Privacy policy

What we hold, why we hold it, and who else touches it. Short, because we collect little.

Last updated 9 August 2026.

The short version

We hold your email address, what you type into the product, and a record of your subscription. We use Google and Meta to measure how this site is used, and none of it loads unless you agree to it — decline and no third-party tag is requested at all. We do not sell your data, and we do not use your work to train anything.

Who is responsible

Tourload is operated from the United Kingdom and is the data controller for the information described here. UK GDPR and the Data Protection Act 2018 apply.

What we hold

Your account. Email address, and a password held only as a hash by our authentication provider — we never see it.

Your workspace. Company or workspace name, and a logo if you upload one, so it can appear on your load plans.

Your work. Case libraries, vehicle profiles, productions, truck packs and saved revisions. Mostly equipment rather than people, but it is yours and we treat it as confidential.

Collaboration. The email addresses you invite, who invited whom, and which productions or trucks each person can see.

Billing. Your subscription status and a customer reference from Stripe. We never receive your card details — those go directly to Stripe and never touch our servers.

Things you send us. Feature requests, haulage quote enquiries, and support emails.

Why, and on what basis

To run the service — storing your work, signing you in, sending invitations. Necessary to perform our contract with you.
To take payment — necessary for the contract, and to meet our tax and accounting obligations.
To keep it working and secure — error logs and diagnostics. Our legitimate interest in a service that functions.
To reply to you — support and enquiries. Our legitimate interest in answering people who write in.

We do not send marketing email. Anything we send is about your account: invitations, password resets, and notice before a trial converts.

Who else processes it

These providers handle data on our behalf, under contract:

Supabase — database and authentication. Hosted in the region chosen for the project.
Vercel — hosting and content delivery.
Stripe — payments. They are a controller in their own right for card data; their privacy notice covers it.
Resend — sending transactional email.
Sentry — error reporting, so we find out the product is broken from a machine rather than from you. Hosted in the EU. It receives a stack trace, the page address, a browser version and a timestamp when something fails. It is deliberately configured without session replay, without performance tracing and without attaching your account details to a report, so it records faults rather than people — which is why it is not part of the cookie banner below.
Google (Analytics and Ads), Meta and PostHog — measuring which pages and adverts bring people here, and where people get stuck. PostHog is hosted in the EU. These are the ones that need your agreement, and nothing of theirs loads until you give it. PostHog’s session recording is switched off, so nobody is watching a replay of your screen — which matters more here than on most sites, because your screen has your client’s tour on it.

Some of these operate outside the UK. Where they do, transfers rely on the safeguards those providers put in place, such as standard contractual clauses.

Places data leaves at your request

Haulage quotes. If you ask for a quote, the enquiry — your email address, the vehicle, the number of trucks, the dates, the mileage and any notes you write — is sent to us and passed to a haulier so they can quote. We record it so a referral can be evidenced. Do not put anything in the notes you would not want a third party to read.

Sharing a case library. If you email a spreadsheet of your cases to somebody, it goes to the address you type. We do not check who that is.

Crew share links. If you create a read-only share for a pack, anyone with the URL can open that load plan without signing in. The link is unguessable; it is not a lock. Deleting the pack ends it.

How long we keep it

Your work stays until you delete it or close your account. We deliberately do not delete anything when a subscription lapses — it locks instead, and reopens if you subscribe again.

Billing records are kept as long as tax law requires, currently six years. Backups are kept on a rolling basis and expire in the ordinary course.

Your rights

You can ask us to:

give you a copy of what we hold about you
correct anything wrong
delete your account and its contents
restrict or object to what we do with it
hand it over in a portable format

Email support@tourload.com and we will respond within one month.

Being straight with you: there is no button in the product yet that deletes your account. Until there is, deletion is a request by email and we will action it. Building the self-serve version is on the list.

You can also export your case library and any truck pack from inside the product at any time, without asking.

If you think we have handled your data badly, please tell us first — but you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Cookies and measurement

We set the cookies needed to keep you signed in, and those are not optional — without them you cannot stay signed in.

Separately, we use Google Analytics, Google Ads and the Meta pixel to understand which pages bring people to the product and which adverts are worth paying for. These are the ones the banner asks about, and they behave the way the banner says: if you decline, or simply never answer, none of the three is requested — no script, no cookie, no cookieless ping. It is not a tag running with a flag set to off; it is a tag that is never loaded.

You can change your mind at any time, and it takes effect immediately:

Changes

If this policy changes materially we will tell you by email before it takes effect. The date at the top always reflects the current version.