Privacy & Data Processing Policy
1. Introduction
King Karom Inc., a New York corporation that operates THENEKAS (“THENEKAS,” “we,” “our,” or “us”), provides an online platform of software tools for freight dispatchers, carriers, owner-operators and other transportation professionals (the “Platform”). The Platform helps users analyze operational data, extract information from transportation documents such as rate confirmations, estimate the profitability of loads and perform related business tasks.
Because the Platform may process business documents and operational information that contain personal information and confidential business data, we take privacy and security seriously.
This Privacy & Data Processing Policy (“Policy”) explains how we collect, use, disclose, process, store, protect and transfer information when you access or use the Platform, including our:
- website at thenekas.com and its subdomains;
- web applications and tools, including Analytics, Dispatch Info and the Load Profit Calculator;
- accounts, companies and team features;
- AI-powered features;
- integrations with third-party services;
- APIs; and
- any other products or services that link to this Policy (collectively, the “Services”).
By accessing or using the Platform, you acknowledge that you have read and understood this Policy and you consent to the collection, use, processing, storage and transfer of your information as described in it. If you do not agree with this Policy, do not use the Platform.
This Policy is part of, and should be read together with, our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.
2. Our Privacy Principles
Customer ownership. Customers retain their rights in Customer Data. We do not acquire ownership of Customer Data by providing the Platform, and we process it only to provide the Platform and as described in this Policy.
Local processing where possible. Where a feature can work entirely in your browser, we design it that way, so that the information never reaches our servers.
Data minimization. We try to collect only the information reasonably necessary to operate, secure, maintain and improve the Platform.
Transparency. We explain what we collect, why, and who processes it.
No sale of data. We do not sell Personal Information or Customer Data, and we do not use them for advertising.
Responsible AI. AI is used only to provide the functionality you request. We do not use Customer Data or Google user data to train generalized artificial intelligence or machine learning models.
3. Scope
This Policy applies to:
- visitors to our website;
- users of the Platform, with or without an Account;
- Customers and Administrators who manage Companies;
- individuals whose information is contained in Customer Data submitted by our users (for example, brokers, shippers, receivers and drivers named in a rate confirmation); and
- individuals who communicate with us.
This Policy does not apply to information processed by independent third-party products and services that have their own privacy policies, such as Google, Microsoft, electronic logging device and telematics providers, load boards or payment providers, even if they are integrated with the Platform.
4. Definitions
Account means a registered user account used to access the Platform.
AI Services means features of the Platform that use artificial intelligence, including extraction of information from documents, classification and summarization.
Customer means an individual or legal entity that registers for, accesses or uses the Platform.
Customer Data means all information, files, documents, spreadsheets, records, addresses, prompts and other content submitted to, uploaded to, transmitted through or processed by the Platform by or on behalf of a Customer. Customer Data may contain Business Data and Personal Information.
Business Data means commercial and operational information, including load details, freight rates, rate confirmations, lanes, miles, invoices, settlements and similar records.
Personal Information means information that identifies, relates to, describes, or is reasonably capable of being associated with or linked to an identified or identifiable individual, as defined under applicable law.
Platform and Services mean all websites, applications, tools, APIs, AI Services, integrations and related technologies operated by THENEKAS.
5. Information We Collect
The information we collect depends on the features you use, the permissions you grant and the integrations you enable.
5.1 Information that stays in your browser
Some features process information only on your device and do not send it to our servers:
- Analytics files. CSV, XLSX and XLS files you open in Analytics are read and analyzed by code running in your browser. The contents of these files are not uploaded to THENEKAS.
- Preferences. Your theme, the column mapping you selected for a spreadsheet and the values you enter in the Load Profit Calculator are stored in your browser’s local storage so they are available next time.
We do not have access to this information. You can remove it at any time by clearing site data in your browser.
5.2 Account information
When you create or manage an Account, we may collect:
- your name and email address;
- your profile picture, if provided by your sign-in provider, or a photo you upload;
- profile details you choose to add: first and last name, job title and phone number;
- if you sign in with Google or Microsoft: the unique account identifier, name, email address and profile picture that the provider shares with us (we do not receive your Google or Microsoft password);
- if you sign in with your email address or phone number: your password, which we never store as written: we keep only a salted, key-strengthened one-way hash of it (PBKDF2 with a secret key), and the one-time code we send to your email or by text for each sign-in, stored only as a keyed hash until it is used or expires. When you choose a password, we check whether it appears in known data breaches with the Have I Been Pwned service: only the first 5 characters of a one-way hash of the password are sent, never the password, so the service cannot learn it;
- if you sign in with your phone number: the phone number, which becomes a sign-in method of your Account. The one-time code is texted and checked by Google Firebase Authentication (see section 11.1); we receive only a signed confirmation that you entered the right code for that number. An Account created only by phone has no email address;
- invitations to join a Company sent to your email address or phone number, including the person’s card they are linked to. Invitations by phone are texted by the person who invites you, from their own phone; we do not send them;
- Company details entered by its Administrators (company name, MC and USDOT numbers, phone, email, address and logo), your position and permissions, the members of your Company, and invitations you send or receive (including the email addresses of the people invited);
- session information, including when you signed in, your IP address and your browser type;
- if your Company verifies itself with FMCSA: the USDOT and MC numbers entered, the public FMCSA record we read for them (legal name, address, phone, operating status) and the email address and phone number FMCSA has on file for the carrier, to which we send a one-time code (by email, stored hashed; or by text message, sent and checked by Google Firebase); the person asking confirms they are authorized to act for the carrier, and we record that statement in the Company’s activity log;
- if a Company’s owner connects an outside service in Connections (for example an ELD provider): the API key the owner enters, stored encrypted; afterwards only its last 4 characters are shown;
- if a Company’s owner connects QuickBooks Online: the access that Intuit grants us after the owner approves it in QuickBooks (access and refresh tokens, stored encrypted), the QuickBooks company identifier and name, and the last error QuickBooks returned with its reference number. We never see the owner’s QuickBooks password;
- passkeys you add: the public key, a counter, the device name (for example “Chrome on Mac”) and when it was added and last used. The private key and your fingerprint or face data never leave your device and are never sent to us;
- devices you signed in from: a random identifier kept in a cookie on your device, or created by our mobile app when it is installed (we store only its hash), with the browser type or the device model the app reports, and dates, so we can email you when your account is used on a new device and list your devices in Settings;
- the countries you signed in from (the two-letter country code our hosting provider derives from the connection, not your address or precise location) and when each was first seen, to detect sign-ins to administrator accounts from a new country;
- records of the version of the Terms of Service and this Policy you accepted, when you accepted them, and the IP address and browser type used; and
- if paid features are introduced: subscription status, billing history and billing contact details (payment card numbers are processed by our payment processor and are not stored by us).
5.3 Documents and Customer Data you submit
When you use features that process documents, such as Dispatch Info, the document you choose (for example, a rate confirmation PDF) is sent to our servers and to our AI provider to extract information. Such documents may contain:
- load, shipment and reference numbers;
- pickup and delivery locations, dates and appointment times;
- freight descriptions, weights, temperatures and equipment requirements;
- rates, accessorials and payment terms;
- names, phone numbers and email addresses of broker representatives, shippers, receivers, dispatchers and drivers;
- carrier and broker company names, MC and DOT numbers; and
- special instructions and other information included in the document.
We process this information only to provide the requested feature. If you only read a document in Dispatch Info, it is processed in memory and not stored by THENEKAS after the result is returned to you. If you are signed in and choose to save it (for example, “Save to Loads”), the document and the extracted details are stored in your Company’s workspace, as described in Section 5.4.
5.4 Company workspace data
When you or other members of your Company use the workspace, we store what you save there:
- loads: load and PO numbers, brokers and broker contacts, the dispatcher handling the load, the actual delivery date, pickup, drop and deadhead locations and dates, rates, miles, equipment, weight, commodity, driver and truck names, notes and load sheets;
- documents you upload or save, such as rate confirmations, bills of lading, proofs of delivery, invoices and lumper receipts (PDF files and photos);
- people cards: the Company’s record of the people who work for it or drive for it, such as first and last name, position (for example owner, dispatcher, accountant, safety or driver), status (active or former; for drivers also applicant, hired or terminated), hire and leaving dates, a work phone and email, and which dispatcher a driver works with. Driver cards may also hold the driver type, who the driver is paid through and the pay rate, the truck and trailer, the CDL number and state, a photo or scan of the CDL that the Company uploads, the address the driver is paid at, the share of pay that goes to a co-driver, and compliance dates (CDL and medical card expiry, last MVR, the date of a pre-employment drug test — never its result — and the last Clearinghouse query). A card may be linked to a member’s Account; a card can also exist for someone without an Account, such as a driver;
- trucks and trailers: unit numbers, VIN, year, make, model, license plates, ELD provider and ID, ownership, status, inspection and registration dates, notes, and papers you upload such as registrations, inspection reports and repair invoices;
- billing and pay: charges on loads (such as detention or lumper), invoices the Company creates (PDF files saved with the load), the Company’s factoring company name, email and remit-to address and payment terms, and driver settlements (amounts per load, fuel, tolls, recurring and per-mile deductions such as truck lease or insurance, installments, additions, the co-driver’s share, other people or businesses paid from a driver’s loads (such as a truck owner or a dispatcher) with their name and share, settlement numbers and paid dates), the Company’s expenses (date, amount, category, vendor or payee, description, the driver, truck or load they relate to, receipts, and schedules of recurring ones such as monthly insurance), and for fuel-tax (IFTA) reports the miles each load drove in each state (counted from its route on the map) and fuel purchases (date, state, gallons, amount, truck) imported from fuel-card files or typed in;
- emails the Company sends through the Platform: invoices and factoring packets to brokers or factoring companies, and load sheets to drivers. We send them from noreply@thenekas.com in the Company’s name, with replies going to the sender; we keep the recipients, the time and what was attached in the Company’s activity log, not the email itself;
- an activity log of the Company: who created or changed loads, documents, people cards, positions, invitations and the Company profile, what changed (before and after) and when. The log cannot be edited or deleted by anyone in the Company;
- statements confirmed in the workspace: that the person creating or verifying the Company is authorized to act for it, and the Company’s statement that it has told its drivers it keeps their information here and has their permission where the law requires it (who confirmed, when and the text, in the activity log).
This data belongs to the Company and is visible to its members according to their positions. Files are stored privately and are served only to signed-in members of that Company. Companies must not enter Social Security numbers, drug or alcohol test results, medical records, biometric information, immigration documents, or individuals’ full bank or card numbers in people cards or any other field or file (Terms of Service, Section 15.3). THENEKAS keeps each Company’s data separate: we never pass one Company’s records about a driver or anyone else to another Company, and we do not provide background, employment history or screening reports.
When you leave a Company or delete your Account. Your card in a Company stays with that Company as a “former” member, with your name, position and dates, so that its loads and activity log keep showing who did what. It is no longer linked to your Account and you lose access to the Company’s data. If you delete your Account, we also remove the phone number and email address from your cards. The Company’s activity log entries about your actions stay with the Company until the Company is deleted.
5.4b Drivers and staff: the Company’s card and your own Account
If you drive or work for a Company that uses THENEKAS, the Company may keep a card about you before you ever sign in, for example when it hires you or imports its driver list. That card is the Company’s record: the Company decides what goes on it, is responsible for telling you about it and asking your permission where the law requires, and controls it (we process it for the Company as its service provider). If you accept the Company’s invitation, your Account is linked to that card. Your Account (sign-in details, profile) is yours; you can delete it at any time. The card and the Company’s records about your work stay with the Company, as described above. For a copy, a correction or the deletion of what a Company keeps about you, ask that Company; if you write to us, we will pass your request to the Company and help it respond. For your own Account, write to us.
Information that a Company imports from its files or from services it connects (for example an ELD, a fuel card or QuickBooks) is stored as the source provides it; we do not change or check it. THENEKAS is not an electronic logging device; the location we receive from the driver app is described in Section 5.5 (truck routes, navigation and load tracking).
5.4a Driver app
Drivers invited by their Company can sign in to the driver app. A driver sees only the loads their Company assigned to them (stops, dates, load sheet), can mark a load on the way, picked up or delivered, can mark when they arrived at and finished loading or unloading at each pickup and drop (the time their phone shows when they tap, and the time it reached us; no GPS location is collected), can upload photos to those loads and to a pickup or drop (bills of lading, proofs of delivery, lumper receipts, seals, reefer temperature, cargo, scale tickets, damage) and sees whether the Company approved each photo or asked for it again (with the Company’s note), and can download their own closed settlements. Everything a driver does is recorded in the Company’s activity log under the driver’s card. Drivers do not see rates, invoices, rate confirmations or other drivers’ data.
5.5 Location and address information
When you use mapping, place search, routing and mileage features on the website, the addresses, cities, ZIP codes and places you enter, and the routes you build, are sent to HERE Technologies to show suggestions, the map, routes and distances. The map on the Load Profit Calculator is drawn from HERE map data that our servers fetch from HERE; HERE does not receive who is looking, and we only count map requests per visitor or Account for usage limits, without keeping which area you looked at. The website does not request access to your device’s location.
Map feature (truck routes). When a driver or a Company member builds a truck route, our servers send HERE Technologies the route points as map coordinates or as the address text typed (the load’s pickup and delivery addresses or the places entered and, when the driver asks for a route from where they are, the phone’s position) and the vehicle’s numbers (height, width, length, weight, axles, trailer, hazardous-materials flag) to get truck routes, restrictions, tolls, and the fuel stations and prices along the route. No name, phone number, email or company name is sent. In the driver app, if the driver allows location access and asks for a route from where they are, the phone’s position at that moment is sent as the route’s starting point. While the driver uses turn-by-turn navigation (“Go”), the app reads the phone’s position continuously on the phone, also with the screen off, to show progress and give directions; that position stays on the phone except when the driver leaves the route and the app asks our servers for a new route from where the truck is (that position is then sent to HERE as the new start, like any route). Navigation's own use of location stops when navigation ends. Load tracking, described next, is separate. We keep each route answer, including its points, for 30 days so the driver can open it again, then delete it.
Load tracking. While a load assigned to a driver is on its way (from the driver’s “On my way” until the load is delivered, cancelled or taken off the driver), the driver app sends the phone’s position (latitude, longitude, time, speed, heading and accuracy) every few minutes, also when the app is in the background, if the driver allowed location access. We use it only for that load: to show the Company where the truck is, to note arrival at and departure from the load’s stops, and to estimate the arrival time with HERE Technologies (our servers send HERE the last position and the next stop’s point; no name or company). We geocode the stops’ addresses with HERE for this. The Company may share a tracking link for the load with its customer (for example the broker); anyone holding the link sees the load’s stops, statuses, times, the estimated arrival and the truck’s last position (rounded to about a mile while it is far from the next stop), never the driver’s name, phone, the rate or the load’s documents. The link stops working when the Company turns it off or 72 hours after delivery. We do not take positions when no load is on its way, and a driver can always turn off location access in the phone’s settings; the Company then sees that tracking is off. Positions are kept 90 days, then deleted (the stop times and the load’s summary stay with the load). Precise geolocation is sensitive personal information: we use it only for the purposes above and never sell or share it for advertising. The Company decides to track its loads and must tell its drivers (Terms of Service, Section 10.4).
Weather, places and road details on a route. To show weather alerts along a route the driver opens, our servers send points along that route, rounded to about 1 km, to the US National Weather Service (api.weather.gov); nothing else is sent (no name, Account or Company). The places shown in the map (truck stops, fuel, weigh stations, parking, rest areas and similar) come from OpenStreetMap, which our servers read on their own schedule without any user data, and from HERE (truck stops, truck parking, rest areas, truck washes and repair, and, when a driver picks those categories, hotels, restaurants, stores, gyms and truck dealers): when a signed-in user views a small map area, our servers ask HERE for such places in that area by its corners only (no user data) and keep HERE’s answer for up to 30 days; see Map data sources. When a signed-in user reports a place’s state (parking, weigh station, diesel price) or rates and reviews a place, we store it with their Account and the time; others see only the combined status, the rating and the review text, never who posted it. Reports are deleted from view when they expire (parking 1 hour, weigh stations 30 minutes, prices 24 hours); a review stays until its author deletes it, we remove it, or the Account is deleted. Road reports (the map’s “!” button: police, an accident, a closure, a hazard, construction, slow traffic) keep the type, the point on the map the driver chose and the time, with the Account; other drivers see the report and how many confirmed it, never who posted or voted; it is deleted a day after it ends. Messages between a Company’s office and its drivers are the Company’s data (Section 5.4): the text, who sent it (name frozen in the message) and the time are kept while the Company exists and are visible to the driver and the Company’s staff; deleting your Account removes the link to it, not the Company’s copy of the messages. When a signed-in user opens a place, our servers may ask HERE for that place’s phone, website and hours by its name and location only (nothing about the user) and keep HERE’s answer for up to 30 days. Grades and speed limits along a route come from the same HERE route answer described above. Road events (accidents, closures, construction) are fetched by our servers from HERE and from state transportation departments’ 511 services (Ohio, Georgia, Arizona, Utah, Wisconsin) for the map area being viewed or the whole state (no user data); traffic camera pictures (Caltrans and those state departments) are fetched by our servers, so the camera operators never see who is looking.
Address search, map picture and saved places. When you type an address or a place in the driver app’s map, our servers send the text typed (and, to show nearby results first, the map’s position) to HERE to get suggestions and the chosen place’s location. When you choose a point on the map (“Choose on map”), its coordinates are sent to HERE to find the address there. The map picture is drawn on the phone from HERE map data that our servers fetch from HERE; HERE does not receive who is looking, and we only count map requests per Account for usage limits, without keeping which area you looked at. Voice search uses Apple’s speech recognition on the iPhone itself: the recording is not sent to us or to Apple, and only the recognised text is used as a search. Places you save (for example “Home” or “Yard”: a name you choose, the address and its coordinates) are stored with your Account so you can route to them on any device; they are not shown to your Company, and they are deleted when you delete them or your Account. Routes you save (a name you choose and the route’s points: names, addresses and coordinates of its start, stops and destination) are kept the same way; the route itself is built again when you open one. Recent searches are kept only on your phone and are erased when you sign out. HERE processes what it receives under the HERE Privacy Policy; the terms that apply to HERE data are in Section 10.1 of our Terms of Service.
5.6 Integration data
If you choose to connect a third-party service (for example, an electronic logging device or telematics provider, or QuickBooks Online), we may receive the information you authorize that service to share, which may include:
- vehicle, truck and trailer identifiers;
- driver names and assignments;
- vehicle location, trip history and hours-of-service status;
- spreadsheet contents from files you select; and
- other data made available by the integration within the permissions you grant.
If your Company connects QuickBooks Online, we read the information needed to send records to it (such as the QuickBooks company name, accounts, customers and vendors) and may send to that Company’s QuickBooks the records its users choose to sync, such as customers (brokers and shippers), vendors (including drivers and payees), invoices, payments received, bills or expenses for driver pay, and other expenses, together with the amounts, dates and descriptions on them. Intuit then handles that information under its own privacy policy.
We access integration data only as you authorize and only to provide the requested functionality. You can disconnect an integration at any time; disconnecting QuickBooks revokes our access at Intuit and deletes the tokens we stored.
5.6a Email a Company forwards to THENEKAS
Each Company gets its own receiving address on thenekas.com. A member adds, in THENEKAS, the mailboxes (Gmail, Outlook or another service) they will forward from, and proves each one by typing a code we email to it (no code is needed for the email the member signs in with); then they may set that mailbox to forward messages to the address, including all of its incoming mail. We do not connect to or read anyone’s mailbox: we receive only what is forwarded or sent to that address. A message that does not come from a mailbox a member added and proved is returned to the sender and not stored. Mail is personal: a message is shown only to the members who added the mailbox it came from, until one of them attaches it to a load or makes a load from it; then everyone in the Company who can see that load can see it. On arrival, an automatic check (no AI, no person) looks for signs that a message concerns loads (attachments such as PDFs or photos, words used for loads and freight, or a reply in a conversation we already keep for the Company). A message without those signs is not sent to our AI provider unless a member asks to make a load from it, and is deleted 30 days after it arrives unless it is attached to a load. For the messages we keep, we store what they contain: the sender, recipients and copies (names and email addresses of brokers, their staff and the Company’s staff), subject, date, message identifiers, text and attachments, and the result of the sender checks (SPF, DKIM, DMARC) done by our email provider. A message that fails those checks is shown with a warning and is not sent to our AI provider. For each mailbox added we keep its address, who added it and when it was proved; the codes are stored only as one-way hashes and expire after 10 minutes.
To sort a message and prepare a draft load, its text and its attachments are sent to our AI provider (Section 8), which tells us what kind of message it is (for example a rate confirmation, a request for an update or a cancellation), the reference numbers it mentions and, for a rate confirmation, the load details. Nothing becomes a load until a member of the Company reviews the draft and adds it. These messages are the Company’s Customer Data: they are visible to its members as described in our Terms (each member sees the mail of the mailboxes they added and the mail attached to the loads they can see), are recorded in the Company’s activity log when someone adds, rejects, attaches or deletes them, and are never shared with another Company.
When a driver records a stop or sends a paper in the driver app, the load’s dispatcher and the Company’s after-hours staff receive a notification in THENEKAS (the driver’s name, the step, the place and the load number).
5.7 Device, technical and usage information
When you use the Platform, our hosting provider and our systems automatically receive technical information necessary to operate and secure the Platform, which may include:
- IP address and approximate location derived from it (country or region);
- browser type and version, and operating system;
- pages and resources requested, and the date and time of each request;
- referring URL;
- error logs and performance information;
- authentication and security events; and
- usage counts needed to enforce rate limits.
If a Company turns on its list of allowed IP addresses, we compare the IP address of each request from its office users with the addresses and ranges its owner entered, and refuse access to that Company’s data from any other address; the list itself (addresses and labels) is Company data, and changes to it are recorded in the Company’s activity log.
5.8 Communications
If you contact us by email or phone, we collect the content of your communication and your contact details, and we keep them to respond to you and to maintain records of our correspondence.
6. How We Use Information
We use information only for legitimate business purposes, including to:
- provide, operate and maintain the Platform and the features you request;
- create and administer Accounts and Companies, and authenticate users;
- send one-time sign-in codes, security alerts and service-related messages;
- extract information from documents you submit and return results to you;
- calculate miles, routes, costs and other estimates;
- synchronize information with integrations you connect;
- detect, investigate and prevent fraud, abuse, spam, security incidents and violations of our Terms;
- enforce rate limits and protect the availability of the Platform;
- troubleshoot, debug and fix errors;
- understand how the Platform is used in aggregate and improve its reliability, performance and usability;
- keep records of your acceptance of our Terms and this Policy;
- process payments, if paid features are introduced;
- respond to your requests and provide support;
- comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims; and
- enforce our agreements and protect the rights, property and safety of THENEKAS, our users and others.
We do not use Customer Data for purposes incompatible with the purposes for which it was collected.
7. Customer Responsibilities
The Platform is designed for business use, and Customers control what information they submit.
Customers are responsible for:
- ensuring they have all necessary rights, permissions and legal bases to submit Customer Data, including Personal Information of third parties, to the Platform;
- complying with confidentiality terms in their agreements with brokers, shippers, carriers and drivers;
- providing any notices and obtaining any consents required by law for the data they submit; and
- configuring appropriate roles and permissions for Users in their Company.
Where we process Customer Data on behalf of a Customer, the Customer acts as the controller (or equivalent) of that data and THENEKAS acts as a processor or service provider, processing it on the Customer’s instructions as expressed through their use of the Platform. Our commitments as a service provider (no selling or sharing, purposes, subprocessors, help with requests, notice of security incidents) are in the Terms of Service, Section 15.5.
8. Artificial Intelligence Processing
Certain features of the Platform use artificial intelligence. For example, Dispatch Info uses an AI model to read a rate confirmation and extract structured load details.
When you use an AI feature, the relevant Customer Data (such as the document you submit) is sent to our AI provider, currently Google LLC, through Google Cloud’s Vertex AI service (Gemini models). The AI features today: reading a rate confirmation (a PDF, a photo or a screenshot) into a load, and reading a CDL photo uploaded to a driver card to fill in its license number, issuing state and expiry date (only those three fields are kept, and only after the user saves the card). When a driver sends a bill of lading, proof of delivery or lumper receipt from the driver app, the photo and the load’s reference numbers are sent once for an automatic check (readable, signed by the receiver, reference numbers seen and whether they match the load), and the result is kept with that document and shown only to the Company’s office users. Under Google Cloud’s terms for Vertex AI, the data we submit is processed as our customer data under Google’s data processing terms and is not used to train Google’s models without our permission.
AI-generated output is probabilistic and may contain errors or omissions. You are responsible for reviewing it before relying on it, as described in our Terms of Service.
We do not use Customer Data, AI inputs or AI outputs to train generalized artificial intelligence or machine learning models.
9. Google, Microsoft and Productivity Platform Integrations
9.1 Sign-in
If you sign in with Google or Microsoft, we request only basic profile scopes (openid, email and profile) and receive your account identifier, name, email address and profile picture. We use this information only to create and authenticate your Account and to show your name and picture inside THENEKAS. It is kept with your Account and deleted with it.
9.2 Gmail and Outlook mailboxes
THENEKAS does not connect to Gmail or Outlook mailboxes and asks Google and Microsoft for no mail permissions. Mail reaches THENEKAS only when a member forwards it to their Company’s address (Section 5.6a).
9.3 Google API Services User Data Policy — Limited Use
THENEKAS’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, THENEKAS:
- uses Google user data only to provide and improve the user-facing features that you request and that are prominent in the Platform;
- does not sell Google user data;
- does not use or transfer Google user data for serving advertisements, including retargeting, personalized or interest-based advertising;
- does not use Google user data to determine creditworthiness or for lending purposes;
- does not transfer Google user data to third parties, except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users;
- does not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models; and
- does not allow humans to read Google user data, unless we have your affirmative agreement for specific messages or files, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations.
You can revoke THENEKAS’s access to your Google account at any time from your Google Account security settings. To request deletion of Google user data we store, email contact@thenekas.com; we will delete it within 30 days unless the law requires us to keep it.
9.4 Microsoft
If you sign in with Microsoft, you can revoke THENEKAS’s access at any time from your Microsoft account or organization settings.
10. Third-Party Integrations
Customers may choose to connect third-party services to the Platform. We access information from these services only as authorized by the Customer and only to provide the requested functionality. Each third-party provider has its own terms and privacy practices, and we are not responsible for them.
Only a Company’s owner can connect or disconnect a service. The API key the owner enters is encrypted before it is stored, is never shown again (only its last 4 characters), and is deleted when the owner disconnects the service or the Company is deleted. Connecting, replacing a key and disconnecting are recorded in the Company’s activity log. Today we store the key only; before we read any data from a connected service, this Policy will describe what we read and how we use it.
11. How We Share Information
We do not sell Personal Information or Customer Data. We do not share Personal Information for cross-context behavioral advertising. We disclose information only as described below.
11.1 Service providers and subprocessors
We use the following service providers to operate the Platform. Each receives only the information it needs to perform its function:
- Cloudflare, Inc. — website hosting, content delivery, security and DDoS protection, databases, file storage (documents, photos, logos), request logs, and delivery of emails (sign-in codes, invitations, and the invoices and load sheets Companies send), receiving the email Companies forward to their THENEKAS address and checking its sender (SPF, DKIM, DMARC); and Turnstile, a check that tells people from automated programs before a password is checked, a sign-in code is sent, or a rate confirmation is read without an Account (it reads signals from your browser and device for that purpose only, not for advertising).
- Google LLC (Google Cloud Vertex AI) — AI processing of documents you submit to AI features.
- HERE Technologies (HERE Global B.V. and its affiliates) — place suggestions, routes, distances, address search and the map picture on the website and in the driver app’s Map feature; truck routes, road restrictions, tolls and fuel station prices for the Map feature: route points, typed addresses, a chosen map point and vehicle numbers only (Section 5.5). Use of these features is also subject to the HERE Privacy Policy.
- National Weather Service (United States government) — weather alerts for rounded points along a route the driver opens; no personal information (Section 5.5).
- Apple Inc. and Google LLC (map display in the driver app) — draw the base map on the driver’s phone when using Apple Maps or Google Maps as the navigation app; they receive what their map software on the phone requests, such as the map area shown.
- Google LLC and Microsoft Corporation — sign-in and productivity integrations, only if you choose to use them.
- Google LLC (Firebase Authentication) — sending and checking one-time codes by text message when you sign in with a phone number, or when a Company verifies itself by a text to the phone FMCSA lists for the carrier. Google receives that phone number and uses reCAPTCHA to prevent abuse.
- Have I Been Pwned (Superset Media Pty Ltd) — checking whether a new password appears in known data breaches. Only the first 5 characters of a one-way (SHA-1) hash of the password are sent; no account information is sent.
- U.S. Department of Transportation (FMCSA and data.transportation.gov) — public carrier records, read when a Company verifies its USDOT or MC number (only the number is sent).
- U.S. Energy Information Administration — public diesel price data (no personal information is sent).
- Payment processor — if paid features are introduced, payment processing (for example, Stripe).
- Intuit Inc. (QuickBooks Online) — only if a Company’s owner connects it: the bookkeeping records described in Section 5.6.
- Integration providers — the third-party services you choose to connect.
We may update this list as the Platform changes. A current list is available on request.
11.2 Within your Company
If you are a member of a Company, information you submit to that Company may be visible to other members according to the positions and permissions set by its Administrators.
11.2a Platform support access
Authorized THENEKAS personnel can see Account and Company records needed to run the service (for example, which Accounts exist, Company names and sizes, sign-in methods, and technical consistency checks) through an internal console protected by separate sign-in. Opening a Company’s work data (loads and documents) requires a written reason, is recorded in an internal log, and is also recorded in that Company’s activity log, where its owner can see it.
11.3 Legal requirements and protection
We may disclose information if we believe in good faith that it is necessary to comply with applicable law, regulation, legal process or a governmental request; to enforce our Terms and other agreements; to investigate or prevent fraud, security incidents or illegal activity; or to protect the rights, property or safety of THENEKAS, our users or others.
11.4 Business transfers
If THENEKAS or the Platform is transferred to an affiliate, or is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of its assets, information may be transferred as part of that transaction. This Policy will continue to apply to information transferred, unless you are notified otherwise.
11.5 With your consent
We may share information for other purposes with your consent or at your direction.
11.6 Aggregated and de-identified information
We may create aggregated or de-identified information that cannot reasonably be used to identify you or any individual, and use it to operate, analyze and improve the Platform. We will not attempt to re-identify such information. This does not apply to Google user data, which we do not use for such purposes.
12. Data Security
We implement administrative, technical and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration and destruction. These include, as applicable:
- encryption of all connections to the Platform in transit using HTTPS/TLS, with HTTP Strict Transport Security;
- hosting on Cloudflare infrastructure, with databases encrypted at rest by our hosting provider;
- two-step sign-in: a password and a one-time code sent to your email or by text (or a passkey, or Google or Microsoft); passwords stored only as salted, key-strengthened hashes and checked against known breaches; repeated wrong passwords temporarily lock password sign-in;
- session tokens, sign-in codes and invitation tokens stored only as one-way cryptographic hashes; sessions end at the latest 60 days after sign-in (180 days in our mobile apps), and changing your password signs out every device;
- API keys and other secrets stored in our hosting provider’s encrypted secret storage, not in source code;
- API keys of services a Company connects encrypted (AES-256-GCM) in our database, each bound to its Company, with the encryption key kept in our hosting provider’s secret storage;
- rate limiting and abuse protection;
- restrictions on which websites may use our map and API keys;
- security headers that limit framing, content sniffing and access to device features;
- position-based access within Companies and an activity log that cannot be edited; and
- limited access to production systems.
No security measure is perfect, and no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.
Incident response
If we become aware of a security incident affecting your Personal Information, we will take reasonable steps to investigate and contain it, and will notify affected users and, where required, authorities, in accordance with applicable law. Where the New York data breach notification law applies, we will notify affected New York residents within thirty (30) days after the breach is discovered, as that law requires. If an incident affects data that a Company controls (for example its driver cards), we will also tell the Company’s owner without undue delay so that the Company can give the notices the law asks of it.
13. Data Retention
We retain information only for as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes and enforce our agreements. In general:
- Documents read in Dispatch Info without saving: not stored by THENEKAS; processed and discarded once the result is returned.
- Company workspace data (loads, documents, people cards): until a member with permission deletes it, or the Company is deleted. Deleted files are removed from storage immediately and from backups within 30 days. People cards are not deleted while the Company exists; they are marked “former”.
- Company activity log: until the Company is deleted.
- Email forwarded to a Company’s THENEKAS address: while the Company keeps it. A message the Company deletes, a draft it rejects and a message that failed the sender checks are removed after 30 days; a message that is not about loads is deleted 30 days after it arrives; a message attached to a load stays with the load. Notifications are removed after 60 days.
- API keys of connected services: until the owner disconnects the service or replaces the key, or the Company is deleted.
- Profile photos and company logos: until replaced or removed, or the account or Company is deleted.
- Invitations: the invited email address is kept for 7 days until the invitation is accepted, revoked or expires, and afterwards as part of the Company’s member history.
- Information in your browser: stays on your device until you clear it.
- Sign-in codes: until used or expired, typically within minutes.
- Password hash: until you change the password or delete your Account.
- Sessions: until you sign out or the session expires.
- Passkeys, known devices and sign-in countries: until you remove the passkey or delete your Account.
- Account and Company information: while your Account is active. After you delete your Account, we delete or anonymize it within 30 days, except as described below.
- Records of acceptance of our Terms and this Policy: for as long as your Account exists and afterwards for as long as needed to establish, exercise or defend legal claims.
- Billing records: as required by tax and accounting laws.
- Request and security logs: for a limited period set by our hosting provider, typically days to weeks.
- Backups: may persist for a limited period before being overwritten.
14. International Data Transfers
The Platform is operated from the United States, and our service providers may process and store information in the United States and other countries where they operate. These countries may have data protection laws different from those of your country. By using the Platform, you understand and agree that your information may be transferred to and processed in these countries. Where required by applicable law, we rely on appropriate safeguards for such transfers, such as the standard contractual clauses offered by our service providers.
15. Your Privacy Rights
Depending on where you live, you may have some or all of the following rights regarding your Personal Information:
- to know and access the Personal Information we hold about you;
- to correct inaccurate or incomplete Personal Information;
- to delete your Personal Information;
- to receive a copy of your Personal Information in a portable format;
- to restrict or object to certain processing;
- to withdraw consent where processing is based on consent;
- to opt out of marketing communications; and
- to lodge a complaint with a data protection authority.
To exercise these rights, email contact@thenekas.com. We will need to verify your identity before responding, and we will respond within the time required by applicable law. We may decline a request where permitted by law, for example where it would adversely affect the rights of others, compromise security or conflict with legal obligations. If you are an authorized agent submitting a request for someone else, we may ask for proof of authorization.
Where your information is contained in Customer Data submitted by one of our Customers (for example, your name in a rate confirmation, or a Company’s card about you as its driver), we will refer your request to that Customer, who controls that data, and help it respond (Section 5.4b).
16. U.S. State Privacy Rights
Residents of California and other U.S. states with comprehensive privacy laws may have the rights described in Section 15, including the right to know, delete and correct Personal Information, and the right not to be discriminated against for exercising these rights.
In the preceding twelve months, we have collected the following categories of Personal Information, as described in Section 5: identifiers (such as name, email address, IP address, account identifiers and the addresses of places a user saves in the map); commercial information (such as subscription history, if any); internet or other electronic network activity information; approximate geolocation derived from IP addresses; precise geolocation (the driver app phone’s position, only when a driver asks for a route from where they are or while they navigate, Section 5.5); and professional or employment-related information contained in documents you submit and in the cards Companies keep about their drivers and staff (for Companies, as their service provider). Sensitive personal information we may process is limited to account sign-in credentials, the precise geolocation described above (used only to build the route the driver asked for, never to track a driver) and, for Companies, driver’s license or CDL numbers and the copies of a CDL a Company uploads; we use it only to provide the Platform. We do not use Personal Information to create profiles or draw inferences about you.
We do not sell Personal Information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding twelve months. We do not knowingly sell or share the Personal Information of consumers under 16 years of age. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use.
17. European Economic Area, United Kingdom and Switzerland
Where the GDPR or similar laws apply, we process Personal Information on the following legal bases:
- performance of a contract — to provide the Platform you request;
- legitimate interests — to secure the Platform, prevent abuse, fix errors and improve the Platform, where these interests are not overridden by your rights;
- legal obligation — to comply with applicable law; and
- consent — where required, which you may withdraw at any time.
You may exercise the rights of access, rectification, erasure, restriction, portability and objection described in Section 15, and you may lodge a complaint with your local supervisory authority.
18. Children’s Privacy
The Platform is intended for business use by adults and is not directed to children. We do not knowingly collect Personal Information from anyone under 18 years of age. If we learn that we have collected Personal Information from a child, we will delete it. If you believe a child has provided us with Personal Information, please contact us.
19. Cookies, Local Storage and Similar Technologies
We use only technologies that are necessary for the Platform to work or that store your own preferences:
- Session cookie — keeps you signed in. It is marked HttpOnly and Secure. Our mobile app keeps an equivalent sign-in token in the phone's secure storage instead of a cookie; we store only its hash.
- Local storage — stores your theme, column mappings and calculator inputs on your device.
We do not use advertising cookies, tracking pixels, or third-party analytics or cross-site tracking technologies. When a page displays a Google map, Google may set or read its own cookies under its own policies. Our hosting provider may use strictly necessary cookies for security and bot protection.
You can block or delete cookies and local storage through your browser settings, but some features of the Platform may not work without them.
Do Not Track and Global Privacy Control. Because we do not engage in cross-site tracking or sell or share Personal Information for advertising, we treat all users as if they had opted out, regardless of Do Not Track or Global Privacy Control signals.
20. Service and Marketing Communications
We send service-related communications that are necessary to operate the Platform, such as sign-in codes, security alerts, account and Company notices, invitations, and notices of changes to our Terms or this Policy. You cannot opt out of these while you have an Account.
We will send marketing communications only where permitted by law, and you can unsubscribe at any time using the link in the message or by contacting us. We do not send SMS or text messages.
21. Changes to This Policy
We may update this Policy from time to time to reflect changes to the Platform, new features, changes in law or changes in our practices. When we do, we will update the Effective Date and version number at the top of this Policy. For material changes, we will provide notice through the Platform or by email and, where required by law, ask for your consent. Your continued use of the Platform after an updated Policy takes effect constitutes your acknowledgment of the updated Policy, except where additional consent is required by law.
22. Contact Information
Questions, requests or concerns about this Policy or our privacy practices may be sent to:
King Karom Inc. (THENEKAS) — Privacy, a New York corporation
Email: contact@thenekas.com
Phone: +1 218 503 2004
Website: https://thenekas.com
To help us respond, please include enough information for us to verify your identity and understand your request.