Privacy Policy

1. Who we are

MoveTheWheels (the "Service") is operated by Timecampus Technologies Private Limited ("Timecampus", "we", "us"), a company incorporated in India and part of the Burdenoff Group. Engineering, support, security and operations personnel are employed by Burdenoff Consultancy Services Private Limited and act on our instructions under intra-group confidentiality and data-protection arrangements. International invoices are issued by Algoshred Technologies Corp (Delaware, USA).

For privacy questions and data-subject requests write to [email protected]. Our Grievance Officer is listed in section 13.

2. What this Policy covers

This Policy applies to the website at movethewheels.com, the product at app.movethewheels.com, the MoveTheWheels mobile and desktop apps, our CLI, SDKs and extensions, and sales, support and billing interactions with us about MoveTheWheels. It does not cover third-party services you connect (for example your ERP, WMS, TMS, identity provider or a carrier you contract directly), which have their own notices.

3. Our role: controller and processor

• We are the controller (the Data Fiduciary under India's Digital Personal Data Protection Act, 2023) for your account, billing, support, security and website-visitor data. This Policy is the notice for that processing.
• We are the processor for the logistics data an organisation puts into MoveTheWheels: orders, shipments and tracking events, vehicle and driver records, customer and consignee contacts and addresses, warehouse and inventory records, routes, and proof-of-delivery documents. The organisation is the controller and we act on its instructions under our Data Processing Addendum. If you are a driver, customer, consignee or partner whose data appears in an organisation's workspace, please send requests to that organisation first; we will help it respond.

4. Personal data we collect

• Identity, contact and account: name, work email, phone (optional), profile photo, sign-in identifiers, multi-factor settings, organisation membership and roles.
• Logistics data you manage: customer and consignee names, delivery and pickup addresses, driver names, contact and licence details, vehicle records, orders, shipments, routes, stops, warehouse and inventory records, and uploaded documents such as proof of delivery.
• Location data: vehicle and driver location and route progress, only where your organisation records or enables it, and only for the operational purpose it configures (dispatch, ETA, proof of delivery).
• Billing: billing contact and address, GSTIN or other tax identifiers, and a tokenised reference to your payment method. Card and UPI details are handled by our payment providers (Razorpay, Stripe), not stored by us.
• Communications: support requests, in-product messages and survey responses.
• Collected automatically: IP address, browser and device details, pages and features used, error and performance data, and audit-log entries. Website and product analytics use Rybbit, which sets no cookies (see our Cookie Policy).
• From third parties: the profile claims your sign-in provider shares (typically name and email), records you sync from integrations you connect, and payment-status events from our payment providers.

The Service does not need special-category data (health, biometrics, caste, religion, political opinion, sexual orientation, trade-union membership or criminal records). Do not put such data into MoveTheWheels unless your signed Order Form expressly allows it.

5. Why we use personal data

• To provide the Service: sign you in, run your workspace, and operate the order, shipment, fleet, route, warehouse, inventory and analytics features your organisation uses (performance of contract).
• To keep the Service secure: detect and prevent fraud, abuse and unauthorised access (legitimate interests and legal obligation).
• To bill you and meet tax and accounting rules (contract and legal obligation).
• To support you and send service messages such as incident, security and renewal notices (contract).
• To improve the Service using aggregated usage and diagnostic data (legitimate interests).
• To send product news and marketing, only with your consent or where the law allows contacting existing customers, always with an unsubscribe option.
• To comply with law and respond to lawful requests from authorities, and to establish or defend legal claims.

We do not sell personal data, and we do not use your organisation's data, including order, shipment, driver, customer, location or AI-session data, to train, fine-tune or evaluate any machine-learning model.

6. Who we share it with

• Subprocessors that host and run the Service, listed with their purpose and location on our Subprocessors page. We give at least 30 days' notice before adding or replacing one.
• People in your organisation with the roles your administrators assign, such as dispatchers, warehouse leads or finance staff.
• Partners you choose to work with in the Service, such as a carrier you assign a shipment to, who see the details you share with them.
• Authorities and courts where the law requires it, professional advisers under confidentiality, and a buyer or successor in a corporate transaction under equivalent protections.

We do not share personal data with advertising networks or data brokers.

7. Where data is stored

Customer data is stored and processed in India, on Amazon Web Services in the Mumbai region (ap-south-1). Some data leaves India: Cloudflare's global edge sees connection metadata such as IP addresses as it routes traffic; Stripe processes international billing; and Rybbit processes website and product analytics in the United States. We follow the cross-border rules of the DPDP Act, 2023 and the IT Act, 2000. For personal data from the EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, as set out in our Data Processing Addendum.

8. How long we keep data

• Account data: while your account is active and for 90 days after it closes, unless the law or a legal hold requires longer.
• Your organisation’s logistics data: for the subscription term, then available for export for 30 days and deleted, except where your organisation instructs us to keep statutory transport, carriage or tax records.
• Audit logs: for the period your plan provides.
• Backups: overwritten on a rolling basis and kept for no more than 30 days.
• Support requests: 24 months after closure.
• Billing and tax records: 8 years, as Indian tax and company law requires.
• Marketing contacts: until you withdraw consent, plus up to 30 days to update our suppression list.

9. AI features

MoveTheWheels includes AI-assisted features such as an operations assistant, route suggestions, ETA estimates and exception triage. Their output can be wrong and must be reviewed before you act on it. You must keep a person involved in any decision that significantly affects an individual driver, partner or recipient, and give the notices the law requires. We log AI usage metadata (time, feature, status) and never use your prompts or data to train models.

10. Your rights

Depending on where you live, you can ask to access, correct, complete, update or erase your personal data, receive a copy in a portable format, restrict or object to processing, withdraw consent, and nominate someone to act for you. Under the DPDP Act you may also complain to the Data Protection Board of India after first contacting our Grievance Officer; in the EEA, UK or Switzerland you may complain to your data protection authority. US residents can exercise their state-law rights, and we honour Global Privacy Control as an opt-out signal. We do not sell or share personal information for cross-context behavioural advertising.

Write to [email protected]. We confirm your identity before acting and reply within the time the law sets, typically 30 days (45 days under California law).

11. Children

MoveTheWheels is a business platform for people aged 18 and over and is not directed to children. We do not knowingly create accounts for anyone under 18. If you believe we hold a child's data without a lawful basis, write to [email protected] and we will act on it.

12. Security

We encrypt data in transit with TLS and at rest, isolate every organisation's data, restrict access by role, and apply stricter controls to driver, location and proof-of-delivery data. Our practices are described on our Security page. We notify affected customers of a confirmed personal data breach without undue delay and within 72 hours of becoming aware of it. No system is perfectly secure; report suspected vulnerabilities to [email protected].

13. Grievance Officer and contact

Under the Information Technology Act, 2000 and the DPDP Act, 2023, our Grievance Officer is Vignesh T.V., Founder, CEO & CTO, reachable at [email protected].

14. Changes to this Policy

We may update this Policy. For material changes that reduce your rights we give at least 30 days' notice by email or in the product and update the version and effective date at the top of this page. If your organisation has signed a Master SaaS Agreement and Data Processing Addendum with us, those documents prevail over this Policy for the processing they govern. Previous versions are available on request.