Privacy Policy
Last updated: 1 October 2026
This policy explains what personal data TachoAssist ("we", "us") processes, why, and the rights you have. It applies to the tachoassist.com website and the TachoAssist application. Contact: contact@tachoassist.com.
1. Data we process
| Category | Examples | Why |
|---|---|---|
| Account data | Name, email, password (hashed), country, optional phone, company name, account type | Creating and securing your account and workspace |
| Tachograph data | Uploaded .DDD files and the data extracted from them: driver names, card numbers, driving activity, locations of periods of work, vehicle registrations | Providing the analysis and reports you request |
| Billing data | Subscription plan, billing status, invoices. Card details are collected and stored by Stripe only — they never reach our servers | Managing your subscription |
| Usage data | Basic website analytics and technical logs | Keeping the service working and improving it |
| Registration IP address | The IP address your account was created from, recorded once at registration. Kept for 12 months, then deleted | Detecting repeated or duplicate free trials. Legitimate interest — we do not use it to profile you or to track what you do in the app |
2. Why we are allowed to process it
- Contract — providing the service you signed up for (account, analysis, billing).
- Legitimate interests — securing the service, preventing abuse, improving the product.
- Legal obligation — accounting and tax records.
Where you upload tachograph files containing your drivers' personal data, your company is the data controller for that data and TachoAssist processes it on your instructions.
3. Where your data lives
- Application data is stored with Supabase (managed PostgreSQL and file storage, hosted in the EU).
- Payments are processed by Stripe. Stripe's own privacy policy applies to the payment details they collect.
- Emails from the application are sent through Zoho (ZeptoMail), from its EU data centre.
- The marketing website is served by Cloudflare, which also measures visitor numbers for us without cookies and without creating an identifier for you.
- We do not sell personal data and do not share it with third parties beyond the service providers identified in this policy.
4. Retention and deletion
- Uploaded files and analysis results are retained securely and can be deleted by you at any time in Settings — per file, per driver, or everything at once.
- Each workspace has a configurable automatic retention period after which old files and analyses are deleted. (UK operators must keep tachograph records for at least 12 months — keep your retention setting at or above that.)
- Deleting your account removes your workspace data, subject to invoices and records we must keep by law. How to delete your account — in the app or by email.
- Unused trial accounts: if a free trial ends without a subscription and nobody signs in to or uses the account for 14 days, we email every user of the account a warning that names the deletion date, 7 days later. If nobody signs in before then, we permanently delete the account and all its data: the users’ logins and account data, the workspace, uploaded files, analyses, reports and settings, the registration IP address, and any customer record created with Stripe during a checkout that was never completed. An account that has ever had a paid subscription is never deleted this way. What remains are anonymous usage counts that identify no one and, for an address that bounced or reported our email as spam, that address on our do-not-send list.
- Account and security emails — such as the sign-up confirmation, a password reset and this warning — are always sent, even to an address that has opted out of optional emails, because they concern access to the account.
- Deleted data disappears from our backups within 35 days.
- Where an account holds records the law requires you to keep (for example tachograph and working-time records), keeping them for the required period is your responsibility as the employer or operator; keep your own copies before the deletion date.
5. Your rights
Under UK and EU data protection law you can ask us for access to, correction of, deletion of, or a copy of your personal data, and you can object to or restrict certain processing. Write to contact@tachoassist.com and we will respond within one month. You can also complain to the ICO (ico.org.uk) or your local supervisory authority.
6. Security
All traffic is encrypted in transit (TLS). Access to stored data is restricted to the service itself; uploaded files live in a private bucket that is never publicly accessible. Passwords are hashed by our authentication provider and are never visible to us.
7. Cookies and analytics
The application uses only the storage needed to keep you signed in and remember your preferences. The marketing website carries no advertising trackers and no third-party analytics scripts that identify you. Visitor numbers are measured with a privacy-focused service that sets no cookies, creates no identifier for you, and does not follow you across other websites.
The website also keeps a small record on your own device, for up to 90 days, of how you first reached us — the search engine, campaign or website that linked to you, and the page you arrived on. We use it to understand which pages bring people to TachoAssist. It contains no identifier, it is never shared with anyone, and it reaches us only if you go on to register an account.
8. Changes
If we materially change this policy we will notify account owners by email or in the app before the change takes effect.