Privacy Policy

Last Updated: April 10, 2026 Effective Date: April 10, 2026

1. Introduction

This Privacy Policy explains how Spirosi LLC ("Spirosi", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use the Spirosi platform, website at https://spirosi.com, and related services (collectively, the "Service").

Spirosi provides a software-as-a-service ("SaaS") dispatch automation platform designed for trucking carriers and their personnel (dispatchers, drivers, administrators, and accountants).

We are committed to protecting personal data in accordance with the Law of Georgia on Personal Data Protection (effective March 1, 2024), the Law of Georgia on Protection of Consumer Rights, the Law of Georgia on Electronic Commerce, and, where applicable, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller and Contact Information

Data Controller: Spirosi LLC Identification Number (ს/კ): 404790507 Tbilisi, Georgia Email (general): support@spirosi.com Email (privacy): privacy@spirosi.com Email (legal): legal@spirosi.com Website: https://spirosi.com

For questions, requests, or complaints concerning your personal data, contact us at privacy@spirosi.com.

If you are located in the European Economic Area (EEA) or the United Kingdom, our representative for GDPR-related matters can be reached at the same address.

3. Categories of Personal Data We Collect

We collect the following categories of personal data:

3.1 Account and Identity Data

• Full name
• Email address
• Phone number
• Job role (dispatcher, driver, administrator, accountant)
• Company name and company identification number
• Password (stored as a cryptographic hash; never in plain text)
• Profile photo (optional)

3.2 Driver-Specific Data

• Commercial Driver's License (CDL) number and expiration
• Medical examiner's certificate and expiration
• Driving records and endorsements
• Hours-of-Service (HOS) logs sourced from ELD providers
• Real-time GPS location while on duty
• Vehicle assignment and equipment type
• Load assignment history and performance metrics

3.3 Business and Transactional Data

• Load details (origin, destination, rate, commodity, weight)
• Rate confirmations, bills of lading, and proof-of-delivery documents
• Broker and shipper contact information
• Invoice and payment records
• Banking and factoring information (processed through third-party payment processors)

3.4 Communications Data

• In-app messages between dispatchers and drivers
• Email correspondence with our support team
• Support tickets and chat logs
• SMS messages sent through integrated providers (e.g., Twilio)

3.5 Technical and Usage Data

• IP address
• Browser type and version
• Operating system and device identifiers
• Pages visited, features used, and timestamps
• Cookies and similar technologies (see Section 10)
• Log files and error reports

3.6 Uploaded Content

• Compliance documents (licenses, certificates, insurance)
• Photographs of proof-of-delivery receipts
• Profile and vehicle images
• Files attached to loads or messages

4. How We Collect Personal Data

We collect personal data in three ways:

1. Directly from you — when you register, update your profile, create loads, upload documents, contact support, or otherwise interact with the Service.
2. Automatically — through cookies, log files, and analytics when you use the Service.
3. From third parties — from integrated services such as ELD providers (Motive, Samsara), load boards (DAT, Truckstop), payment processors (Stripe), and communication providers (Twilio, SendGrid).

5. Legal Basis for Processing

Under Article 5 of the Law of Georgia on Personal Data Protection (and Article 6 of the GDPR where applicable), we process personal data on the following legal bases:

You may withdraw consent at any time by emailing privacy@spirosi.com. Withdrawal does not affect the lawfulness of processing based on consent before the withdrawal.

6. Purposes of Processing

We use personal data to:

• Provide, operate, and maintain the Service
• Authenticate users and secure accounts
• Assign loads, track drivers, and automate dispatch workflows
• Generate rate confirmations, invoices, and compliance reports
• Send transactional notifications (SMS, email, push)
• Process payments and handle billing disputes
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Improve our product through aggregated analytics
• Comply with legal, tax, and regulatory obligations
• Respond to support requests and enforce our Terms of Service

7. Sharing of Personal Data

We do not sell personal data. We share personal data only in the following cases:

7.1 Service Providers (Data Processors)

We share data with trusted third parties who help us operate the Service, under written data-processing agreements:

7.2 Within Your Organization

Data you enter is shared with other authorized users of your carrier account (e.g., dispatchers, administrators).

7.3 Legal and Regulatory

We may disclose data when required by law, court order, or a valid request from Georgian or foreign authorities (including the Personal Data Protection Service of Georgia).

7.4 Business Transfers

If Spirosi is involved in a merger, acquisition, reorganization, or sale of assets, personal data may be transferred as part of the transaction, subject to this Privacy Policy.

8. International Data Transfers

Because Spirosi serves trucking carriers primarily operating in the United States, personal data is transferred to and stored on servers located in the United States and the European Union.

Transfers outside Georgia are carried out in compliance with Article 37 of the Law of Georgia on Personal Data Protection, using:

• Standard contractual clauses with our processors
• Adequacy decisions where recognized
• Your explicit consent, where required

You may request a copy of the safeguards we rely on by emailing privacy@spirosi.com.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described above:

Upon termination of your account, we will delete or anonymize personal data within 90 days, except where longer retention is required by law.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service and improve user experience.

Strictly necessary cookies (no consent required) — authentication, session management, load balancing, CSRF protection.

Functional cookies — language preference, UI state.

Analytics cookies — PostHog or equivalent, used to understand feature usage.

You can control cookies through your browser settings. Disabling strictly necessary cookies will break core Service functionality.

11. Your Rights

Under the Law of Georgia on Personal Data Protection (Articles 12–18) and, where applicable, the GDPR, you have the following rights:

• Right to information — know what data we hold about you
• Right of access — receive a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion in certain cases
• Right to restriction of processing — temporarily halt processing
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest or direct marketing
• Right to withdraw consent — at any time, where consent is the legal basis
• Right not to be subject to automated decision-making — including profiling that produces legal effects
• Right to lodge a complaint with the supervisory authority

To exercise any of these rights, email privacy@spirosi.com. We will respond within 10 business days (or within 1 month under GDPR).

Supervisory Authority in Georgia: Personal Data Protection Service of Georgia (პერსონალურ მონაცემთა დაცვის სამსახური) Website: https://personaldata.ge Address: 7 Nino Ramishvili Street, Tbilisi 0179, Georgia Email: office@personaldata.ge

12. Data Security

We implement technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Password hashing using bcrypt/argon2
• Role-based access control and Row-Level Security in the database
• Multi-factor authentication for administrator accounts
• Regular security audits and vulnerability scanning
• Access logging and anomaly detection
• Staff training and confidentiality agreements
• Incident response procedures

Despite our measures, no system is 100% secure. In the event of a personal data breach, we will notify affected users and the Personal Data Protection Service within 72 hours, as required by law.

13. Children's Privacy

The Service is intended for business use by adults employed by trucking carriers. We do not knowingly collect personal data from individuals under 18. If we learn that we have collected data from a child, we will delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. Continued use of the Service after the effective date constitutes acceptance.

15. Contact

For privacy-related questions, requests, or complaints:

Email: privacy@spirosi.com Postal: Spirosi LLC (ს/კ 404790507), Tbilisi, Georgia Supervisory Authority: Personal Data Protection Service of Georgia — https://personaldata.ge