Sub-processors

Anthropic (AI features)

Purpose: (1) reading order documents you upload (PDF/photo/text/email) to pre-fill an order draft; (2) checking the CMR photographed by the driver against the order; (3) reading your customers’ pro-forma documents when they have no machine-readable lines, and matching the lines that could not be paired automatically; (4) translating chat messages between dispatch and driver, if your company turns it on (off by default); (5) suggesting the language to write to a driver in, from the driver’s name and phone number; (6) generating Academy test questions from the training materials a manager uploads.

Data: the document, photo or text sent for that task, plus the details it is compared against — for the CMR check the order’s companies, references, vehicle plates and cargo; for pro-formas the order references, route, dates and price. These fields are encrypted in our database but are sent to the provider in readable form, only for that task. Location: EU/US. Safeguard: DPA with Standard Contractual Clauses; under Anthropic’s commercial terms, data sent through the API is not used to train models and is deleted within 30 days — longer only if a request is flagged under Anthropic’s usage policy or where the law requires it. Anthropic’s retention policy: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data

HERE Global B.V. (maps, routing, tolls)

Purpose: truck routing, map tiles, ETA and toll calculation. Data: stop coordinates and route geometry. Location: EU. Safeguard: DPA; no customer identities are sent — only geographic points.

Daimler Truck / Fleetboard & telematics providers

Purpose: importing live vehicle positions, fuel and tachograph/driving-time data for the trucks you connect. Data: vehicle and driver telematics from your own fleet account. Location: EU. Safeguard: your credentials are encrypted at rest; data is pulled on your instruction.

Stripe Payments Europe (billing)

Purpose: online card payment of invoices, only if we enable it for your account — not enabled today. Data: billing contact and payment metadata (card data is handled by Stripe, never stored by us). Location: EU/US. Safeguard: PCI-DSS; DPA.

NETOPIA FINANCIAL SERVICES S.A. (card payments in Romania)

Purpose: online card payment of invoices through NETOPIA Payments, only if we enable it for your account — not enabled today. Data: billing contact and payment metadata (card data is handled by NETOPIA, never stored by us). Location: Romania (EU). Safeguard: PCI-DSS; DPA.

Twilio SendGrid (transactional email)

Purpose: sending account, verification, compliance-digest and notification emails. Data: recipient email address and message content. Location: EU/US. Safeguard: DPA; used only for service emails, not marketing without consent.

Expo / push providers (FCM, APNs)

Purpose: delivering push notifications to the driver and dispatch mobile app. Data: device push token and notification content. Location: EU/US. Safeguard: notifications are transient; no sensitive commercial data is stored by the provider.

Hetzner Online GmbH (hosting and document storage)

Purpose: running the application and database on servers in Germany, and storing the documents you upload (order PDFs, CMR photos, fleet documents) in object storage in Nuremberg. Data: all Service data; uploaded documents. Location: Germany (EU). Safeguard: EU provider subject to the GDPR; sensitive commercial fields are encrypted per company at rest; documents are reachable only through short-lived signed links, never publicly.

LiveKit (in-app voice calls)

Purpose: real-time voice calls between dispatch and drivers inside the app, one call room per trip. Data: the live audio of the call and the participants’ display names. Location: EU/US. Safeguard: calls are encrypted in transit (WebRTC); we do not record calls.

Contact & changes

We will keep this list current and give reasonable notice of new sub-processors. Questions or objections: office@digiohs.com. Security incidents: office@vectares.com.