Privacy policy

01Who this covers.

This policy is from DRS Express LLC d/b/a Upways ("Upways", "we", "us"). It covers the Upways driver and office apps, the web dashboard, Upways Freight, the Upways Spot Chrome extension, our public forms (driver applications, contractor sign up, truck photos, demo bookings) and this website. It applies to company owners, dispatchers, drivers, owner operators, job applicants, and visitors to the site. Upways is a service for businesses and the adults who work for them.

02Who we are.

Upways is run by DRS Express LLC, doing business as Upways. Email: ralpasovsi@gmail.com. You can ask about your data, or ask us to delete it, even without an account: see Your data requests (/info/data-requests).

03Your company and us.

Most of what is in Upways belongs to a trucking company (our customer) and its people. For that information the company decides what is collected and why, and we process it for the company to run the service, as its service provider (a processor). If you drive or dispatch for a company, questions about its records, such as a receipt or a load paper, may need to go to that company too; we help it answer. For your own account, billing, the website and our own security, we decide, and this policy explains how.

04What we collect.

Only what the product needs to work.

• Account: your name, email address, phone number if you add it, your role, the company you belong to, your password (stored hashed by our database provider, never readable by us), and your two-step sign in setup if you turn it on.
• Company: the company name, address, USDOT and MC numbers, trucks and trailers, who works there and what each person may do.
• Location: see the next section, in plain words.
• Rescues: what broke, the answers you give, notes, photos, the provider chosen, the cost and every update with its time.
• Documents and photos: receipts and invoices, driver and truck documents such as a CDL, DOT medical card, registration, insurance and inspections with their dates, accident reports with photos, statements, the other party's details and witnesses, and truck photos.
• Freight, if your company uses it: loads, stops, customers and brokers, rates, rate confirmations, bills of lading, proof of delivery and other load papers, invoices, pay statements, driver pay details, and the tax ID needed for year end tax forms (shown one at a time and logged).
• Driver details your company keeps: licence number, state and class, date of birth, address, the last four digits of an SSN, fuel card numbers, and how you want to be paid (a Zelle, Venmo, Cash App or PayPal handle and the name on it; never a bank or card number).
• Job applications: what an applicant enters on a company's apply link: contact details, date of birth, licence and medical card details, past employers, accidents and violations, the checks they agree to (MVR, PSP, Clearinghouse, drug test) with a typed signature, and photos of the CDL and medical card. We do not ask for a full SSN.
• Contractors: the business name, address, USDOT and MC, insurance and W 9 papers, a tax ID (kept sealed in an encrypted vault), the trucks' VIN, plate and papers, and how the contractor is paid (the method, the payee's name and the last four digits of the account; never a full account number).
• Demo bookings: the name, company, work email, phone number, fleet size and message you give us, and your time zone so the time is right.
• Email, only if an owner connects a Gmail or Outlook inbox: we read the messages and attachments in it to find loads, rate confirmations and broker replies, and keep the ones we process. If the owner also turns on sending, replies go out from that inbox. The owner can disconnect at any time, and the access is then revoked.
• Messages and calls: chat between drivers and the office, and, when a company uses an Upways phone number, who called whom, when and for how long. A call is recorded only if the company turns recording on, and the other person hears a notice first.
• Device: a push notification token and, on iPhone, a Live Activity token, so we can send you updates.
• Usage and security: which feature was used and when (to keep costs and abuse in check), when you sign in, a security log of sensitive changes in your company, and a scrambled (hashed) form of the network address behind public forms and security events. We do not keep raw IP addresses.
• Crash reports: when something breaks, an error report with your account id and role. Names, emails, phone numbers, document links and positions are removed before it is sent.
• Payments: handled by Stripe on its own checkout page. We keep only Stripe's customer and subscription ids; we never see or store a full card number.
• Support: what you write to us and anything you attach.

05Location, in plain words.

Upways uses your phone's location only while the app is open on your screen. It never runs in the background, and the app never asks for Always access.

• When: only while you are on a load (from the moment it is dispatched to you until it is delivered) or in an open rescue, and the driver app is open, your phone's position is shared with your company about every 30 seconds, so dispatch can see where the truck is and send help to the right place. The app shows "Sharing with dispatch" the whole time, and the sharing stops by itself when the load is delivered and the rescue is closed. The map also uses your position on your phone to find services near you; that is not shared.
• What is kept: only your latest position. Each update replaces the one before, so there is no trail of where you have been. The place a rescue or an accident report was made stays on that record.
• Who sees it: the owner and dispatchers of your company, never the other drivers. A broker's tracking link, if the office sends one, shows the truck's area rounded to about a kilometre, never your exact spot; it uses your phone's position only after the freight is picked up, never a position older than 30 minutes, and it stops at delivery (the link itself closes 7 days after delivery).
• Truck positions from an ELD (Motive, Samsara, Geotab) come from the provider your company connects, not from your phone, and are kept for 7 days.
• How to stop it: turn Location off for Upways in your phone's settings (on iPhone: Settings, Upways, Location, Never), close the app, or sign out. The app keeps working, with less it can do for you.

06Why we use it, and our legal basis.

To run the service you or your company signed up for, and nothing else. Where a law such as the GDPR asks for a legal basis, it is shown in brackets.

• Running Upways: rescues, providers near the truck, the board, loads, records, reminders, messages and notifications (to perform our contract, and our customer's instructions).
• Reading a paper or an email for you, when you use an AI feature (see AI and your data).
• Billing, support and the emails that go with your account (contract).
• Keeping Upways secure, preventing fraud and abuse, and fixing what breaks (our legitimate interests in a safe, working service).
• Meeting legal duties, such as tax records and lawful requests (legal obligation).
• Anything optional, such as product news by email, only with your consent, which you can withdraw at any time with the unsubscribe link.
• We do not sell your personal information, we do not share it for cross context behavioural advertising, and we do not use it for advertising at all.

07AI and your data.

Some features use AI to save you typing: reading a receipt, a rate confirmation or another document, the describe it search, sorting broker emails, drafting a broker reply, matching spreadsheet columns on import, and Uppy, the office assistant. When you use one, the page, photo or words involved are sent to our AI provider, Anthropic, to produce the answer.

• No training on your data: Anthropic processes it for us under its commercial terms, which do not allow it to train its models on our customers' inputs or outputs. We do not use your data to train AI models either.
• If we ever want to use customer data to improve an AI feature, we will ask first and only use the data of companies that opt in.
• Suggestions can be wrong. The app shows you what it filled in, and nothing an AI drafted is sent to a broker or anyone else without a person's approval unless the owner has turned on automatic sending for that task.
• You can do every one of these things by hand instead.
• Speech to text (the microphone button) uses your phone's or browser's own speech recognition: Apple's on an iPhone, Google's on Android and in Chrome. Depending on your device, the recording may be processed on the device or sent to Apple or Google to turn it into text. Upways never receives or keeps the recording; only the text is used.

08Who we share it with.

Inside Upways, your company sees what belongs to your company: owners and dispatchers see the fleet, its rescues, loads and records; drivers see their own. Outside it, we share data only with the companies that run parts of the service for us (our sub-processors), each under a contract that limits them to that job. The full list, with what each one gets and where, is on the Sub-processors page.

• Supabase (database, file storage and sign in), Vercel (hosting), Google Maps Platform (maps, places, addresses, routes), Anthropic (AI features), Resend (email), Stripe (payments), Expo (push notifications and app updates), Apple and Google (push notifications, the phone's own maps and address lookups, and speech to text), Twilio (calls, only if your company uses an Upways number), Sentry (crash reports, when switched on), TollGuru and PC*MILER (toll and mileage estimates from route points, only when switched on).
• Services your company chooses to connect, only with its permission: Google or Microsoft (a Gmail or Outlook inbox), Motive, Samsara or Geotab (truck positions), QuickBooks (invoices and costs), and a factoring company (the papers your office sends it).
• Public lookups: FMCSA (carrier records by USDOT or MC number), NHTSA (decoding a truck's VIN, asked by your browser, so NHTSA sees the VIN and your network address), and a website icon service for a broker's logo (the broker's web address only).
• When you choose to navigate, the route opens in Apple Maps, Google Maps or Waze, which then work under their own privacy policies.
• A provider you send to a truck gets what the dispatcher tells it on the call; Upways does not send it your data.
• If the law requires it, or to protect someone's safety, we may disclose information. If Upways is ever sold or merged, this policy keeps applying to the data that moves with it, and we will tell you first.

09Cookies and browser storage.

Upways sets no advertising or tracking cookies and runs no analytics or marketing scripts. In your browser it keeps only what it needs to work: your sign in, your settings (such as light or dark, language and menu layout), drafts you have not sent yet, and short lived copies of your company's data so pages open fast. Signing out on the website clears the private copies. The website's type is served by Upways itself; Google Fonts supplies only the dashboard's icons and the type on printed invoices, statements and reports. The site also loads the Google Maps script on map pages, and Stripe's checkout page when you pay; those companies receive your browser's network address to deliver them. You can see this any time under Cookie settings at the bottom of every page, and the Cookie policy (/info/cookies) lists it in full. If we ever add an optional analytics or advertising tool, it will stay off until you say yes, and Reject will be as easy as Accept.

10How long we keep it.

Only as long as it is needed.

• Company records (rescues, receipts, accident reports, documents, loads, load papers, invoices, statements, messages, call records and processed emails) stay for as long as the company keeps its account, because a fleet may need them for years. After a company closes its account they are deleted as described under Ending an account.
• Your latest phone position is replaced every update and removed when your account is deleted. ELD truck positions are kept for 7 days.
• A document deleted from Documents can be put back for 30 days; after that its file is removed. Deleting a receipt photo or an accident photo removes its file right away.
• The security log is kept for about a year (400 days), then removed. Cached photos of businesses from Google are kept for 30 days and removed by a weekly clean up, so none is older than about five weeks.
• Demo bookings are kept as our own sales records until you ask us to delete them.
• If you unsubscribe from our marketing emails (or a company's outreach through Upways), your email address stays on a do-not-email list, with nothing else about you, so you are never written to again.
• A record of which version of the Terms and this policy you accepted, and when, is kept as proof of that agreement, even after the account is deleted. It holds only your account id, the two versions, the time and the device type.
• Crash reports are kept for a short time by Sentry. Database backups roll off on their own schedule, within 30 days.
• Job applications stay with the company you applied to, for as long as it keeps them.

11Your rights and choices.

You can see, download, correct and delete your data. Depending on where you live (for example California, Virginia, Colorado, the EU or the UK) these are also rights by law, along with the right to object to or limit some uses and to withdraw consent. We will not treat you differently for using them.

• See and correct: most of your details are on the You page in the app and in Settings on the website; change them there.
• Export: a company owner can download the company's data any time in Settings, Security, Export company data. You can ask us for a copy of your own data.
• Delete: delete your own account in the app (You, Delete account) or on the website (Settings, Security, Delete my account). We ask for your password (and your two step code, if it is on) first. Your sign in, your profile, your profile photo and your latest position are removed right away; backup copies roll off within 30 days. Records you filed for a company, such as receipts, accident reports, documents, loads and pay statements, stay with that company under your name, because they are its records too (pay records are tax records it must keep). A few things that are only about you, such as your own rescue requests, chat threads and routes, are deleted with your account. An owner whose company still has other people hands it over or removes them first; an owner can close the whole company account by writing to us.
• Location and notifications: turn them off in your phone's settings at any time.
• How to ask: write to ralpasovsi@gmail.com from the email on your account. We confirm it is you, answer within 30 days (45 where the law allows), and tell you if a request has to go to your company instead. An authorised agent may ask for you with your written permission. If we say no, you can appeal by replying to our answer, and you may complain to your local data protection authority.

12Security.

Data travels over encrypted connections and is stored encrypted at rest by our database provider. Every company's data is kept apart, and access inside a company follows each person's role, enforced by the database, not just the screen. Papers such as rate confirmations and bills of lading sit in private storage and open only through short lived links. You can turn on two step sign in, and an owner can require it for the office. Sensitive changes are written to a security log the owner can read. No system is perfectly secure; if a breach affects your data, we will tell you and, where required, the authorities, without undue delay.

13Where your data is kept.

Upways is run from the United States, and your data is stored and processed in the United States by us and our sub-processors. If you use Upways from another country, your data is transferred to the United States. Where a law such as the GDPR applies, we rely on our customer agreements and, for business customers, the Standard Contractual Clauses in our Data processing addendum.

14Children.

Upways is a business service for working drivers and fleet staff who are 18 or older. It is not meant for anyone under 18, it is not directed at children, and we do not knowingly collect information from or about children. If you think a child has given us information, write to us and we will delete it.

15Upways Spot extension.

Upways Spot is our Chrome extension for the DAT One load board. It reads only the DAT One results you are looking at, in your own signed in browser tab, to show profit, rate per mile and your nearest truck beside each load. It never searches DAT for you, the one button it can press there is DAT's own refresh, and only if you turn Auto refresh on, and it never asks for or keeps your DAT or broker passwords.

• What leaves your browser, only when you press the button: Send to Upways and Negotiate send that one load to your company's Upways account; Check broker sends the broker's MC number and name; Book, Offer and Email open your own mail app.
• Load Hub is off until you turn it on. When it is on and you are signed in, the loads shown on your DAT screen go to your own company's Upways account, at most every 15 seconds, so your team can sort them there. Turn it off in the side panel at any time.
• Kept in your browser: your sign in to Upways (a session handed over by our own page, never a password), your settings, broker blacklist, Recent list and cached trucks. Chrome may sync the settings to your Google account if you use Chrome sync.
• Sent to Upways to work: your settings and broker blacklist, so the extension and the Spot pages on the website match.
• Upways Spot works on DAT One but is not made, endorsed or affiliated with DAT. We do not sell this information or use it for advertising. Removing the extension deletes what it kept in your browser.

16Changes.

If we change this policy in a way that matters, we update the date and version at the top, tell you in the app or by email before it takes effect, and ask you to accept it again the next time you open Upways.

17Contact.

Questions, requests or complaints about privacy: ralpasovsi@gmail.com.