CloudTMS LLC (“CloudTMS”, “we”, “us”, “our”) is a Wisconsin limited liability company offering a multi-tenant transportation management platform: a web application at cloudtms.io and the “CloudTMS Driver” companion mobile app used by professional truck drivers operating for our customers (motor carriers).
This policy describes the personal data we collect from end users (dispatchers, drivers, accounting staff, executives), how we use it, who we share it with, and the rights you have over it. CloudTMS is the data processor on behalf of the carrier you work for; the carrier is the data controller.
1. Data we collect
Account and identity
Name, work email address, phone number, role within your company, and a hashed password. Created when you sign up for CloudTMS, or when an administrator at your carrier adds you.
Driver and vehicle records
CDL number, license expiry, medical-card expiry, hire date, vehicle and trailer assignments, hours-of-service status (when an ELD provider is connected). Required for DOT compliance reporting.
Location data (mobile app)
When a driver presses Arrived, Loaded, or Delivered in the CloudTMS Driver mobile app we capture a single GPS point at that moment. We do not run continuous background location tracking. We retain location points for the lifetime of the load record.
Camera and documents
The mobile app uses the camera to capture bills of lading (BOL), proofs of delivery (POD), lumper receipts, and other freight documents. Captured images are uploaded to our document storage on AWS S3 in us-east-1 and attached to the corresponding load record.
Push-notification tokens
With your permission, the mobile app registers an Expo push token used to deliver dispatch messages and load updates. Tokens are stored against your user record and removed on logout.
Operational data
Loads, customers, invoices, payments, settlements, fuel and toll receipts, IFTA mileage, and the messages exchanged between dispatchers and drivers within the app.
Logs and diagnostics
HTTP request logs, error reports (stack traces, breadcrumbs) sent to Sentry, and anti-abuse signals (IP address and user-agent for login and sign-up requests). We use these to detect outages and prevent brute-force attacks.
2. How we use your data
- To run the dispatch, billing, settlement, and compliance workflows you sign in for.
- To deliver real-time notifications about loads, messages, and dispatch events.
- To process subscription payments via Stripe and to send invoices via email.
- To meet your carrier's legal obligations (DOT, FMCSA, IFTA, IRS Form 2290).
- To detect and prevent fraud, abuse, and unauthorized access.
- To debug crashes and improve product reliability.
We do not sell personal data. We do not use your data to train third-party models.
3. Service providers we share data with
CloudTMS relies on the following sub-processors. Each handles a specific slice of data. The list is maintained in code alongside the features that use it.
- Amazon Web Services — application hosting (AWS Amplify Hosting with the CloudFront CDN), RDS Postgres database, and S3 document storage. Privacy policy.
- Stripe — subscription billing and payment-method processing. Privacy policy.
- Resend — transactional email (invoices, settlement statements, password resets). Privacy policy.
- Pusher — real-time websocket fan-out for dispatch and messaging events. Privacy policy.
- Upstash — Redis-based rate limiting. Privacy policy.
- Sentry — crash and error reporting (web). Privacy policy.
- Anthropic — AI processing: rate confirmations you upload are sent to the Anthropic API to extract load fields, and internal summaries and drafts are generated through it. Privacy policy.
- Google Maps Platform — map rendering, route geocoding, and address autocomplete. Privacy policy.
- Cloudflare Turnstile — bot challenge on the sign-up form. Privacy policy.
- Expo — push-notification delivery for the driver app. Privacy policy.
- Apple Push Notification Service — push notification delivery to iOS devices, relayed through Expo. Privacy policy.
- QuickBooks Online (Intuit) — optional accounting sync, when your carrier connects it. Privacy policy.
- Samsara, Motive, and Geotab — optional ELD, telematics, and camera data, when your carrier connects one. Samsara privacy notice, Motive privacy policy, Geotab privacy policy.
4. Data retention
We retain operational records (loads, invoices, settlements, driver and vehicle files) for as long as your carrier remains a CloudTMS customer plus seven years afterwards, to satisfy DOT, IRS, and IFTA record-retention rules. Files over 30 days old are kept in lower-cost storage and stay accessible.
Deleting Your Data
Individual documents can be deleted in the app. To delete an account's data, the customer emails privacy@cloudtms.io. We confirm the request, then delete. The exception is records we must keep by law or for billing, accounting, or legal claims; we keep those only as long as required. Driver qualification and other compliance documents removed in the app are retained as federal rules require. Deleted data can remain in encrypted backups for up to 7 days.
5. Security
- All traffic is served over HTTPS with HSTS.
- Passwords are stored using bcrypt; vendor tokens are encrypted with AES-GCM.
- Document storage is private S3 with server-side encryption and access denied to the public.
- Every carrier's data is scoped to a Company ID, and queries that return carrier data filter on the signed-in user's Company ID. This is applied in application code and checked in code review; see our Security page for what that does and does not guarantee.
- Login and sign-up endpoints are rate-limited to deter brute-force attacks.
6. Your rights
Depending on your jurisdiction (GDPR, CCPA, etc.) you may have rights to access, correct, or delete your personal data, port it, or restrict its processing. Because your carrier is the data controller, the fastest route is to contact your carrier's CloudTMS administrator. You may also email us directly at privacy@cloudtms.io and we will respond within 30 days.
7. Permissions used by the mobile app
- Location (when in use): required to record the GPS point at pickup, loaded, and delivery events. Not used for continuous tracking.
- Camera: required to capture BOL, POD, lumper receipt, and permit documents. Captured photos are uploaded to your carrier's document store.
- Photo library (optional): if granted, captured documents may be saved locally to your device for offline access.
- Notifications: required to deliver dispatch messages and load updates.
8. International transfers
CloudTMS is operated from Wisconsin, USA. Data is processed in AWS us-east-1. If you access the service from outside the United States, your data will be transferred to and processed in the United States.
9. Children's privacy
CloudTMS is a workplace tool for licensed commercial drivers and back-office staff. It is not intended for and we do not knowingly collect personal information from anyone under the age of 13. If a parent or guardian believes their child has provided information to CloudTMS, contact privacy@cloudtms.io and we will delete the data as described in Section 4.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via in-app notice and email at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the current revision.
11. Contact
CloudTMS LLC — Privacy Team
Wisconsin, United States
privacy@cloudtms.io