities, and your rights differ between them.

• As Data Fiduciary, for the data of the people who sign up with us: your name, phone number, your organisation’s details, your billing records, and enquiries made through our website. We decide why and how this data is processed.
• As Data Processor, for everything your business records inside the application about other people — your parties, brokers, truck owners, drivers and consignees. That data is yours. We process it only on your instructions, to provide the service. Your business is the Data Fiduciary for it, which means your business is responsible for having a lawful basis to collect it, for issuing notices to those people, and for answering their requests.

If you are a party, driver or broker whose details appear in a TranspoX customer’s account, please contact that business directly. We will assist them in responding, but we cannot alter or delete their records on your instruction alone.

Grouped by why it exists rather than by where it is stored.

• To create and secure your account, and to send the one-time passwords that log you in.
• To provide the service you subscribed to — recording bookings, generating your documents, tracking money and stock.
• To bill you, issue GST invoices, and manage your subscription.
• To provide support, and to investigate faults and misuse.
• To contact you about an enquiry you made, or a signup you started and did not finish.
• To meet legal obligations, including tax and accounting record-keeping.

We process your data on the basis of your consent, given when you create an account or submit an enquiry, and on the certain legitimate uses permitted by the DPDP Act — including performing the service you asked for and complying with law. We do not sell personal data, and we do not use your business records to advertise to you or to anyone else.

The assistant answers questions about your own data. It works in two stages, and the distinction matters for your privacy:

• Answers are always produced by our own software, from database queries run against your organisation’s records and checked against your permissions. Your bookings, ledgers and documents are not sent to any third party for this.
• Understanding an unusual question may involve an AI provider. Where we have enabled this feature, the text of a question our own rules could not interpret is sent to an AI service to work out which report you are asking for. Only the sentence you typed is sent — never a record, a figure, or a document. If you type a party’s name into a question, that name is part of the sentence and is sent with it.

If you would prefer that no question text ever leaves our systems, write to us and we will disable the feature for your organisation.

We share personal data only with the service providers needed to run TranspoX, under contract, and only to the extent each one needs.

We may also disclose data where we are legally required to — to a court, a tax authority, or a law enforcement agency acting under lawful process — and in connection with a merger or acquisition, in which case we will tell you before your data becomes subject to a different policy.

Service data is stored on servers located in India. Some of the providers listed above may process limited data outside India; where they do, we rely on contractual protections and on the transfer rules of the DPDP Act. We do not transfer personal data to any country restricted by the Central Government for this purpose.

• While your account is active, we keep your data so the service works.
• After you close your account, we delete or anonymise personal data within [90 DAYS], except where we must keep it longer.
• Financial records — invoices, payments and tax documents — are retained for the period Indian tax and company law requires, currently at least six years from the end of the relevant financial year. This applies even if you ask us to delete your account, because we are not permitted to destroy them earlier.
• Enquiries and incomplete signups are kept for [12 MONTHS] from your last contact with us, then deleted.
• Backups roll off on their own schedule, within [35 DAYS].

Export your data before closing your account — see clause 10.

• PINs are stored only as Argon2 hashes. Nobody at TranspoX can read your PIN, and we will never ask you for it.
• All traffic between your device and our servers is encrypted in transit.
• Access inside your organisation is governed by the role and permission system you configure, so staff see only what you allow.
• Our own staff access to customer records is restricted and logged, including read access.
• We do not store card numbers, UPI IDs or net-banking credentials at all — our payment gateway handles those directly.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires.

Under the DPDP Act you may:

• Ask for a summary of the personal data we hold about you and how it is processed.
• Ask us to correct or complete inaccurate data.
• Ask us to erase your data, where we are not required by law to keep it.
• Nominate another person to exercise these rights if you die or become incapacitated.
• Withdraw a consent you gave — though withdrawing consent to process your account data means we can no longer provide the service.
• Complain to us first, and to the Data Protection Board of India if we do not resolve it.

You can export your organisation’s records from the app at any time. To exercise any of these rights, write to our Grievance Officer at clause 13. We will respond within [30 DAYS]. We may ask you to verify your identity, and we may decline a request that would expose someone else’s data or that we are legally obliged to refuse.

TranspoX is a business tool and is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child’s data has reached us, tell us and we will delete it.

We use cookies that are necessary for the service to function — keeping you signed in and keeping your session secure. We do not use advertising cookies and we do not track you across other websites. Blocking essential cookies will stop you from being able to log in.

In accordance with the DPDP Act and the Information Technology Act, 2000, our Grievance Officer is:

[OFFICER NAME]
Email: [grievance@yourdomain.in]
Address: [REGISTERED ADDRESS]
Phone: [PHONE]

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.

We will post any change here and update the date at the top. If a change materially affects how we handle your personal data, we will tell you in the app or by message before it takes effect.