Privacy Policy

This Policy explains how Exluma (Pty) Ltd, registration number 2026/354697/07 ("EXLUMA", "we", "us"), collects, uses, stores and protects personal information in the WaybillGO service (the "Service"), in line with the Protection of Personal Information Act 4 of 2013 ("POPIA"). WaybillGO is a business tool used by transport companies (our "Customers"), their drivers and staff, the cargo owners they work for ("Corporate Clients"), and the people who count or receive loads.

1. Who is responsible for your information

• Records captured on a Customer's account — trips, photos, locations, counts, seals, fuel fills, confirmations and documents — belong to that Customer. The Customer is the responsible party; EXLUMA is its operator and processes that information only on the Customer's instructions to provide the Service.
• Account, billing and support information about our Customers and Corporate Clients: EXLUMA is the responsible party.
• A Corporate Client that views trips linked to its own contracts is responsible for how it uses what it sees.

2. Where your information is stored and processed

WaybillGO stores and processes its data in South Africa. The database, all photos and documents, every server function that handles your data, and our secret keys are hosted on Google Cloud in the africa-south1 (Johannesburg) region.

A small number of supporting services operate outside South Africa. We list each one so you know exactly what leaves the country:

• Sign-in accounts (Google Firebase Authentication — United States). To let people sign in securely we hold each user's email address or phone number, a one-way scrambled form of the password (never the password itself), the display name, and sign-in timestamps. Google runs this service only from US data centres.
• Phone verification (Google). When a receiver confirms a delivery with a one-time PIN, Google sends the SMS and runs an automated bot check (reCAPTCHA) in the browser.
• Push notifications (Google Firebase Cloud Messaging — global). Alerts are deliberately content-free ("open WaybillGO to see it"): no trip details, quantities or names are sent through this channel.
• Website delivery (Google Firebase Hosting — global network). Delivers the app's code and public pages. It does not store your records.
• Scheduled-job timer (Google Cloud Scheduler — Doha, Qatar). A timer that only triggers our Johannesburg billing and housekeeping jobs at set times. It holds no personal information.
• Email delivery (Resend — United States). Invitations and password-setup emails pass through Resend, which receives the recipient's email address and the message content.
• Card payments (Paystack). Card and bank details are entered directly on Paystack's checkout and handled by Paystack under its own privacy policy. WaybillGO never receives or stores them.

We transfer information across borders only as POPIA section 72 allows: where it is necessary to provide the Service you signed up for, and where the recipient is bound by law or by binding agreements (including Google Cloud's data processing terms) to a level of protection substantially similar to POPIA. WaybillGO does not use artificial intelligence or automated text reading (OCR) on your photos.

3. Information we collect

• Fleet managers and Customer staff — name, work email, phone number, company name, role and the settings you choose, and any corrections or confirmations you make (see section 5).
• Drivers — name, email, assigned truck, and everything captured on a trip: photographs (documents, seals, weighbridge slips, loads and, where the Customer's client requires it, security-escort photos at the origin and again at the destination), counts, weights, seal numbers, timestamps, and location (see section 4). While a trip is active the app also records the phone's battery level, network type and whether the app is open, so the office can tell a quiet phone from a lost signal.
• Fuel fills — the truck, the odometer reading and a photo of the odometer (or the driver's reason why no photo was possible), litres, total cost, card or cash, yard or station, a photo of the fuel slip and the time it was taken, and — only if the phone allows it — where the slip photo was taken. Managers' review notes and corrections on a fill are kept with it.
• Corporate Client users and bay clerks — name, work email, role, the sites they are assigned to, and the counts and seal numbers they record.
• Receivers — name, company (optional), verified phone number, the quantity and seal numbers they confirm, whether seals were intact, and any notes they add.
• Billing — billing email and the payment reference / reusable authorisation token Paystack returns. Never card or bank numbers.
• Location consent records — who agreed, for which trip, when, and which version of the notice they saw.
• Technical data — error and security logs needed to run, secure and troubleshoot the Service, and a check of the phone's clock against our server's time (see section 4).

4. Location information

Before a trip starts, the driver is shown a location notice and must agree. While that trip is active and the app is open on the driver's screen, the app reads the phone's position to prove arrival and departure at sites, time waiting on site, and show that the truck stayed on its route. Each photo also records the position at the moment it was taken. Location reading stops when the trip ends, when the driver changes job or signs out, and WaybillGO cannot read location when the app is closed or in the background. Customers remain responsible for informing their employees about monitoring, as employment law requires.

How site waiting time is measured

• During an active trip the app keeps location points on the driver's phone only — points accurate to 100 m or better, at most one every 10 seconds. They are used to work out when the truck entered a site's boundary and when it left.
• The points themselves never leave the phone. Only the worked-out arrival and departure times, how each time was set (boundary entry or exit, the driver's tap, or a manager's correction) and whether a time is approximate are added to the trip.
• The points are deleted from the phone when the trip's last site visit has been timed, when the driver signs out, and in any case after 72 hours.
• Near a site, while the app is open, it may keep the phone's screen on so the visit can be timed accurately. This stops after departure or when the app is closed.
• The app compares the phone's clock with our server's time. If the phone's clock is more than two minutes out, the visit is flagged for the manager to review. Times are never changed automatically.

Fuel fills

No location is used in any fuel calculation or fuel check. If the phone shares its location when the slip photo is taken, that position is stored with the photo as information only.

5. Why we use information

• To provide the Service: capture, sync, cross-check (bay clerk, driver and receiver), display and export delivery records and documents — performance of the contract with our Customer.
• To time site visits and produce standing-time (demurrage) reports, and to let managers correct or confirm a time with a recorded reason — the Customer's legitimate interest in accurate billing evidence.
• To check fuel fills (for example a lower odometer reading, more kilometres than the time allows, or efficiency far from the truck's own normal) and flag them for the Customer's review. A flag is a prompt to check, never a finding of wrongdoing — the Customer's legitimate interest in controlling its fuel costs.
• To keep each company's data separate and each driver's work private from other drivers — security and legitimate interest.
• To bill for active trucks and manage subscriptions — contract and legal obligation.
• To read location during an active trip — the driver's consent, and the Customer's legitimate interest in proof of delivery.
• To prevent fraud and abuse, secure the Service and give support — legitimate interest.

We do not sell personal information, use it for advertising, or run advertising or analytics trackers in the Service.

6. Who can see what

• The Customer's managers see their own company's records. Companies never see each other's records.
• Drivers see only their own trips and their own truck — never another driver's work, and never past fuel fills.
• A Corporate Client sees only trips linked to its own contracts: delivery proof, documents, site arrival and departure times with standing time, the route line on the Route Proof document, and whether locations were verified. It never sees drivers' contact details, the location points used to time a site visit, fuel records, or escort photos and certificates (only whether an escort was logged, and when).
• Bay clerks see only the trucks to be counted at their own sites. Receivers see only the delivery they are confirming.
• Anyone holding a document's verification QR code can view that one document.
• We may disclose information when the law requires it, or to protect the rights and safety of users or the public.

7. How long we keep information

• While the account is active, records stay on the Customer's account unless the Customer deletes them sooner.
• Fuel records and their photos are deleted automatically seven years after each was created.
• On the driver's phone: location points for at most 72 hours (see section 4); unfinished drafts, including their photos, until they are submitted or for at most 7 days; captures waiting to upload, until they have uploaded.
• Receiver confirmation links expire after 3 hours.
• When the Customer deletes its account (in the app, once any amount owed for services already used is settled), its records, photos, documents and sign-in accounts are deleted at that time. We keep only a billing record (who the customer was and its payments) and, for trips that were billed to a Corporate Client, the minimum trip facts that client's statements rely on — for five years, as tax and accounting law requires.
• When a user is removed from a team, their sign-in is disabled immediately. You may ask us to delete a sign-in account sooner.

8. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Access requires sign-in; security rules enforce company and driver separation on every request; sensitive photos (such as security escorts) are released only through short-lived signed links; secret keys are kept in a managed secret store in Johannesburg. Once a step has been saved, its photos and site times can no longer be changed or removed from the phone; a manager's correction is added alongside the original with a reason and is audit-logged. No system is perfectly secure. If we become aware of a security compromise affecting personal information, we will notify the affected Customer and, where POPIA requires, the Information Regulator and affected people, as soon as reasonably possible.

9. Your rights

Under POPIA you may ask to know what personal information is held about you, request access to it, ask for it to be corrected or deleted, and object to processing in certain circumstances. If the information was captured on a Customer's account, we will pass your request to that Customer as the responsible party and assist it. You may withdraw location consent for future trips at any time; a trip then cannot be run in the app, and you should speak to your fleet manager.

10. Information stored on your device

The driver and clerk apps store data on the device so they keep working without signal: captures waiting to upload, unfinished drafts (so a reload or a switch to the camera never loses work), the location points described in section 4, the signed-in session and app settings. This is essential to the Service; we do not use advertising cookies. Each kind of data is removed as set out in section 7.

11. Children

WaybillGO is a business service for adults and is not intended for anyone under 18.

12. Information Officer, PAIA and complaints

The Information Officer of Exluma (Pty) Ltd can be reached at privacy@exluma.co.za or support@exluma.co.za, or through our Customer Service page. Exluma's physical address and other company information are set out in our PAIA manual. If you are not satisfied with our response, you may complain to the Information Regulator (South Africa) — see inforegulator.org.za.

13. Changes to this Policy

We may update this Policy as the Service or the law changes. We will show the new effective date above and tell Customers about material changes through the Service or by email before they take effect.

What changed in version 2026-10-24: fuel fills (section 3 and 4); how site waiting time is measured, including location points kept only on the phone, keeping the screen on near a site and the phone clock check (section 4); escort photos at the destination (section 3); what Corporate Clients can and cannot see (section 6); retention periods that match how the Service works, including account deletion (section 7); drafts kept on the device (section 10); the PAIA manual (section 12).