Xaro Privacy Policy

• Customer account users — whoever signs in to a customer’s Company Account.
• Driver App users — drivers whose company has given them access to the Xaro Driver app with a username and password.
• People in a customer’s records — drivers, carrier contacts, broker and facility contacts, and anyone else a customer enters while running its freight.
• Visitors — anyone who looks up a shipment on a public tracking page using a reference number or a tracking link.

If you are in a customer’s records and have a question about them, contact that company first; it decides what is kept and can ask us for help.

• Account and sign-in. Your name, email address and role. Sign-in uses a one-time code sent to your email or a passkey; we store the code only as a hash while it is valid, and for a passkey only its public key and identifier — the private key never leaves your device. We keep a record of sign-ins (time, IP address, browser and method), active sessions and security events.
• Driver App access. When a customer gives one of its drivers access to the Driver app, we keep, with that driver’s record in the customer’s account: the username, the password — stored only as a one-way hash, never in a form anyone can read — whether sign-in is allowed, and when the password was set, when access last changed and when the driver last signed in. A signed-in driver’s session is identified by a random token kept in the driver’s browser; we store only a hash of it. To limit repeated attempts, failed sign-ins are recorded briefly with the username entered and the IP address. The customer’s Company Account sets up and manages this access, and changes to it are written to the audit trail.
• Operational records a customer enters. Drivers (name, phone, email, mailing address, emergency contact, date of birth, CDL number and expiry, medical card expiry, hire date, status, pay rate, notes); carriers (company and contact names, phone, email, mailing address, fee terms, insurance expiry); loads and stops (broker names and contacts, reference and PO numbers, facility names and addresses, appointment dates and times, rates, miles, notes); the customer’s facility directory; equipment (unit numbers, VIN, plate, odometer, registration and inspection dates); settlements and payments (driver and carrier pay and adjustments); and documents uploaded to a load — bills of lading, rate confirmations, lumper receipts and similar paperwork — with their thumbnails and the amounts read from them.
• Vehicle telematics. If a customer connects its Samsara account, Xaro reads the position, heading, speed, engine state and fuel level of the vehicles the customer links, and keeps the latest positions and the route estimates made from them.
• Text messages. When staff send a dispatch text to a driver, we keep the message, the recipient’s number and its delivery status.
• Audit trail. Who changed what, when, and from which IP address, kept as part of the customer’s records.
• Public tracking lookups. The reference number entered and the IP address it came from, used to limit repeated lookups.
• Technical information. Server logs of requests, errors and timings. Text typed into the load form’s address fields is not logged, and no raw answer from an address provider is kept.

• To provide and operate the service: dispatching loads, tracking shipments, paying drivers and carriers, keeping records.
• To sign you in, keep accounts and sessions secure and prevent abuse: sending codes, verifying passkeys and Driver App passwords, limiting repeated attempts, ending sessions when access changes, keeping the audit trail.
• To let a customer’s Company Account manage its drivers’ Driver App access: setting usernames and passwords, resetting them, and switching access on or off.
• To send the text messages and sign-in emails that staff or the service initiate.
• To place facilities on a map, estimate arrival times, draw planned routes and show a customer’s fleet map.
• To read uploaded documents with an AI service and suggest values — a rate confirmation’s fields, a lumper receipt’s total — that a person then confirms.
• To back up the data, keep the service running, investigate problems and respond to support requests.
• To comply with law and protect the rights, safety and property of customers, their people and us.

We do not use the information in Xaro for advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Xaro includes Google Maps features and content. Use of Google Maps features and content in Xaro is subject to the then-current Google Maps End User Additional Terms of Service (maps.google.com/help/terms_maps) and the Google Privacy Policy (policies.google.com/privacy). This is what Xaro sends to Google, and when:

• The fleet map. The fleet map page is drawn with the Google Maps JavaScript API in your browser. When you open it, your browser connects to Google directly, and Google receives your IP address, device and browser details and your interactions with the map, and may set its own cookies. Vehicle positions from the customer’s telematics are shown on that map.
• Facility addresses. When a customer enters a facility address, our servers send the address text to Google’s Geocoding API to place it, and the resulting coordinates to Google’s Time Zone API to determine the local time zone.
• Routes and arrival times. To estimate a truck’s arrival and draw a load’s planned route, our servers send vehicle positions and facility coordinates to Google’s Routes API. Vehicle location from the customer’s telematics provider is combined with Google’s road and traffic data for this purpose.
• Address suggestions. When you type a street address on the load form, the text typed so far and a session identifier are sent through our servers to Google’s Places API, which suggests matching addresses. Only the address you select is saved, to that load; we do not store Google’s suggestion lists, place identifiers or business listings.

Google collects and may retain the data it receives this way — including search terms, IP addresses and coordinates — to provide and improve its services, as described in its privacy policy. We do not send Google your name, email address or other account details.

These providers process information for us, only to provide their service to Xaro:

• Railway hosts the application, its database and the customer’s uploaded documents, in a United States region.
• Cloudflare provides DNS for the platform’s domain and stores encrypted backup copies of uploaded documents.
• Resend delivers the platform’s emails — the sign-in codes — to staff addresses.
• Twilio delivers the text messages staff send to drivers.
• Samsara is the customer’s own telematics account; when connected, we read vehicle data from it with the credential the customer provides, which we store encrypted.
• Anthropic provides the AI service that reads documents. A rate confirmation is sent when a person asks for its fields to be extracted; a lumper receipt is sent when it is uploaded, so its total can be suggested. The document’s content is sent for that purpose under Anthropic’s commercial API terms.
• CARTO and OpenStreetMap supply the base map for a load’s overview map; our servers fetch the tiles, and no information about you is sent to them.

We may also disclose information when the law requires it, to protect the safety, rights or property of any person, or as part of a reorganization or transfer of the platform, in which case this policy continues to apply to the information transferred.

A customer may let brokers and receivers look up a shipment by its reference number or through a tracking link. The page answers with the shipment’s status, pickup and delivery locations and dates — not the vehicle, the driver or the equipment. Where the customer has shared a live tracking link from its telematics provider, the page can send the visitor to that provider’s page while the load is open; the link stops working once the load is delivered. Lookups are rate-limited by IP address.

Xaro sets only the cookies it needs to work: a session cookie after you sign in (rapid.session_token, or __Secure-rapid.session_token over HTTPS; the older sx_session for sessions that predate sign-in by code) and a short-lived cookie that carries a passkey challenge during sign-in or registration. A driver who signs in to the Driver app receives a separate session cookie, sent only to the Driver app’s pages. They are marked HttpOnly and are scoped to this host. We use no advertising or analytics cookies and no third-party trackers on our pages. The fleet map, drawn by Google, may set Google’s own cookies as described above. The public tracking pages set no cookies.

Connections use HTTPS. Company Account sign-in is by one-time email code or passkey; we do not ask for a password there. Driver App sign-in uses a username and a password that the customer’s Company Account sets; Driver App credentials are separate from the Company Account’s, the password is stored only as a one-way hash, and resetting it or switching a driver’s access off signs that driver out everywhere. Each company has one Company Account, and each company’s records are kept apart from every other company’s. Telematics credentials and backups are stored encrypted, and every change to a record is written to an audit trail. No system is perfectly secure; if you believe an account or record has been misused, contact us at once.

Operational records are kept for as long as the customer’s account is active and as its business records require. A customer controls what it enters: it can change or remove many records, while some — accounts, settlements and the audit trail — are kept rather than erased so that history remains intelligible. A driver’s Driver App access is removed with the driver’s record, and its sessions end when the driver signs out, the password is reset, access is switched off or the driver is made inactive, and otherwise expire on their own. Backups are taken on a schedule and kept for recovery. We do not currently publish fixed retention periods; ask us about a specific record and we will explain how it is handled.

• Whoever uses a Company Account can add, rename and remove its passkeys from the account page, and can sign it out of every other session there.
• If you use the Driver app, your company’s Company Account sets your username and password and can reset them or switch your access off; ask the company for help signing in. You can sign out of the Driver app at any time.
• If you are a driver, carrier, broker or other person in a customer’s records, direct requests about that information to the company; we will help it respond.
• Where a privacy law gives you rights over information we hold — to know, correct or delete it — write to us and we will honor the request as that law requires. We do not sell personal information or share it for cross-context behavioral advertising, and we do not discriminate against anyone for exercising a privacy right.

Vehicle locations in Xaro come from the customer’s telematics provider and are shown to that customer’s staff on the fleet map and the load pages; they are combined with Google’s routing data to estimate arrivals, as described in section 4. Xaro does not read the location of your phone or computer.

Xaro is a business tool. It is not directed to children under 13, and we do not knowingly collect their information.

Xaro is hosted in the United States and is intended for use by businesses operating there. If you use it from elsewhere, your information is processed in the United States.

When this policy changes, we post the new version here with a new “last updated” date. The Terms of Use govern your use of the service.

Trucking companies that use Xaro can send operational text messages (SMS/MMS) through it — about loads, dispatch, pickup and delivery, documents such as a bill of lading or proof of delivery, and account and support matters — only to people who have agreed to receive them. The trucking company is the sender of its messages and Xaro is the platform that carries them; Xaro Inc is the sender only of messages Xaro sends itself, such as account and support notices. These messages are not marketing. Agreeing is optional and is not a condition of purchasing or using Xaro.

A person agrees in two steps, to hear from a specific company: verbal consent, given personally when an authorized representative of that company reads them our approved disclosure naming it, and then a YES reply to the confirmation text sent to them through Xaro. For messaging through Xaro we handle:

• Mobile phone numbers — of the people who receive messages.
• Verbal consent records — the number, the company the consent is for, when consent was given, who asked for it, that it was given verbally, the version of the disclosure read, and the answer.
• Confirmation records — the confirmation text sent, the YES reply and when it arrived, the verbal consent it confirms, the message identifier the messaging provider assigns where available, and whether the person is enrolled.
• Opt-out and help requests — STOP and HELP replies and when they arrived.

We use this information only to send the messages a person agreed to receive from the company they agreed to hear from, to confirm their enrollment, to stop messages when they reply STOP, to answer HELP requests, and to show that consent was given. Messages are delivered through Twilio (section 5), which receives the mobile number and the content of each message in order to deliver it.

We do not sell, rent or share mobile phone numbers or SMS consent information with third parties or affiliates for marketing or promotional purposes. Mobile numbers are shared only with the provider that delivers the messages, and only to deliver them.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. The terms of messaging through Xaro are in section 16 of the Terms of Use.

Questions about this policy or about your information: support@xaro.co.