Privacy Policy

DockLedger is a trading name of Angelo Guedes, a sole trader established in England and Wales, at Office 1899, 60 Tottenham Court Road, Fitzrovia, London W1T 2EW, United Kingdom.

Being a sole trader changes nothing about your rights under UK GDPR: the same obligations, the same deadlines, and the same right to complain to the regulator.

For anything in this policy, including a privacy or security concern or a request about your data, write to security@dockledger.co.uk. We acknowledge security reports within 2 working days, aim to answer everything else within five working days, and answer formal data protection requests within one month. For help using DockLedger, write to hello@dockledger.co.uk.

We pay the data protection fee to the Information Commissioner’s Office. Our registration number is ZC231614, and you can check it on the ICO’s public register.

UK data protection law splits responsibility in two, and DockLedger sits on both sides of that line depending on which data you mean.

Your account with us: we are the controller

The data about your relationship with DockLedger: the names and work emails of the people who sign up and use the product, billing records, support conversations, and the security logs we keep to spot break-in attempts. We decide how that is handled.

The records you keep in DockLedger: you are the controller, we are the processor

Everything your business puts into the product about its operation: drivers, contacts at carriers, suppliers and customers, your own staff, bookings, paperwork, signatures and vehicle positions. You decide what goes in, why, and how long it stays. We act only on your instructions, under the processor agreement that forms part of our terms.

If you are a driver or a contact of one of our customers, that customer is responsible for your data. Section 12 explains how to ask for a copy, or for it to be erased.

Live view: the live view shows owners, managers and office staff where colleagues last scanned, picked, put away or counted on the site plan; each of those positions is kept for 30 days. When a shift started and ended is kept with the workspace’s records, so the site can see hours worked, and is deleted with the workspace. The time a phone last checked in during a shift is cleared when the shift ends.

Waitlist: if you join the waitlist, we keep your email address, and your company and note if you give them, only to tell you when you can start, and for nothing else. We delete it 30 days after we invite you, or 12 months after you joined if we have not.

Free trials and trusted browsers: to stop the same business taking repeated free trials, we keep a scrambled fingerprint of each sign-up (a hash that cannot be turned back into the details) for 12 months. If you trust a browser for two-step sign-in, we remember it until the trust ends or you remove it, and delete that record 30 days later. The sign-in it let through is deleted a day after that sign-in expires.

Where it comes from. Most of it comes from you and your staff as they use DockLedger. If a colleague invited you, your name and email came from them. Billing status comes from Stripe. Driver and contact details come from the site’s staff, from the paperwork they photograph, or from the driver at check-in. Vehicle positions come from the carrier’s telematics account or from the driver’s own phone.

• Database and files: Supabase, in London (eu-west-2). This is where your records live.
• The website and its server functions: Vercel. Since 27 September 2026 the server functions run in London. Pages that are the same for everyone are served from Vercel’s worldwide network and carry no customer data.
• The assistant, support chat and delivery-note reader: processed by Anthropic in the USA, as section 7 explains.
• Error reports: Sentry, in its EU data centre in Germany.
• Email: sent through Resend, in the USA.

The full list of suppliers, and what each one sees, is in section 8.

For the data where we are the controller:

• Contract. We cannot provide the service without your account, your sign-in and your billing state.
• Legitimate interests. Keeping security logs, preventing fraud and abuse, fixing faults from error reports, answering support conversations, and contacting an existing customer about their own account. We have weighed these against the rights of the people involved and consider them proportionate and expected. You can object to any of them (section 12).
• Business contacts we write to. If we email someone at a warehouse or cold store about DockLedger, we use their name, work email address, job title and company, taken from their company’s own website or a business directory. Our legitimate interest is telling businesses about a product they may need. Every such email says where we found the address and how to stop further emails, and if you object we stop for good. We never send these emails to sole traders or partnerships without their consent.
• Legal obligation. Keeping financial records for as long as UK tax law requires, for six years.
• Consent. Google’s advertising cookies on our website, only if you accept them, and product-news emails, only if you tick the box when you sign up. You can withdraw either at any time (sections 12 and 13).

For the records you keep in DockLedger, you decide the lawful basis, because you are the controller.

You need to give us a name and work email to have an account. Without them we cannot provide the service. We share data with the police or a regulator only when the law requires it. If DockLedger is ever sold, your data would pass to the buyer under this same policy, and we would tell you first.

Vehicle positions get their own section, because they are the part of DockLedger most likely to affect someone who has never heard of us: a driver.

A position can reach DockLedger in two ways today.

From a driver’s phone, if they choose

When a driver checks in on their phone, the page offers to share their location for this delivery. It is optional, and saying no changes nothing about the delivery. While it is on, the phone sends its position, direction and speed about every 15 seconds, and every 2 seconds while the vehicle is moving on the site. Sharing stops when the driver switches it off, closes the page, or is signed out at the end of the visit. The booking keeps only the latest position and clears it when the visit ends, or 24 hours after, if the visit is never closed. The site view keeps each position for 14 days, so the site can replay any of the last two weeks, and then deletes it. A site can also ask the phone for its position at check-in to confirm the driver is at the gate (and again if that first check fails); that position is used for the check and not kept.

Separately, the site view keeps when each booked vehicle arrived, went to a bay, loaded and left, under its registration, for 90 days.

From a carrier’s telematics account

A carrier can connect its own telematics account through the haulier portal, using its own credentials. DockLedger cannot connect one on a carrier’s behalf. We receive positions for a vehicle only while it is carrying a booked load to you, and show them on your yard board. We delete these positions after 30 days. The last route we worked out from a vehicle’s position stays on the booking.

What we do not do

We never take a position from a phone unless the driver switches sharing on, apart from the check at the gate described above. There is no background collection and nothing derived from the mobile network. We do not use positions to score or rank drivers.

Tracking of a customer’s own fleet is built but switched off. If we switch it on, we will update this policy and tell you before it starts.

What you and your carriers must do. A vehicle’s position can show what a named driver was doing and where. If you or your carriers use DockLedger to see vehicle positions, you need a lawful basis for it, and drivers need to be told it is happening. We recommend the carrier tells its drivers in writing before connecting. We can supply wording if it helps: email us.

The console assistant

When you ask the console assistant a question, we send Anthropic your question and the workspace figures for the screen in view: counts, references, times, carriers and bays. Before the call we remove driver names, phone numbers, vehicle registrations and trailer numbers, signatures, positions and email addresses. The names of your own staff can still be sent where the screen shows who is doing what, and so can any job title a signer typed. Your question is sent as you typed it, and phone numbers typed into notes are not removed.

We do not store the conversation. It lives in your browser tab and is gone when you close it. We keep only a monthly count of questions, for your plan’s allowance.

Support chat

When you use the Help panel or the support page, the text you type, and for a signed-in user their role and their workspace’s plan, is sent to Anthropic to draft an answer from our own documentation. If the assistant cannot answer, or you ask for a person, the conversation is passed to someone at DockLedger, who reads it and replies. We may email that reply to you. We keep support conversations as section 11 describes.

Reading and reconciling a delivery note

When a checker photographs a delivery note or CMR (or someone in the office uploads it as a PDF) and asks DockLedger to read it, the photo or PDF is sent to Anthropic, which returns the lines it can read. We keep that reading with the delivery, beside the photo, and our own database, not Anthropic, reconciles it against the order, the declared lines and the count; nothing it read becomes a line of the delivery, and your checker decides every difference. The reading, the reconciled sheet and the checker’s decisions are kept with the delivery’s record for as long as the booking is kept, and deleted with it. The photo itself stays in your workspace like any other paperwork. On an appliance nothing is sent unless its owner switches reading on with their own key.

Anthropic

Anthropic processes this in the USA. Under Anthropic’s terms for businesses using its service, what we send is not used to train models. Section 8 explains how the transfer is covered. Please do not type personal details about other people into the assistant or the support chat unless you need to.

We use a small number of specialist suppliers. Most handle data only on our instructions, under a written contract that requires them to protect it. Three work differently. Stripe, as merchant of record, handles payments under its own privacy policy. Xero and Sage are your own accounts, which you choose to connect.

We will email account owners at least 30 days before we add or replace a supplier that handles your records, so you have time to object.

Accounting systems you connect

Xero and Sage appear above only because you can choose to connect them. When you do, DockLedger exchanges the contacts, invoices and product codes you choose to sync with your own account there, on your instruction. The access tokens are held encrypted in our database vault and deleted when you disconnect or your workspace is deleted. Sync logs are deleted after 90 days.

Data sent outside the UK

Your records are stored in the UK. Sentry (Germany) and TomTom (the Netherlands) are in countries the UK recognises as protecting data to its own standard. Anthropic, Resend and Stripe are in the USA. The transfers to Anthropic and Resend are covered by the EU standard contractual clauses with the UK Addendum, which form part of Anthropic’s and Resend’s data processing terms. Stripe, and Google’s, Cloudflare’s and Vercel’s worldwide networks, are covered either by the UK–US data bridge, where the supplier is certified under it, or by the EU standard contractual clauses with the UK Addendum. You can ask us for a copy of the safeguard for any supplier.

• Separation is enforced by the database, not the screen. Every table carries row-level security rules, so a request for another company’s records returns nothing, even if someone bypasses the app and calls the database directly.
• Encrypted in transit and at rest. HTTPS everywhere; the database and file storage are encrypted on disk.
• Passwords are hashed, never stored in a form anyone could read. Credentials for other systems, such as a carrier’s telematics key or your Xero connection, are held in an encrypted vault that no one can read back from the app.
• Access by role. Checkers can record deliveries but cannot see billing. Only the account owner can.
• Paperwork photographs are private. In DockLedger they are shown through links that expire after one hour. When you send a supplier a claim, the email carries links to its photographs that work for seven days.
• Backups. Supabase takes daily backups of the database. Every night we also make a copy of the database and the stored files, encrypted before it leaves the backup job, and keep it in a private Google Drive.

Who at DockLedger can see what

• Our support desk reads support conversations, from every customer, so it can answer them.
• The owner of DockLedger sees a summary of each workspace: its plan, when people last signed in, activity counts, the state of connected systems, and open support tickets.
• Nobody at DockLedger reads your records in the normal course of things. The people and tools we use to build and run DockLedger, including AI assistants, do not access customer records: they work only on the structure of the database, on demo workspaces and on data with the personal details removed. For AI assistants this is enforced by access controls, not only by our rule: the only route they are given to the live database is read-only and shows a customer’s workspace as counts, never its contents. The owner opens a customer’s records only to fix a problem, to act on that customer’s instructions, to investigate a security incident, or when the law requires it.

If something goes wrong

No system is perfect. If we become aware of a breach affecting your data, we will tell affected customers without undue delay, and within 72 hours of becoming aware: what happened, what data was involved, what we have done, and what you should do. We will report it to the ICO where the law requires.

A site that uses DockLedger can send a haulier a private link to its portal. The link is the key: anyone who has it can see that haulier’s bookings with the site, including driver names and phone numbers. Please do not forward it. If it has been shared by mistake, ask the site for a new one.

When you open the link, the page removes it from the address bar straight away, so it does not sit in your browser history. It is kept only in that browser tab until you close it. Links issued since September 2026 expire after 90 days unless the site renews them.

• While you are a customer, your records stay for as long as your workspace is open, because deleting your delivery history is your decision, not ours.
• Deleting your workspace. An owner can ask for the workspace to be deleted at any time: open the account menu in the console, then Your workspaces. Everyone in the workspace sees the date, and any owner can cancel it within 7 days. We then delete it within 30 days of the request. If nobody asks, we delete it no later than 90 days after your subscription ends. The only exceptions are our own billing records for your account, which UK tax law requires us to keep, and any records you have asked us in writing to keep. We keep a list of the stored files we removed, with the workspace’s name for 90 days, as proof that they went. This applies to the service at dockledger.app. If you run DockLedger on your own server (an appliance), your data is only on that server and we hold no copy of it. You delete it by deleting the virtual machine and its backups. We keep only the appliance’s licence record.
• Proof of delivery and traceability records stay in your workspace for as long as it is open; nothing deletes them on a timer. If your workspace is deleted they are deleted with it, so export them first if you need to keep them. Most contract claims in England and Wales can be brought for up to six years, so you may want to keep them that long.
• Paperwork readings, the reconciled sheet and the checker’s decisions on it are kept with the delivery’s record for as long as the booking is kept, and deleted with it.
• Your account details (the names and work emails of your users) are kept while your workspace is open and deleted with it.
• Vehicle positions from a carrier’s telematics account are deleted after 30 days. Positions a driver shares from their phone are kept for 14 days, so the site view can replay any of the last two weeks, and then deleted. The booking itself holds only the latest one, and clears it when the visit ends, or 24 hours after, if the visit is never closed.
• Vehicle stages on site (arrived, at a bay, loading, left), under the vehicle’s registration: 90 days.
• Waitlist addresses: 30 days after the invitation, or 12 months after joining.
• Sign-up fingerprints: 12 months. Trusted browsers for two-step sign-in: 30 days after the trust ends or is removed. Trusted sign-ins: a day after they expire.
• Billing records are kept for six years, because UK tax law requires it.
• Support conversations close by themselves after 60 days with no new message, and are deleted 12 months after they close.
• Rate-limit counts, which include the caller’s network address, are deleted within 48 hours. A count that turned a caller away is kept for 8 days so we can see the pattern.
• Failed sign-ins: the email typed, the caller’s network address and browser, kept 90 days so we can spot password guessing. We never check whether the email belongs to an account.
• Security alerts we sent ourselves, keyed by the email address or incident they were about, are kept 90 days.
• Hosting logs. Our hosting providers keep request and sign-in logs, which include your IP address, for a short time: Supabase for 7 days and Vercel for up to 30 days. Cloudflare, which checks forms for bots, does not publish a period.
• Error reports are deleted by Sentry at the end of its retention period, which is no more than 90 days.
• Assistant usage counts are kept while your workspace is open.
• A driver’s or contact’s details. A driver or a contact can ask the site they delivered to for their details to be erased. If they write to us instead, we pass the request to that site within 5 working days. Once the site tells us to go ahead, we erase the details within 30 days. If the law requires a delivery record to be kept, we keep the record and remove everything else we can. The site’s owner can also do this themselves, under Settings, Company: it removes the driver’s phone number and name from that site’s deliveries, portal links, office messages and delivery-note readings, and keeps the deliveries. A portal link lets go of the driver’s name and phone 30 days after it stops working.
• Your own login. Anyone with a DockLedger login can delete it themselves under Settings, Profile. That removes the email address, password, photo, two-step sign-in and trusted devices, and leaves every workspace. Their name stays on work they recorded for a business, because those records belong to the business; the business’s owner can remove it on request.
• Backups. Supabase takes a backup of the database every day and keeps each one for about a week. Every night we also make an encrypted copy of the database and the stored files in a private Google Drive. No time limit is in force for those copies yet, so for now they are kept until one is. Three older copies of the database, taken by hand in August and September 2026, are no longer in our Google Drive.

Anyone whose personal data we hold has the right to:

• see it and get a copy;
• have it corrected if it is wrong;
• have it erased, where there is no reason we must keep it;
• restrict what we do with it, or object to what we do on the basis of legitimate interests;
• receive it in a common, machine-readable format, to take elsewhere.

Email security@dockledger.co.uk. There is no charge, and we will respond within one month.

If you are a driver, or a contact or employee of one of our customers, that customer decides what is stored about you, so your request usually goes to them. You can write to us instead, and we will pass it to them within 5 working days and help them answer.

We make no decisions about people by automated means that have a legal or similarly significant effect on them. Carrier scores rate carrier companies, not individual drivers.

If you think we have got it wrong, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, so we can put it right.

The pages of our website that tell you about DockLedger, such as the homepage, pricing, the manual and this policy, set no cookies of their own. The one exception is Google’s advertising cookies, and only if you accept them.

Google’s advertising cookies, with your consent

These pages carry the Google Ads tag (AW-18496133398). With your consent it sets Google’s advertising cookies, which tell us which of our adverts bring visitors to the site. They are not used to change what you see here. The first time you visit, a banner asks you to accept or decline, and neither is chosen for you.

The sign-up page carries the same tag, under the same choice. If you have accepted, starting a trial there also tells Google Ads that a trial was started, so we can see which adverts lead to one. Nothing you type into the form goes with it: no name, email address or company. The only other thing sent is a random reference made for that one sign-up and kept nowhere. It is not your account’s, so Google cannot tie the trial to your account with it.

Until you accept, nothing is sent to Google: your browser does not even fetch the tag, so Google gets no cookie, no signal and no IP address from these pages. If you decline, it stays that way. Declining changes nothing else: the site works the same either way.

If you accept and later change your mind, Google stops reading and setting its cookies from that moment. Cookies it set while you had accepted stay in your browser until they expire or you clear them in your browser’s settings.

Your choice is kept in your browser’s storage on this device for six months, and then we ask again. You can change it at any time from “Cookie choices” at the foot of these pages. For what its cookies collect, Google is a controller in its own right, and Google’s privacy policy applies to it.

Page views and three steps, counted without cookies

Page views on the website, the portals, the console, the floor apps and the driver check-in page are counted by our hosting provider, Vercel, so we can see which pages are used. For each one it receives the page’s address without its query (the part after a question mark, where links carry their codes), the page you came from, your browser, the type of device and the country. To tell one visit from another it makes a hash from your IP address and browser, a new one each day, and it does not keep your IP address itself.

It also counts three steps, by name only: starting the sign-up form, finishing it, and sending a message from the support page. Nothing you type goes with them, not your name, your email address or your message, so we can see how many people get from one step to the next without knowing who they are.

No cookie is set and nothing is stored on your device for it, so it is not part of the cookie choice above. If you would rather not be counted, the button below stops it on this device. It keeps that one choice in this browser’s storage, so it lasts until you press it again or clear the site’s data.

What the product keeps so it works

Everything below is strictly necessary, so the UK’s cookie rules (the Privacy and Electronic Communications Regulations) do not require consent for it. None of it is used to follow you on other sites.

• The console keeps your sign-in session in a cookie and in browser storage, so you are not asked to sign in on every page. That cookie is essential: without it you could not stay signed in. It also remembers settings such as light or dark mode.
• The floor apps on warehouse phones and tablets keep work waiting to be sent when there is no signal, including photographs, which can show signatures. They also keep the signed-in profile, printer and scale settings, and a working copy of the lists they need offline, such as customer and haulier names, loading runs and despatches. That copy is cleared when you sign out and is not used after 24 hours. Work not yet sent stays on the device, belongs to the person who did it, and is sent only when they sign in again.
• The Help panel keeps a random visitor identifier, so your conversation can continue, and the time of the last reply you have seen.
• The haulier portal keeps its link in that browser tab until you close it (section 10).
• The driver check-in page remembers the language you picked and keeps a code for your visit, so the page picks up where it left off if you reload it.
• The wallboard and the customer ordering portal keep their link in that browser tab until it is closed, and a bench station keeps a device identifier so it keeps its licence.
• Cloudflare Turnstile, the bot check on sign-in pages and the support form, may set a short-lived security cookie.

If we ever add anything else that is not strictly necessary, it will be off until you switch it on, and this section will say so.

The date at the top of this page is the version of this policy. If we change it in a way that materially affects you, we will email the account owner before the change takes effect.