Privacy Policy

Last updated: 18 September 2026 · Version 1.2

This policy explains how Digital Blast Media (Pty) Ltd, trading as FreightOps ("we", "us") handles personal information on this website (freightops.co.za) and in the FreightOps application (app.freightops.co.za and the FreightOps driver app), in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Who we are

Digital Blast Media (Pty) Ltd t/a FreightOps (registration number 2016/387590/07), a private company registered in South Africa. Our Information Officer is registered with the Information Regulator (registration number 2026-061664). Contact: sales@digitalblastmedia.co.za · 079 695 4062. Our registered address is given in full on request and in every agreement we sign.

2. What we collect, and why

Website contact form: your name, email address, and message — used only to respond to your enquiry. Submissions are delivered to us by Web3Forms, a form-delivery service.
FreightOps app accounts: name, email address, cell number, and role — used to provide login access and operate the service.
Operational data: loads, costs, vehicles, and related records entered by our client companies. This data belongs to the client.
Client companies' customer contacts: the name, email address and phone number of a contact person at a client company's own customer, entered by the client so that a tracking link or a delivery notification can be sent to that person. The client company is responsible for having the right to enter it.
Driver location: the driver app captures GPS coordinates when a driver logs a trip event. Drivers are shown a dedicated privacy notice inside the app and must acknowledge it before first use.
Receipts and slips: photos of fuel, toll, tyre and expense receipts uploaded by our client companies' staff or drivers, so that the cost can be recorded against a load. A receipt sometimes shows a driver's name, an ID or passport number, or a vehicle registration where the garage or border post printed it. When a user asks for a receipt to be read automatically, the photo is sent to an automated reading service (Anthropic — see sections 4 and 5) which returns the figures printed on it; the user checks those figures against the photo before anything is saved. Reading is optional and every figure can be typed in by hand.

Roles under POPIA: for driver and operational data, the transport company using FreightOps is the responsible party and Digital Blast Media is the operator — we process that data only on the client's instructions, under a written operator agreement.

3. Cookies and browser storage

We do not use tracking cookies — in fact, we set no cookies at all. There are no analytics, advertising, or social-media trackers on this website or in the FreightOps dashboard.

Logging in to the FreightOps dashboard stores a session token in your browser's local storage. This is strictly necessary to keep you signed in and is removed on logout. It is not used to track you.
This website loads the Inter typeface from Google Fonts; your browser's request to Google discloses your IP address to Google. No other third-party resources are loaded.

If we ever introduce analytics or marketing tools that use cookies, we will ask for your consent first.

4. Where your data is stored

FreightOps data is hosted on Supabase in the European Union (Ireland, AWS eu-west-1). This is a transfer of personal information outside South Africa as contemplated by section 72 of POPIA. We rely on section 72(1)(a): the EU provides an adequate level of protection through the GDPR, which imposes obligations substantially similar to (and in many respects stricter than) POPIA. This is supported by our data-processing terms with Supabase and the operator agreements we sign with each client.

Every night we copy the database and uploaded files to a second location so that the service can be rebuilt if Supabase fails. That copy is encrypted before it is stored, with a key only we hold, and kept in Cloudflare storage in the European Union. The copy is made by a job that runs on GitHub's hosted computers, whose location GitHub does not publish; the data is encrypted on that computer in the same run and is not kept there.

Application error reports (technical diagnostics, not operational data) are processed by Sentry in the EU (Germany), configured not to send personal information by default.

Emails we send — password resets, tracking links and delivery notifications — go through Resend, a United States company. Those emails carry names, email addresses and load references, never location records or receipt photos. Resend keeps its account records and email logs in the United States. For this transfer we rely on Resend's data-processing terms under section 72(1)(a) of POPIA.

The place names typed on a load (for example a depot or a border post) are sent to Google's geocoding service to find their map coordinates. Place names are not personal information.

Receipt photos sent for automated reading are processed by Anthropic, PBC in the United States. This is a second transfer outside South Africa under section 72 of POPIA. The United States does not have a general adequacy standing like the EU, so for this transfer we rely on section 72(1)(a)'s binding agreement limb: Anthropic's commercial terms and data-processing addendum bind it to confidentiality, purpose limitation and security safeguards substantially similar to POPIA's conditions. Under those terms Anthropic does not use our data to train its models, and keeps it only for a limited period for safety monitoring. Only the receipt photo goes to Anthropic — never GPS locations, account details or load records — and only when a user chooses to have it read.

5. Service providers we use

Supabase — database, authentication, and file storage (EU/Ireland)
Cloudflare — hosting for this website, and encrypted off-site backup storage (EU)
GitHub — runs the nightly backup job (location not published; data encrypted in the same run)
Resend — transactional emails (password resets, tracking links, delivery notifications) from noreply@freightops.co.za (United States)
Sentry — application error monitoring (EU/Germany)
Google Maps Geocoding — place names to map coordinates
Anthropic — automated reading of receipt photos (United States); does not use our data to train its models
Web3Forms — contact-form delivery for this website
Netlify — hosting for the app

We do not sell personal information, and we do not use it for advertising.

6. Your rights

Under POPIA you may:

ask what personal information we hold about you (access);
ask us to correct or delete it;
object to processing;
complain to the Information Regulator of South Africa.

To exercise any of these rights, contact our Information Officer, Revendran Pillay, at sales@digitalblastmedia.co.za. If your request concerns data processed on behalf of one of our client companies (for example, driver location data), we will assist and refer you to that company, which is the responsible party for that data.

7. How long we keep it

Operational data is kept for as long as the client company's account is active. When an account ends, the client may ask for an export or deletion within 30 days; if they do not, we delete the data within 90 days. Copies in our encrypted backups are overwritten within 35 days after that. Website contact-form messages are kept only as long as needed to respond.

8. Changes to this policy

We will update this page when our practices change and revise the "Last updated" date and version above.