Privacy Policy

This Privacy Policy describes how Muftar ("we," "our," or "us") handles information through the Muftar website, account and organization portals, Muftar Driver mobile app, business tools, support channels, and authorized integrations (collectively, the "Services"). Muftar refers to the legal operator identified in your applicable commercial agreement, billing record, or associated legal notice.

It applies to drivers, carrier personnel, owners, contractors, visitors, applicants, approved vendors and partners, and authorized Muftar staff, to the extent they use a covered Service. An organization may separately determine why its workers' or customers' information is processed. In those cases Muftar may process information on that organization's instructions; the organization's own employment or customer privacy notice may also apply.

Some third-party identity, payment, ELD, social, or other service providers issue additional notices where their services are actually enabled. Features marked as planned are not represented as connected or collecting data today.

Depending on how you use Muftar, information may include:

• Identity and accounts: name, email, phone, profile information, account identifiers, security settings, sign-in events, email verification, and policy acknowledgments.
• Organizations: business identity, registration and authority details, memberships, permission assignments, verification results, and business contact information.
• Transportation operations: pickup and delivery details, rates, assigned personnel and equipment, dispatch communications, trip history, order changes, and associated audit records.
• Uploaded content: Bills of Lading, Proofs of Delivery, rate confirmations, receipts, signed forms, photographs or scans, notes, and other business records.
• Driver app and device: app installation identifier, device platform, version, language or locale, push-notification token where enabled, and operational troubleshooting information.
• Precise trip location: GPS coordinates, accuracy, speed, heading, timestamps, and load/trip association, when an authorized tracking session is running.
• Financial activity: token purchases, payment and billing references, invoices, processing activity, statements, eligible earnings, deductions, allocations, reimbursements, and factoring/invoicing workflow status.
• HR and safety: employment and qualification records, onboarding forms, driver documents, expiration dates, acknowledgments, reviewer actions, and authorized safety-service requests.
• Communications and applications: customer support requests, employment applications, submitted inquiries, marketing preferences, vendor or partner applications, and records of our responses.
• Technical and analytics information: diagnostic logs, service requests, page interactions, error events, security identifiers, usage patterns, and analytics data, subject to applicable permission and consent settings.

We may receive information directly from you, from an organization you work for, another authorized user, public or business records, and service providers supporting features you use. Do not send passwords, bank credentials, sensitive identity documents, or full payment-card details to the public contact form.

We process information to operate and protect accounts, verify identity and organizational authority, manage transportation orders, facilitate dispatch communication, display permitted trip tracking, review documents, support invoices and settlements, respond to requests, and provide connected services authorized by a user or organization.

We also process appropriate information to prevent fraud and abuse, investigate technical or security problems, maintain audit records, meet lawful recordkeeping obligations, and improve product reliability.

We use service and usage data for Muftar's own analytical purposes: measuring how features perform, understanding aggregate workflows, identifying technical problems, improving usability, evaluating customer-support effectiveness, and planning product development. We aim to use aggregated or de-identified information where practical and do not need to expose identifiable driver trips or confidential customer documents to unrelated users to accomplish general product analytics.

We do not treat information collected under a provider's restricted API authorization as unrestricted data. Such information is used only within the applicable platform scopes, policies, and lawful purposes.

The lawful basis for processing depends on the information and applicable jurisdiction. Depending on the circumstance, it may be necessary to perform a contract, satisfy a legal obligation, pursue legitimate operational or security interests subject to appropriate safeguards, or rely on consent where that is required and valid.

For records provided through an employer, carrier, or other organization, Muftar may be a service provider or processor acting on its documented instructions; the organization may be responsible for establishing the legal basis and giving required worker or customer notices. Where workplace consent would not be freely given, another lawful basis may be required. Acceptance of the Terms is not intended as blanket consent for every form of personal-data processing.

Muftar Driver may collect precise geographic location while an authorized load-tracking session is active, including when the app is not on screen or the device is locked. Background location supports trip continuity, shipment monitoring, and dispatcher visibility for an active load.

Recorded samples can include latitude, longitude, estimated accuracy, device-reported speed, heading, sample time, and associated shipment, driver, and tracking-session identifiers. On supported devices, the App may request foreground and background location permissions and show a platform-controlled background indicator or service notification when tracking is active.

The current App is designed to collect and transmit position samples during an authorized session, check continued access, and stop collecting when the session ends or cannot remain authorized. It may temporarily queue location samples on the device while awaiting transmission. Collection and transmission can be affected by battery optimization, missing permissions, low signal, service interruptions, or hardware limitations; exact timing and continuous accuracy are not guaranteed.

Who can see trip information: authorized members of the organization connected to the load, such as dispatch personnel, owners, and other appropriately permissioned staff, as necessary for shipment operations and related reviews. Muftar personnel may access data where appropriately authorized for support, security, incident response, or platform administration.

Choices: you can change location permissions in iOS or Android settings. Disabling permission may prevent or interrupt tracking-dependent features and does not retroactively erase location history already transmitted. Contact the organization responsible for your trip records, or Muftar through the privacy request process, if you need to exercise applicable location-data rights.

Precise GPS is intended for actual work-related trip coordination, not unrestricted 24-hour personal surveillance. Organizations are responsible for their own workplace-monitoring notices and legal compliance. We do not sell precise driver location data or use it for third-party targeted advertising.

When you use document capture or upload features, Muftar Driver may request camera or file access to scan transportation paperwork and receipts. Images and files you submit may be available to your organization's authorized reviewers and become part of its load, reimbursement, or other permitted business record.

The App may register an installation identifier, app version, device operating system, locale, and push token for supported account/device management and notifications. Push services, including Firebase Cloud Messaging where enabled, may handle delivery tokens and notification-routing information. You may manage notification permissions in your device settings. Certain essential in-app service messages may remain available even with push disabled.

A personal account can be linked to one or more organizations. Organization owners and permitted administrators determine which workers may access business records and what they may do with them. A person's access may change when their work assignment, role, or organization membership changes.

A document or transaction you create for an organization may remain part of its lawfully held business history, even if you leave the organization or deactivate your personal account. Muftar may need that history to keep accounting, dispatch, safety, employment, investigations, signatures, and audit records accurate.

Account or organization verification may involve a specialized verification service and business data providers. We may receive the status and related references needed to decide whether an account or organization can access restricted functionality. Where a third-party provider collects sensitive identity materials, its notice also explains that provider's handling.

HR, driver-qualification, safety, and personnel information can be sensitive. Access is restricted to authorized organizational and Muftar personnel with an appropriate operational reason; legal requirements may call for additional notices, safeguards, or rights.

Muftar stores or processes records needed for token or service billing and applicable accounting workflows, including invoices, payment references, statement drafts and history, deductions, contributions, approved receipts, and payout or factoring status information. Payment providers may independently process payment details under their own policies; the Services should not be used to send full card numbers through general-purpose forms.

Organizational access, financial review, and retention are governed by role permissions and applicable contractual or recordkeeping obligations. A displayed settlement status does not by itself indicate that funds were transferred.

Muftar uses information generated by the Services to analyze platform performance, feature adoption, operational bottlenecks, support quality, fraud patterns, and product reliability. Analysis may use event information and, where necessary, pseudonymous account or organization identifiers. We seek to limit direct identifiers and use aggregate reporting where suitable. Processing for specific customer or organization analytics remains subject to that organization's permissions and applicable law.

Optional Google Analytics on our public website measures visits and engagement only after the user accepts optional website analytics, as explained in our Cookie Policy. Withdrawing that choice stops future optional website tracking as described there. Necessary security and diagnostic processing is not necessarily controlled by the same cookie preference.

We do not sell personal data to data brokers, advertisers, or unrelated third parties. We do not use precise driver trip locations for third-party advertising. Where privacy laws define "sale," "sharing," or targeted advertising more broadly, you may contact us regarding applicable opt-out rights and the processing that falls within those definitions.

Authorized staff may connect Muftar-controlled business accounts to a supported provider when an official integration has been activated and approved. Providers under consideration or integration may include YouTube/Google, TikTok, LinkedIn, Facebook/Instagram/Threads through Meta, and X. Merely displaying a platform in Marketing Studio does not mean a connection has been established or data has been collected.

When an account owner authorizes applicable API scopes, Muftar may receive account or Page identifiers, permitted display information, access tokens, token expiration details, publishing status, authorized media references, posts, engagement counts, and performance metrics made available by the provider. The precise fields depend on scopes, provider access, and the connected account.

We process connected-platform data to authenticate the connection, prepare or publish specifically authorized content, audit publication results, troubleshoot failures, and produce permitted first-party campaign analytics. We will not use restricted API data for unrelated profiling, resale, third-party advertising, or purposes forbidden by the platform's developer terms.

Muftar will not sell or rent connected social account information, OAuth credentials, or data obtained through third-party social-platform APIs. We may use authorized performance statistics to evaluate our own company campaigns, subject to the source platform's permissible uses, required disclosures, and account permissions.

Disconnecting an integration or revoking provider access should stop new authorized data access through that connection. Provider account owners may revoke access at their social platform. Where available, staff can also disconnect within Muftar. Existing platform posts must be changed or deleted using the provider's own features. Tokens and provider-derived records will be deleted or retained according to the applicable platform requirements, legal obligations, and our documented operational needs.

For YouTube-linked features, the Google Privacy Policy and YouTube Terms of Service provide additional information. Where Google grants an integration, users may manage third-party app permissions through their Google Account connections. Other platforms offer comparable authorization or app settings under their own policies.

Muftar shares information only where appropriate for a permitted purpose, which may include:

• Authorized organization users: information they are permitted to access to dispatch loads, review documents, manage employees, or perform accounting.
• Business recipients: brokers, carriers, factoring or invoicing recipients, and other parties specified in a workflow your organization authorizes.
• Service providers: services supporting infrastructure, authentication, communications, analytics, payments, identity verification, mobile push, or other enabled functionality.
• Social platforms: media and post information your authorized staff direct Muftar to publish or transmit, subject to platform authorization.
• Legal or safety recipients: disclosures reasonably necessary to comply with law, lawful requests, prevent fraud, secure the service, or respond to legal claims.

Our infrastructure may use Supabase for data storage and authentication, Lovable for applicable website hosting, Firebase for supported mobile push delivery, and Google Analytics for consented website analytics. Other providers are used only where their services are enabled.

Muftar does not sell personal information. Sharing data with an organization, service provider, or an authorized transaction recipient for these specified functions does not transfer a general right to sell the information.

The Services may involve infrastructure, organizations, or providers operating in different jurisdictions. Accordingly, information may be processed outside the place where it was collected. Where law requires it, appropriate contractual, organizational, or other legally recognized transfer safeguards must apply.

You may contact Muftar for information about the handling of data across borders relevant to your situation.

We employ technical and organizational security measures appropriate to the nature of the Services, including account authentication, authorization, restricted organizational access, and operational monitoring. We review relevant incidents and limit access to personnel or service providers who need information for their permitted duties.

No online service, network, or device is entirely risk-free. Users must keep passwords and devices secure and report suspicious access. We will provide legally required notices in the event of a qualifying data-security incident.

Retention depends on what a record represents and why it is needed: active account access, open loads, driver tracking history, transport documents, safety and HR requirements, invoicing, taxes, contractual disputes, fraud prevention, security investigations, and audit integrity. We do not promise a single fixed retention period across all information categories where none has been formally established.

In the Driver App, the account-deactivation process ends account access but may retain the driver's profile, operational history, uploaded documents, and organization records. Deactivating an account is not the same as deleting all stored personal data.

A verified request for deletion will be evaluated against applicable rights and lawful retention exceptions. We will erase or de-identify information where required and feasible, while preserving records an organization or applicable law is permitted or required to keep. Social-platform data may also be subject to stricter provider-specific deletion rules.

Subject to your jurisdiction, you may have rights to request access, correction, deletion, portability, restrictions, objections to certain processing, or withdrawal of consent where consent is the legal basis. You may also have rights to seek review by a privacy regulator.

To request assistance, use the Muftar privacy contact form. Tell us which account, organization, or category of information your request concerns without sending sensitive documents through the public form. We may verify your identity or authority before responding. For organization-controlled employment, load, or accounting records, we may refer you to or coordinate with the organization responsible for those records.

You can manage device location, camera, and push permissions through iOS or Android settings; choose optional website analytics through our cookie controls; and revoke social integrations through the applicable provider. Withdrawing permission may limit some functions but does not automatically erase lawfully retained historical records.

Muftar's operational transportation and Driver App Services are intended for authorized adults or other individuals legally eligible for the particular service. They are not directed at children. If you believe a child's information was submitted unlawfully, contact us for review.

We may update this Privacy Policy when features, providers, legal obligations, or data practices change. The effective and last-updated dates identify the published version. We will provide further notice or request additional consent where applicable law requires it.

Questions about privacy, GPS handling, social integrations, account access, or data deletion can be submitted using the Privacy topic on our contact page. Related information appears in our Terms of Use and Cookie Policy.