Privacy policy
Version of 27 October 2026
Translation of the Portuguese original. In case of any discrepancy, the Portuguese version prevails.
1. Who we are
Iris is provided by Balboastar Web Solutions — Rui Lucas dos Santos Costa, sole trader (empresário em nome individual), tax number (NIF) 213752654, Avenida de São Félix, n.º 8, 4760-510 Gondifelos, Vila Nova de Famalicão, Portugal.
Privacy contact: geral@bswebsolution.com · telephone 911 884 828.
2. Two different roles
- We are the controller of the data of anyone who creates an account, signs in to the dashboard, pays the subscription, contacts us or visits the website.
- We process data on behalf of the haulier where it concerns the drivers, the haulier's customers, trips, refuelling, expenses and documents. The controller of that data is the haulier; we act as processor, processing it solely to provide the service and in accordance with the haulier's instructions, under the data processing agreement. If you are a driver or a customer of a haulier, please address your requests to the haulier — we help it to respond.
3. Data for which we are the controller
| Purpose | Data | Lawful basis (Art. 6 GDPR) | Retention period |
|---|---|---|---|
| Creating and managing the account of the haulier and of its office users | name, email, telephone, role, password (stored as a hash, never in plain text), language, date of acceptance of the terms | performance of a contract (Art. 6(1)(b)) | for as long as the account exists and for 30 days after it ends |
| Subscription and invoicing | company name and tax number (NIF), address, plan, payments (card details are held by Stripe, not by us) | performance of a contract (point (b)) and legal obligation (point (c)) | 10 years, as required by law for tax documents |
| Service emails (access, password recovery, account notices) | email, name | performance of a contract (point (b)) | for as long as the account exists |
| Security and operation | IP address, date and time of requests, browser | legitimate interest in keeping the service secure (point (f)) | we do not keep our own technical logs; hosting providers keep them for a short period, in accordance with their own policies |
| Responding to enquiries | whatever you send us | legitimate interest (point (f)) or steps prior to entering into a contract (point (b)) | up to 1 year after the last contact |
We do not sell data, we do not use it for advertising and we do not share it with anyone other than the providers listed in section 5.
4. Data we process on behalf of the haulier
What the haulier and its users record in Iris: data of drivers and other workers (identification, contact details, tax number (NIF), IBAN, address, date of birth, images of documents such as the Portuguese citizen card, driving licence, CAM (driver certificate of professional competence), tachograph card and ADR certificate, photograph, rate per km), trips, stops and deliveries, refuelling, expenses and receipts, incidents and photographs, absence requests and supporting documents, and contact details of the haulier's customers.
The driver app stores the location of the phone at the moments when the driver makes an entry (arrival at a stop, refuelling, departure) and uses GPS to detect arrival and departure. The driving times shown by the app are an aid to planning: the legal record is the tachograph.
It is for the haulier to have a lawful basis for processing this data and to inform its workers. We have a template notice for drivers, which we send on request.
5. Providers we use
| Provider | Purpose | Where the data is stored |
|---|---|---|
| Supabase, Inc. | database, authentication and files | European Union (Ireland) |
| Cloudflare, Inc. | hosting of the website and the application server | global network |
| OpenRouter, Inc. and Google (Gemini model) | reading photographs and PDFs when a user requests it (section 6) | United States |
| Resend | sending emails, including the end-of-trip report | United States |
| Stripe Payments Europe, Ltd. | subscription payments (Stripe also acts as a controller, under its own terms) | European Union (Ireland) |
| Telegram | receiving orders and sending the end-of-trip report, only where the haulier chooses this channel | outside the European Economic Area |
| OpenStreetMap (Nominatim) | converting addresses into coordinates | United Kingdom |
| HeiGIT (openrouteservice) and FOSSGIS (OSRM) | calculating routes and distances | Germany |
| Google Fonts and jsDelivr | fonts and a dashboard library (they receive the IP address of whoever opens the page) | global |
Where a provider is located outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission. Telegram is optional: it is the haulier that decides whether to use it.
6. Document reading with artificial intelligence
To avoid copying errors, a user can ask Iris to read a photograph or a PDF — a driver's document, a transport order, a receipt — and propose how to fill in the fields.
- The image is sent encrypted to our server, which forwards it to a third-party AI model (Google Gemini, via OpenRouter).
- The request is sent with zero retention and with data collection refused: the provider does not keep the image or use it to train models. Our server does not keep it either — only the copy that the user decides to attach is kept.
- The result is a proposal: the person confirms or corrects it before saving. There is no automated decision-making or profiling (Art. 22 GDPR).
- Using document reading is optional: the fields can be filled in manually.
7. Security
- Each haulier sees only its own data: isolation is enforced by the database itself, in every table, and not just by the screen.
- Within the haulier, each role sees what it needs: drivers' personal documents are visible only to the office, and drivers do not see their colleagues' records.
- Encrypted connections (HTTPS), passwords stored as hashes and service keys held only on the server.
- Replaced or removed documents are deleted from storage, and changes to records are logged (who changed what and when).
8. Your rights
You may request access to, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest, using the contact details in section 1. We respond within one month. You may also lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados), the Portuguese data protection authority (www.cnpd.pt). If you live or work in another European Union country, you may complain to that country's data protection authority.
9. Browser storage
The dashboard and the app store in the browser the session (so that you do not have to sign in on every page), the chosen language and, in the driver app, entries not yet sent when there is no network connection. This is strictly necessary for the service. We do not use advertising cookies or analytics tools.
10. Changes
We notify customer hauliers, by email and with 30 days' notice, of material changes to this policy or to the list of providers.