Privacy Policy

This Privacy Policy explains how Transport Anything 247 ("we", "us", "our") collects, uses and protects information about you when you use:

• the website at transportanything247.com;
• the Transport Anything 247 customer mobile app (iOS and Android); and
• the Transport 247 Driver mobile app (iOS and Android).

Together we refer to these as the Service. By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

We are committed to UK GDPR compliance (Data Protection Act 2018 and the UK General Data Protection Regulation). We collect only what we need to run a transport marketplace and never sell your personal information.

Transport Anything 247 is a UK-based transport marketplace connecting customers with vetted drivers. For data protection purposes:

• Data controller: Transport Anything 247.
• Privacy contact: customers@transportanything247.com.
• Registered jurisdiction: United Kingdom.

We operate two account types, each with its own data scope:

Customer accounts: created when you book transport. We collect your name, email address, phone number, billing address and a hashed password (we never see or store your password in clear text). We use this information to authenticate you, deliver booking communications, send receipts and let you re-book past jobs.

Driver accounts: created when a transport operator applies to the platform. In addition to the customer-account data above, drivers provide a UK driving licence number, vehicle insurance details, vehicle photos, and Stripe Connect onboarding information (handled by Stripe directly — we never store full bank-account or card details). We verify driver documents before approval and retain them for the lifetime of the driver relationship.

We only collect what the Service genuinely uses. Specifically:

• Account data: name, email, phone, hashed password.
• Booking data: pickup and delivery postcodes, item type, dimensions/weight, schedule, instructions you add to a booking.
• Driver verification data: licence, insurance documents, vehicle photos and registration plate (drivers only).
• Payment data: handled by Stripe — we receive only the last four digits of your card, the card brand and a payment-result token. We never see your full PAN, CVV or bank-account number.
• Location data: see Section 5 — only collected when you are actively using the Service.
• Proof-of-delivery photos: see Section 9 — uploaded by drivers at delivery.
• Messages: in-app chat messages between customer, driver and our team (see Section 11).
• Device identifiers: push tokens (drivers only), web-session identifiers, JWT subject identifiers — used to keep you signed in and deliver dispatch notifications.
• Diagnostics: crash and performance logs that help us fix bugs. Not linked to your identity.
• Operational telemetry: for drivers, we compute a private weekly efficiency / paid-mile / deadhead summary from your GPS breadcrumbs. This is visible only to you and to our internal operations team for support purposes.

We do not collect: full payment-card numbers, biometric data (your fingerprint / Face ID stays on your device — see Section 8), advertising identifiers, or any data we then share with advertising networks.

Why we need it. Location data is essential to a transport marketplace:

• Customers: to suggest your current location as a pickup point (foreground only, with your permission).
• Drivers: to match you with nearby jobs, calculate accurate ETAs, and share your live location with the assigned customer during an active delivery.

Foreground location (both apps): we read your location only while the app is open.

Background location (driver app only, and only while a job is active): we continue to capture position breadcrumbs when the screen is off so customers see accurate ETAs. You can revoke this permission at any time from your device's Settings; the driver app will fall back to foreground-only tracking.

What we store. Breadcrumbs are recorded every ~30 seconds while you are online and are automatically deleted after 7 days. Aggregated derived data (miles driven, paid vs deadhead totals) is retained while your account is active.

What we don't do. We do not track drivers when they are off-duty, do not share customer location with anyone other than the assigned driver, and do not sell or license location data to third parties.

Once a driver accepts a customer's booking, the customer can see the driver's live position on a map until delivery is confirmed. This sharing is automatic and tied to the booking; it ends when the booking status moves to "completed" or "cancelled". Customers see only their own assigned driver's location — never any other driver on the platform.

On native mobile apps we use the operating system's push services (Apple Push Notification service for iOS, Firebase Cloud Messaging for Android) to send job offers, status updates and booking confirmations. To do this we receive a device push token from Apple / Google and store it against your account.

Push notifications are an essential part of the dispatch experience for drivers; the app will still function if you decline, but you may miss time-sensitive job offers. Customers can disable push notifications at any time from device Settings. We do not use push tokens for advertising.

On the driver app you can choose to unlock the app with Face ID, Touch ID or your Android fingerprint / face unlock. When you opt in:

• Your authentication token is stored in the device's secure store (iOS Keychain or Android Keystore).
• Your biometric data never leaves your device and is never sent to our servers — Apple and Google handle the biometric check locally.
• You can disable biometric unlock at any time from the driver app Profile screen, or by signing out.

The driver app uses the device camera to capture proof-of-delivery photos at the drop-off point. With the driver's permission, we also capture the GPS coordinates and an optional free-text note at the moment of upload, so the customer has a verifiable record.

Proof-of-delivery photos are visible to (a) the assigned driver who took them, (b) the customer associated with the booking, and (c) Transport Anything 247 staff for support and dispute resolution. They are stored encrypted at rest and retained for 6 years after the booking as part of our commercial records (HMRC / contract dispute requirement).

If you operate in patchy signal areas, the driver app may queue your POD upload locally on your device's IndexedDB store until the network reconnects, at which point it is sent and removed from the queue.

We use Stripe as our sole payment processor:

• Customer card payments are taken via Stripe Checkout and Stripe Payment Intents. Your card details are entered on Stripe-hosted UI and never touch our servers.
• Driver payouts are made through Stripe Connect Express. Drivers complete onboarding directly on Stripe's hosted forms; we receive only an account identifier and onboarding status.

Stripe is an independent data controller for the personal data they process. Their privacy statement is at stripe.com/privacy.

The Service includes an in-app messaging channel between customers and the assigned driver, plus an "Operations" channel where you can contact our team. Message contents are stored for the lifetime of the related booking plus 12 months. Operations staff can view messages in the support context only.

Please avoid sending sensitive personal information through chat — it is not designed to replace a secure channel for things like passport numbers or bank statements.

The website and apps use only the storage we need to make the Service work. We do not use advertising cookies, fingerprinting trackers or cross-site tracking technologies on the Service. The detailed list (storage item, type, purpose and lifetime) is published in our separate Cookie Policy.

We track diagnostic and performance data to operate the platform reliably: API response times, crash reports, and aggregated counts (e.g. how many drivers were online in a given week). This data is not used to profile individual users or for advertising.

Drivers have access to a private "Your performance" widget on their dashboard. This shows their own miles, paid miles, deadhead miles, jobs completed and an efficiency percentage, for their eyes only. There is no public leaderboard and no comparison to other drivers.

We rely on the following processors to deliver the Service. They process data on our instructions only, under contractual data-protection terms.

• Stripe, Inc. — payments and driver payouts.
• Resend / GoDaddy SMTP — transactional email delivery (booking receipts, payout notifications, weekly digests).
• Postcodes.io — UK postcode geocoding (we send only the postcode; never any account data).
• Apple Push Notification service — iOS push delivery.
• Google Firebase Cloud Messaging — Android push delivery.
• OpenStreetMap tile providers — map tiles rendered in the live-tracking view.
• Emergent (hosting) infrastructure — application hosting and MongoDB-backed primary storage.

International transfers, where they occur, rely on Standard Contractual Clauses or equivalent UK-recognised safeguards.

• Account profile: kept while your account is active; deleted within 30 days of account closure (see Section 17).
• Bookings, invoices, POD photos: retained for 6 years from booking date for HMRC and contract-dispute reasons.
• Driver verification documents: retained for the lifetime of the driver relationship plus 6 years.
• GPS breadcrumbs: 7 days; aggregated mileage summaries are retained while your account is active.
• Chat messages: 12 months after the related booking is closed.
• Diagnostic logs: 90 days.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your personal data (subject to legal retention obligations);
• object to or restrict processing in certain circumstances;
• request portability — a machine-readable export of the data you have given us; and
• withdraw consent at any time for processing based on consent (e.g. push notifications).

To exercise any right, email customers@transportanything247.com. We respond within one month. If you are dissatisfied with our response you can complain to the UK Information Commissioner's Office (ico.org.uk).

You can request deletion of your account in two ways:

• In-app: from the customer or driver Profile screen, choose "Delete account". You'll receive an email confirmation; once confirmed, we remove your account-identifiable data within 30 days.
• By email: write to customers@transportanything247.com from the email address on the account.

Some records — completed-booking invoices, driver verification documents, POD photos — must be retained for 6 years to comply with HMRC and commercial-contract obligations. After deletion those records are anonymised or pseudonymised so they are no longer linked to you.

We protect personal data with industry-standard controls: TLS for all data in transit; encryption at rest in our primary MongoDB store; bcrypt-hashed passwords; JWT-signed authentication tokens with rotation; role-based access for our support team; and audited third-party services. No system is perfectly secure — we will notify you in line with UK GDPR Article 33 obligations should we ever suffer a breach affecting your personal data.

The Service is intended for users aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact customers@transportanything247.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes to the Service or applicable law. We will revise the "Last updated" date at the top of this page and, for material changes, notify active users by email. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.