TransportHub
Sign up

Privacy policy

Last updated: 30 October 2026

This policy explains what data we collect, how we use it and what your rights are under the General Data Protection Regulation (GDPR — EU Regulation 2016/679).

1. Controller

The data controller is TransportHub. For any request about your data you can contact us at contact@transporthub.ro.

2. Data we collect

  • Account data: name, email, password (bcrypt hash), phone, account type, platform ID.
  • Company data: name, tax ID (CUI), registered office, contact people, locations.
  • Usage data: listings posted, offers placed, orders, messages, ratings, incident reports.
  • Technical data: IP address, user agent, authentication logs, cookies.
  • Driver app data: the phone's location and state during an order, only where the carrier has enabled it and the driver has agreed (details in section 11).
  • Transport documents and e-mails: photos of CMRs, receipts and other documents sent by drivers, and the e-mails a company forwards to its orders address (section 11).

3. Purpose of processing

  • Providing the platform services (authentication, posting listings, messaging and so on).
  • Sending notifications (email and in-app) according to your preferences.
  • Preventing fraud and maintaining the integrity of the platform.
  • Improving the product through anonymous aggregation.
  • Complying with legal obligations (tax reporting, requests from authorities).

4. Who we share data with

Your data is not sold to third parties. We share it only with:

  • Infrastructure providers: Netcup (server / hosting, in the EU), PostgreSQL hosted on our own infrastructure (database), Amazon Web Services (Amazon SES, transactional email, EU region) and Resend (transactional email, fallback), Cloudflare (DNS, email routing).
  • Payments and invoicing: Stripe (card payment processing) and Oblio (issuing invoices and submitting them to e-Factura).
  • AI-assisted checks: Anthropic (the activation documents you upload, the freight texts you ask us to read automatically, the questions you ask the assistant, the transport documents and receipts photographed by drivers and the e-mails received at a company's orders address are sent to the Claude model; they are not used to train models).
  • Push notifications: Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), only for the phones where the TransportHub app has notifications turned on; they receive a device token and the text of the notification.
  • Meta Platforms Ireland (Facebook, Instagram): only if you accept Marketing cookies, through the Meta Pixel. Details in the Cookie policy.
  • Crisp: only if you turn on the support chat in the cookie preferences.
  • Other platform users: your public profile data (company name, tax ID, rating, listings posted) is visible to other authenticated users.
  • Legal authorities: only upon the formal request of a competent authority.

5. Your GDPR rights

You have the following rights:

  • Access: to find out what data we hold about you.
  • Rectification: to correct inaccurate data.
  • Erasure ("the right to be forgotten"): to ask us to delete your account and the data linked to it.
  • Restriction: to limit certain processing.
  • Portability: to receive your data in a structured format.
  • Objection: to object to processing for marketing purposes.

To exercise these rights, write to contact@transporthub.ro. We reply within 30 days at the latest.

6. Security

We use technical and organisational measures to protect your data: passwords stored as bcrypt hashes, encrypted HTTPS connections, sessions with HttpOnly cookies, logical separation between environments (production / preview / dev).

7. Cookies

We use cookies that are strictly necessary for the platform to work (authentication, session, remembering preferences). The Meta Pixel (Facebook, Instagram) and the Crisp chat start only with your explicit consent, given in the cookie banner. Full details in the Cookie policy.

8. Data retention

We keep your data for as long as your account is active. When the account is closed we delete personal data within 30 days at the latest, except for the data we are legally required to keep (for example invoices, 10 years under Romanian tax law).

9. Complaints

If you believe your rights have been breached, you can contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro.

10. Early-access waiting list

10.1 What data we collect

Through the early-access form we collect: name, email address, phone number (optional), company name (optional), company type (carrier, freight forwarder, direct client or partner). We also record the IP address and the browser user agent at the moment you sign up, for security and spam prevention.

10.2 Purpose of processing

The data collected through the waiting list is used solely to notify you by email when the TransportHub platform becomes publicly available, and to send you a confirmation email for your sign-up.

10.3 Legal basis

The processing is based on your explicit consent (Art. 6(1)(a) GDPR), given by ticking the corresponding box in the form. You can withdraw your consent at any time, as described in section 10.5 below.

10.4 Storage period

Waiting-list data is kept until the platform launch plus 12 months, or until you unsubscribe or ask for deletion, whichever comes first.

10.5 Your rights

In relation to the waiting-list data, you have the right to:

  • Access: to find out what data we have stored about you.
  • Rectification: to correct inaccurate data.
  • Erasure: to ask for your entry to be removed entirely from the early-access list.
  • Portability: to receive your data in a structured format (JSON or CSV).
  • Withdrawal of consent: you can withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

For any request regarding the waiting-list data, contact us at: contact@transporthub.ro. We reply within 30 days at the latest.

11. The driver app and the orders e-mail address

11.1 The driver's phone location and state

A carrier can enable, in its account settings, order tracking through the TransportHub app installed on the driver's phone. The app asks the driver to agree, on a separate screen, before asking for location permission. Nothing is collected unless the carrier has enabled the option and the driver has agreed.

  • What we collect: the phone's position (coordinates and the time it was recorded) and its state at that moment: location on or off, permission granted or withdrawn, network type, airplane mode, battery level, battery saving and background restrictions, plus an identifier of the app installation.
  • When: only during an order, from the first confirmed loading to the last confirmed unloading. Outside orders the app sends no positions. Positions recorded without signal are sent when the signal returns.
  • Why: to show the carrier and the order's client where the goods are, to confirm orders on the vehicle paired with the phone and to calculate the GPS connectivity component of the score, under the Platform Rules (Sections 4 and 8).
  • Who sees it: the carrier sees the positions and the phone state; the order's client sees only the position, through the order's tracking link, while that link is active.
  • Legal basis: performance of the transport contract and the carrier's legitimate interest in tracking the goods during the trip; the driver's consent in the app is an additional safeguard, and withdrawing it stops the collection.
  • How long we keep it: positions and phone state are kept with the order file, as evidence that the transport was carried out, and are deleted together with it.

The driver can withdraw consent in the app at any time or withdraw location permission in the phone settings. The carrier is responsible for informing its own drivers. To exercise the rights in section 5, the driver can write to us at contact@transporthub.ro.

11.2 The orders e-mail address

A company can receive an orders e-mail address on the platform. E-mails sent to this address by the company's users, by the clients and carriers in its directory or by senders it has approved are read automatically (including PDF and image attachments) to prepare a draft order file that a person confirms. E-mails from unknown senders wait for the company's approval and are not read automatically. E-mails are received through Amazon Web Services (Amazon SES, EU region), and their raw content is deleted after 30 days at the most; what goes into an order file is kept with the file.