Privacy policy

Who is responsible

Tourload is operated from the United Kingdom and is the data controller for the information described here. UK GDPR and the Data Protection Act 2018 apply.

What we hold

Your account. Email address, and a password held only as a hash by our authentication provider — we never see it. We also keep the most recent activity time for each signed-in account in truck packing and Atlas, to count how many people are using the services. This records a time and product name, not what you type or a history of pages you visit. For Atlas usage reporting, we also record when you hand a recap image to your device’s share menu or open a social post composer, with your account ID, the selected platform and the time. These events do not contain your recap image or caption and do not tell us whether you published a post.

Who you are. First and last name, the company you work for, what you do, and which market you work in — asked once, when you create an account. Optionally a LinkedIn address, if you add one on your profile.

Where you connected from. The country your browser reached us from when you signed up, taken from the network rather than asked for. We keep it because we ask you for a market rather than a country, and this is the finer answer to the same question. It is a country, never a location.

A postal address — only if you ask. We send stickers and occasional merchandise to people using Tourload. If you want some, you tick a box on your profile and give us an address. We cannot store an address without that tick — the database physically refuses it — and untick it and save, and the address is erased rather than merely unused.

Your workspace. Company or workspace name, and a logo if you upload one, so it can appear on your load plans.

Your work. Case libraries, vehicle profiles, productions, truck packs and saved revisions. Mostly equipment rather than people, but it is yours and we treat it as confidential.

Collaboration. The email addresses you invite, who invited whom, and which productions or trucks each person can see.

Billing. Your subscription status and a customer reference from Stripe. We never receive your card details — those go directly to Stripe and never touch our servers.

Things you send us. Feature requests, haulage quote enquiries, and support emails.

Why, and on what basis

• To run the service — storing your work, signing you in, sending invitations. Necessary to perform our contract with you.
• To take payment — necessary for the contract, and to meet our tax and accounting obligations.
• To keep it working and secure — error logs and diagnostics. Our legitimate interest in a service that functions.
• To reply to you — support and enquiries. Our legitimate interest in answering people who write in.
• To understand who this is for — your role, company and market, so we build the right things next and know which parts of this industry we are serving. Our legitimate interest in developing the product. If you would rather we did not, say so and we will remove it.
• To post you things — your postal address, on the basis of the consent you give when you ask for them, and nothing else. You can withdraw it at any time from your profile, and withdrawing erases the address.

We do not send marketing email. Anything we send is about your account: invitations, password resets, and notice before a trial converts.

Who else processes it

These providers handle data on our behalf, under contract:

• Supabase — database and authentication. Hosted in the region chosen for the project.
• Vercel — hosting and content delivery.
• Stripe — payments. They are a controller in their own right for card data; their privacy notice covers it.
• Resend — sending transactional email.
• Sentry — error reporting, so we find out the product is broken from a machine rather than from you. Hosted in the EU. It receives a stack trace, the page address, a browser version and a timestamp when something fails. It is deliberately configured without session replay, without performance tracing and without attaching your account details to a report, so it records faults rather than people — which is why it is not part of the cookie banner below.
• Google (Analytics and Ads), Meta and PostHog — measuring which pages and adverts bring people here, and where people get stuck. PostHog is hosted in the EU. These are the ones that need your agreement, and nothing of theirs loads until you give it. PostHog’s session recording is switched off, so nobody is watching a replay of your screen — which matters more here than on most sites, because your screen has your client’s tour on it.

Some of these operate outside the UK. Where they do, transfers rely on the safeguards those providers put in place, such as standard contractual clauses.

Product measurement details

With your agreement, PostHog receives page categories and successful actions such as creating or importing inventory, saving a design, starting and ending a Load Out, loading a case, and invitation or reward actions. We do not send case or production names, email addresses, invitation tokens, form contents, or URL queries. Automatic click capture and session replay are disabled. Ad platforms receive limited page and conversion signals on suitable pages.

Successful signup is measured only when you have already agreed. We do not store a separate signup-tracking cookie before consent. After agreement, local browser records prevent repeated conversion reports. Pending reports expire after 15 minutes; deduplication records expire after 30 days and contain no names or email addresses. Product deduplication references stay in this browser. Turning measurement off cancels pending reports.

Places data leaves at your request

Haulage quotes. If you ask for a quote, the enquiry — your email address, the vehicle, the number of trucks, the dates, the mileage and any notes you write — is sent to us and passed to a haulier so they can quote. We record it so a referral can be evidenced. Do not put anything in the notes you would not want a third party to read.

Sharing a case library. If you email a spreadsheet of your cases to somebody, it goes to the address you type. We do not check who that is.

Crew share links. If you create a read-only share for a pack, anyone with the URL can open that load plan without signing in. The link is unguessable; it is not a lock. Deleting the pack ends it.

Statistics, and what we may do with them

We build statistics out of how the product is used — how full trucks typically run, how many a production of a given size takes, how that differs between markets. They are counts and averages across many accounts, and they are the most useful thing this product knows.

We may publish, share or sell those statistics, including commercially. Once information has been aggregated and anonymised it is no longer personal data and the law stops governing it — so rather than leave you to work that out from a silence, we are saying plainly that we intend to treat it as an asset.

Two commitments go with that, and they are the limits:

• We do not sell personal data. Your name, email, address, LinkedIn or anything else that identifies you is not for sale, and is not shared with anyone for their own purposes.
• We do not sell your work. Your case libraries, routings, truck packs and who you work for are commercially confidential. This is a small industry and that information has competitive value, so anything we publish is aggregated to the point where no individual production, company or person can be picked out of it — including by someone who already knows part of the answer.

If we ever want to go beyond that, we will ask you, and it will be something you opt into rather than a sentence that changes on this page.

We also do not use your work to train machine learning models, our own or anybody else’s.

How long we keep it

Your work stays until you delete it or close your account. We deliberately do not delete anything when a subscription lapses — it locks instead, and reopens if you subscribe again.

Billing records are kept as long as tax law requires, currently six years. Backups are kept on a rolling basis and expire in the ordinary course.

Postal addresses are not kept for ever. An address we have not used in two years is erased, and we will email you before doing it in case you would rather we kept it. An address held on the strength of a tick you have forgotten giving is not something you consented to.

Your rights

You can ask us to:

• give you a copy of what we hold about you
• correct anything wrong
• delete your account and its contents
• restrict or object to what we do with it
• hand it over in a portable format

Email support@tourload.com and we will respond within one month.

Being straight with you: there is no button in the product yet that deletes your account. Until there is, deletion is a request by email and we will action it. Building the self-serve version is on the list.

You can also export your case library and any truck pack from inside the product at any time, without asking.

If you think we have handled your data badly, please tell us first — but you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Cookies and measurement

We set the cookies needed to keep you signed in, and those are not optional — without them you cannot stay signed in.

Separately, we use Google Analytics, Google Ads and the Meta pixel to understand which pages bring people to the product and which adverts are worth paying for. These are the ones the banner asks about, and they behave the way the banner says: if you decline, or simply never answer, none of the three is requested — no script, no cookie, no cookieless ping. It is not a tag running with a flag set to off; it is a tag that is never loaded.

You can change your mind at any time, and it takes effect immediately:

Changes

If this policy changes materially we will tell you by email before it takes effect. The date at the top always reflects the current version.

See also the terms of use.