Privacy Policy

1. About this policy

This policy explains how Road-X ("Road-X", "we", "us") handles personal data in the Road-X mobile app, the web apps (including the business portal) and this website (together, the "Service").

Road-X is a marketplace. It connects drivers (clients) with towing, repair and road-service companies. See the Terms of Use and the Payment Terms.

We try to collect only the data we need. We do not show ads at launch. We do not sell your personal data.

Road-X decides why and how the data in this policy is used. A company that receives client data through a request uses its copy for its own purposes and is responsible for that use (see section 5).

2. Data we collect

Account data

• Name, email address and phone number.
• For a company: the company profile (name, details, location and service categories) and the staff accounts (owner, managers, workers).
• Sign-in data. Clients sign in with a one-time email code. Companies sign in with a password, which we store only in hashed form.
• Your chosen app language.

Vehicle data (garage)

• Make, model, year and body type of your vehicles. The VIN is optional.
• When you create a request, we copy the vehicle onto the request. Later changes in your garage do not change that copy.

Requests and location

• The request: service type, description, photos you add, and the vehicle copy.
• The location of the request. You set it with the map pin or your device location, if you allow it.
• The search radius you choose.

Chat and translations

• The chat messages between a client and a company for a request, and the original language of each message.
• Machine translations of those messages, which we keep so that we do not translate them again.

Ratings and reviews

• A star rating (1 to 5) and an optional review text that a client writes for a company after a completed job.

Job and payment records

• Whether a job is completed, and whether it is marked as paid.
• For a payment request that a company sends for a job: the amount, the currency, the state of the request (open, paid or cancelled), and when it was paid. We do not store card numbers or a Checkout link (see section 5).
• For a company that connects Stripe to receive job payments: the Stripe connected account reference and the onboarding state. Stripe collects and holds the identity and bank details in its own onboarding.
• For a company plan: the Stripe customer and subscription details needed to know the company's plan. Stripe holds the card and billing data.

Device and usage data

• Push notification tokens for your device.
• Usage events and device information for analytics (see "Product analytics" in section 5), and crash reports. This helps us fix errors and understand how the app is used.
• Technical data your device sends to our servers, such as IP address and app version.

Sensitive personal information

The precise location of a request is "sensitive personal information" under California law. We use it only to run the Service you ask for: to show your request to companies in range, and to let the assigned company reach you. We do not use it to infer other facts about you, so there is no separate "limit use" choice for it. You can refuse the location permission of your device and set the pin by hand on the map.

3. Where your location goes and who can see it

Your location is used for a request. We do not follow you in the background for this purpose.

• A client's request location is visible only within the scope of the request.
• While a request is open, companies whose service area is inside the radius you chose can see the request, including its location and distance. They see the location as you set it. This can be the exact point of the pin.
• Offers are anonymous before you accept. After you accept an offer, you see the name and phone number of the company you chose.
• After you accept an offer, that company sees your name and phone number, if you gave them. Other companies do not.
• The VIN, if you gave it, is shown only to the company whose offer you accepted. Companies see the make, model, year and vehicle class before that.
• Other companies stop seeing your request when it closes.
• If a company declines or postpones a request, you are not told.

A live location of the client during a request, and the live location of workers, are planned but not yet part of the Service. We will update this policy before they launch.

The assigned company and its workers

A company can add workers (its employees) to its account and assign a worker to a job. While a company is assigned to your request, the assigned company and the worker it assigned receive:

• the location of the request;
• your vehicle details;
• the photos you added to the request;
• the chat of the request.

A worker does not receive your phone number.

The company is responsible for its workers. It must make sure they use this data only to do your job and keep it confidential.

Access ends when the assignment changes. If the company assigns a different worker, the earlier worker can no longer see the request. If the company is no longer assigned, the company and its workers can no longer see it. A company may keep its own copy of data it received (see section 8).

4. Why we use data

• To run the Service: create accounts, show requests, send offers, run chat, and confirm jobs.
• To translate chat messages.
• To send notifications about your request, such as a new offer, a reminder to keep waiting, and when a request expires. A push message and a lock-screen message show only status and the number of offers.
• To send email, such as sign-in codes and account notices.
• To manage company plans and billing.
• To keep the Service safe, stop fraud and abuse, and follow the law.
• To measure and improve the Service, including product analytics (see section 5).

Road-X is not yet offered in the European Economic Area or the United Kingdom. If the GDPR or the UK GDPR applies to you, these are our legal bases: contract (to run the Service, chat and translation, notifications about your request, sign-in email, and plan billing); legitimate interests (safety, fraud prevention and crash reports); legal obligation (to follow the law); and consent (for the permissions on your device, and for product analytics where the law requires consent).

5. Who receives your data

We use service providers to run Road-X. They process data for us under written agreements and on our instructions. We do not let them use it for their own marketing. Where data moves from the EU or UK to a country without an adequacy decision, we use the transfer tools the law requires, such as standard contractual clauses.

Provider	What for	Data involved
Microsoft Azure	Hosting of our servers, database and files	All Service data
Microsoft Azure Translator	Machine translation of chat messages	Message text
Google Maps Platform	Maps, and a count of nearby repair shops	Map views; a rounded location for the shop count. We do not keep or show Google place content
Stripe	Company plan billing; payments to companies for jobs	Payment, billing and contact data (see below)
Postmark	Sending email	Email address and message content such as sign-in codes
Firebase Cloud Messaging (Google), and Apple Push Notification service	Push notifications	Push token and notification text
Amplitude	Product analytics (see "Product analytics" below)	Usage events, account ID, role, app language and device data
Firebase Crashlytics (Google)	Crash reports	Crash and device data

Payments

Road-X does not store your card number.

When a client pays a company through the Service, the payment is made directly to the company's own Stripe account. The payment page is Stripe Checkout, run by Stripe. Road-X does not process or hold the payment. Stripe processes the payment data for itself under its own privacy policy. Road-X keeps the payment request (amount, currency, state) and the paid status of the job, as described in section 2.

The company that receives the payment is the seller and can see the payment details, such as the amount and the payer details that Stripe gives it, in its own Stripe account. Stripe and the company each decide for themselves how they use the payment data they receive. The company handles that data under its own responsibility. Refunds, disputes and chargebacks are handled by the company in its Stripe Dashboard.

For company plans, Stripe handles the payment card and billing details. Stripe's Privacy Policy applies.

Product analytics

We use Amplitude to learn how the mobile app and the business portal are used. Amplitude is our service provider. It processes this data for us, under a data processing agreement, and only for this purpose. Analytics does not apply to this website.

What we send. Events about what you do in the Service: for example signing in, viewing a screen, choosing a language, creating a request, receiving or sending an offer, accepting an offer, assigning a worker, sending a chat message, completing a job, a payment, giving a rating, and answering the notification prompt. We also send session information, your account ID, your role (client, company or worker), the company ID if you work for a company, your platform (iOS, Android or web) and your app language. Events can include internal IDs of a request, an offer or a company. Because they are linked to your account ID, they are personal data. Amounts and counts are sent in ranges, not as exact numbers.

What we do not send. We do not send your name, phone number, email address, the text of chat messages, request descriptions, review text, or your precise location. We do not use advertising IDs, we turn off IP address capture in Amplitude, and we do not record your screen (no session replay).

One exception: feedback. The in-app "Rate us" screen lets you write optional feedback. If you send it, the text you wrote goes to Amplitude, with its length, your app language and the app version. Please do not put personal data in feedback: no names, phone numbers, email addresses, addresses or licence plates. This option is hidden when analytics is off.

How long. We keep analytics data in Amplitude for 24 months.

Your choice. Analytics is on by default. You can turn it off with the "Analytics" switch in the app and in the business portal. When it is off, the app and the portal send no analytics events, and our servers send none for your account. Turning it off does not delete events sent earlier; write to us (section 11) to ask for deletion. On the business portal we also treat a Global Privacy Control (GPC) signal from your browser as a request to opt out.

No sale, no sharing. We do not sell this data. We do not share it for cross-context behavioural advertising. Amplitude may not use it for its own advertising.

Companies and other users

Other users get the data described in section 3, and the chat messages of your request. The assigned company and its assigned worker get the data listed in section 3 only while they are assigned. A company that gets a client's data from a request uses its copy for its own purposes, not on behalf of Road-X, and is responsible for how it uses that data. Our terms require a company to use a client's data only for the request.

Other cases

We may share data:

• with advisers, insurers and authorities when the law requires it or to protect rights and safety;
• in a sale or reorganisation of Road-X, with notice to you where the law requires.

6. How long we keep data

• Account data: until you delete your account. After you ask for deletion, we switch off the account, and delete it for good after 30 days (see section 8).
• Push tokens: deleted when you log out and when you delete your account.
• Analytics data: 24 months in Amplitude.
• Requests, offers, chat, translations, ratings and job records: not decided yet. We have no fixed deletion period for them. We will set one and update this policy. Until then, a client can see their own request history in the app, and we keep it until the retention policy is set.
• Payment records: Stripe keeps its own records under its own rules. We keep only the payment request and the paid status, as part of the job record.
• Legal and safety needs: we may keep some data longer where the law requires it or to deal with fraud or a dispute.

7. Your rights

Your rights depend on where you live. We give these choices to all users where we can.

You can ask to:

• know what personal data we hold about you, and get a copy;
• correct data that is wrong;
• delete your data;
• object to or limit some uses of your data;
• move your data to another service, where the law gives you that right;
• withdraw consent you gave us, at any time.

United States (California and other states)

If you live in California, the California Consumer Privacy Act (CCPA, as amended by CPRA) gives you the right to know, delete, correct, and limit the use of sensitive personal information. Other US states give similar rights. We do not discriminate against you for using these rights.

We do not sell your personal data. We do not share it for cross-context behavioural advertising. This includes the data we send to our analytics provider.

European Economic Area, United Kingdom and Switzerland

If the GDPR (or the UK GDPR) applies to you, you have the rights of access, correction, deletion, restriction, objection and portability. You can also complain to your data protection authority.

We do not yet offer the Service in these places. We will set the retention periods and complete a data protection impact assessment before we do.

To use a right, write to the address in section 11. We may ask you to prove who you are. You may use an authorised agent; we may ask for proof that the agent may act for you. We answer within 45 days. If we need more time, we may extend this once by up to 45 more days and we will tell you why. Where the law sets a different time, we follow it.

8. Deleting your account

You can ask to delete your account in the app.

• The account is switched off at once. If you are a company owner, your company is switched off with it.
• You can sign in and cancel the deletion for 30 days.
• After 30 days we delete the account for good. For a company owner, we delete the company too.
• Push tokens are removed when you log out and when you delete your account.

Some data, such as chat messages, requests and ratings, involves other users and is covered by section 6. A company may also keep its own copy of data it received from a request, under its own responsibility.

9. Children

Road-X is for people who are at least 18 years old. We do not knowingly collect data from children under 13 (or under 16 where the law sets that age). If you think a child gave us data, write to us and we will delete it.

10. Security, transfers and changes

We use technical and organisational measures to protect data, such as encrypted connections and access controls. No system is fully secure.

Road-X and its providers may process data in the United States and other countries. Those countries may have different data protection laws.

We may change this policy. We will post the new version here with a new date. For a big change we will tell you in the app or by email before it starts, where we can.

This site does not use advertising or tracking cookies, so there is no cookie banner. We show no ads at launch. We will update this policy and ask for consent where the law requires it before we add ads or tracking.

11. Contact

Operator: RTV Consulting Group

Questions or requests about your data: support@rtvcg.com