Privacy Policy
1. Who we are and what this policy covers
This Privacy Policy explains how personal information is handled in Coreway.
- “Coreway” is the truck-load dispatch service described on this website. It includes the Portal, the App and this website.
- “We”, “us”, “our” or “Luxeran” means LUXERAN LLC, a Florida limited liability company based in Tampa, Florida, USA. We operate Coreway and publish this website.
- “Agency” means the dispatch business that is our customer and uses Coreway to run its loads.
- “Authorized User” means a member of an Agency’s staff (for example a dispatcher, manager or accounting person) who uses the Portal.
- “Driver” means a truck driver who uses the App after being invited by an Agency.
- “Portal” means the dispatcher web application at app.corewaydispatch.com.
- “App” means the Coreway driver app for Android and iOS (package and bundle ID com.luxeranlabs.coreway).
This policy covers the Portal, the App and corewaydispatch.com. It does not cover the websites or services of third parties, such as load boards, brokers or carriers, even when their names or documents appear inside Coreway.
Coreway is a business service. An Agency decides which people and records it puts into Coreway. For the records an Agency manages, we act on the Agency’s behalf as its service provider. For accounts, security and the operation of Coreway itself, we decide how personal information is used, and this policy describes that use.
2. Personal information we collect
The table below lists the categories of personal information we collect. The category names follow the Google Play Data safety section and the Apple App Store privacy labels. All of it is linked to the person’s account. None of it is used to track people across other companies’ apps or websites.
| Category | What it includes | Who it concerns |
|---|---|---|
| Contact info | Name, email address, phone number | Authorized Users, Drivers, contacts at carriers, owners and brokers |
| Identifiers | Account ID, invite codes, push notification token, device platform and app version | Authorized Users, Drivers |
| Account and sign-in data | Password (stored only as a hash) or your Google or Apple sign-in identity, preferred language, role and Agency membership | Authorized Users, Drivers |
| Financial info (earnings) | Pay plans, per-load pay, quick-pay requests and pay dates | Drivers |
| Business records | Legal names, MC and DOT numbers, EIN, contact details, credit checks, incidents, invoices, payments, receivables and collection events | Carriers, owners and brokers, which may include individuals doing business under their own name |
| User content | Rate confirmation PDFs, proof of delivery (POD) and bill of lading (BOL) photos and PDFs, and reasons given when rejecting a load. When the Agency enables chat (planned): messages and their photo or PDF attachments | Authorized Users, Drivers |
| Location | Pickup and delivery addresses and stop details for each load. When the Agency enables tracking (planned): precise location of the Driver’s device, including in the background, only during an active load | Drivers |
| App activity | Loads accepted or rejected, arrival and departure stamps at each stop, times, and an activity log of actions taken in the Portal | Authorized Users, Drivers |
| Technical and security data | IP addresses and request logs, used for security and to keep the service running | Everyone who uses the Portal or the App |
| Diagnostics | None. We do not use crash analytics or performance analytics SDKs | Not applicable |
We do not collect contacts, biometric data, advertising IDs, browsing history or SMS messages. The App keeps your language preference and its queue of files waiting to upload on your device only.
Device permissions in the App
The App asks for device permissions only when a feature needs them:
- Camera and photos: to capture or pick POD, BOL and other load documents.
- Notifications: to tell you about new assignments and changes to your loads.
- Location (planned, only when your Agency enables tracking): to share your position with your Agency during an active load. On Android a visible notification stays on screen while location is in use.
You can refuse or withdraw any permission in your device settings. Some features will not work without it.
3. Where the information comes from
- From you, when you sign in, complete your profile, stamp a stop, upload a document or send a message.
- From your Agency, when an Authorized User creates your account or invitation, assigns you to a truck or load, records pay, or enters business records about carriers, owners and brokers.
- From your device, such as the push token, platform, app version and, when tracking is enabled, location.
- From sign-in providers, when you choose to sign in with Google or Apple. We receive your name, your email address and an account identifier.
- Automatically, such as IP addresses and request logs when you use the Portal or the App.
4. How we use personal information
We use personal information only to:
- Provide Coreway: create and assign loads, move them through pickup and delivery, store documents, and keep pay and billing records.
- Create, secure and sign in to accounts, and send invitations, sign-in links and password recovery emails.
- Send push notifications and transactional emails about loads, accounts and the service.
- Show a Driver’s position to their Agency during an active load, when the Agency enables tracking (planned).
- Bill Agencies for the service.
- Provide support and answer requests.
- Keep the service secure, detect and prevent fraud or abuse, and investigate incidents.
- Keep the service running and fix problems.
- Comply with the law and enforce our Terms of Service.
We do not use personal information for advertising. We do not build profiles of people to make decisions with legal or similarly significant effects.
5. No sale, no sharing for advertising, no tracking
- We do not sell personal information.
- We do not share personal information for cross-context behavioral advertising.
- We do not use personal information for targeted advertising.
- The App contains no advertising SDKs and no analytics SDKs.
- This website sets no cookies and runs no analytics or tracking scripts.
6. Who receives personal information
Your Agency
When an Agency invites you, that Agency receives the information you put into Coreway for its loads, including stops, stamps, documents, earnings and, when tracking is enabled, location. The Agency decides which of its Authorized Users can see it. The Agency is responsible for its own use of that information.
Service providers
We use the service providers below to run Coreway. They process personal information on our instructions and only to provide their service to us.
| Provider | Role | Location |
|---|---|---|
| Hostinger | Server hosting for the Coreway database, files and backend | Company headquartered in the EU. We choose the hosting region |
| Cloudflare | DNS, content delivery, network protection, and hosting for this website | USA |
| Grafana Cloud (Grafana Labs) | Service logs and metrics used to operate and secure Coreway | USA |
| Resend | Sending transactional email from mail.corewaydispatch.com | USA |
| Google Firebase Cloud Messaging | Delivering push notifications to Android devices | USA |
| Apple Push Notification service | Delivering push notifications to iOS devices | USA |
| Google Sign-In | Signing in with a Google account, when you choose it | USA |
| Sign in with Apple | Signing in with an Apple account, when you choose it | USA |
| Let’s Encrypt | Issuing the TLS certificates that encrypt connections | USA |
| Mapbox (planned) | Maps in the App and Portal, when enabled | USA |
| Stripe (planned) | Payment processing for Agency billing | USA |
Load boards such as DAT and Truckstop are not connected to Coreway. No data flows between Coreway and them.
Other disclosures
We may also disclose personal information:
- When required by law, subpoena or court order, or to respond to lawful requests from public authorities.
- To protect the rights, property or safety of Luxeran, our customers, users or the public.
- To a buyer or successor if Luxeran is involved in a merger, acquisition or sale of assets, subject to this policy.
7. How long we keep it
| Data | How long |
|---|---|
| Account data (sign-in, profile, role, Agency membership) | While the account exists, plus up to 30 days after deletion |
| Business records: loads, stops, rate confirmations, POD and BOL documents, pay records, invoices and ledgers | Kept by the Agency and by us as required by law and for the Agency’s business records, typically up to 7 years |
| Push notification tokens | While the account exists. Signing out of the App revokes its token, and we stop sending notifications to that device |
| Service and security logs | Up to 90 days |
When a retention period ends, we delete the data or remove its link to the person. See also Delete your account.
8. How we protect it
We use administrative, technical and physical measures suited to the information we hold, including:
- Encryption in transit with TLS for every connection to the Portal, the App and this website.
- Stored data and documents live on a server we control. The database and the document storage are not reachable from the public internet except through the service.
- Row-level access controls in the database, so each Agency and each user sees only the records they are allowed to see.
- Least-privilege roles for our own services and staff.
- Private storage for documents such as POD and BOL files.
No system is perfectly secure. If we learn of a security incident that affects your personal information, we will notify you and your Agency as the law requires.
9. Your US state privacy rights
Depending on the state where you live, you may have some or all of these rights:
- Know and access: ask what personal information we have about you and get a copy.
- Correct: ask us to fix inaccurate personal information.
- Delete: ask us to delete personal information about you.
- Portability: receive your personal information in a portable format.
- Opt out: of the sale of personal information, of sharing for cross-context behavioral advertising, of targeted advertising and of profiling. We do none of these, so there is nothing to opt out of, but you may still send the request.
- Limit the use of sensitive personal information: precise location and account sign-in data are sensitive under some state laws. We use them only to provide Coreway and keep it secure.
- Non-discrimination: we will not treat you differently for using your rights.
- Appeal: if we decline your request, you can appeal our decision.
Many of these rights depend on your state of residence and on exceptions in the law. Some rights apply differently to information we process for an Agency. In those cases we may refer your request to the Agency or help the Agency respond.
How to use your rights
- Email support@corewaydispatch.com with the subject “Privacy request” and tell us what you want.
- Or use the in-app option where available, such as Profile, then Delete account.
Verification. We verify requests by replying to the email address on the account. We may ask for more information if we cannot confirm who you are. We use that information only to verify the request.
Authorized agents. You may use an authorized agent. We may ask the agent for proof that you gave them permission, and we may ask you to confirm your identity with us directly.
Response time. We respond within 45 days. If we need more time, we may extend this once by up to 45 more days and will tell you why.
Appeals. To appeal a decision, reply to our answer or email support@corewaydispatch.com with the subject “Privacy appeal”. We will answer within the time the law of your state requires. If you are not satisfied with the result, you may contact your state attorney general.
Global Privacy Control. We honor Global Privacy Control (GPC) signals as a valid request to opt out of sale and sharing, even though we do not sell or share personal information.
See also Your Privacy Choices.
10. Notice for Drivers
- Your Agency invited you. Your App account exists because an Agency invited you with an invite code. That Agency is the one you work with in Coreway.
- What your Agency sees. Your Agency sees the loads assigned to you, your stops and the arrival and departure stamps you mark, the documents you upload, your earnings records and, when the Agency enables tracking, your location during an active load.
- Location is limited. When tracking is enabled (planned), location is collected only during an active load. It is not collected when you have no active load. On Android a visible notification is shown while it is in use.
- Turning location off. You can turn off location for the App at any time in your device settings (on Android: Settings, Apps, Coreway, Permissions; on iOS: Settings, Coreway, Location). If your Agency requires tracking for a load, turning it off means the Agency cannot see your position, and the Agency may contact you or reassign the load. That decision belongs to your Agency, not to us.
- Safe driving. Never use the App while driving. See our Terms of Service.
11. Children
Coreway is for adults 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us personal information, email support@corewaydispatch.com and we will delete it.
12. Push notifications
The App sends push notifications about assignments, load changes and your account. You can turn them off at any time in your device settings. If you do, you may not learn about new assignments until you open the App. Signing out of the App revokes its push token, so we stop sending notifications to that device. The revoked token is deleted together with your account.
13. Email
We send transactional emails only, such as invitations, sign-in links, password recovery and messages about your account or loads. We do not keep marketing lists at this time. If we ever send marketing email, it will comply with the CAN-SPAM Act, identify LUXERAN LLC as the sender with our location in Tampa, Florida, USA, and include a way to unsubscribe. For any question about our emails, contact support@corewaydispatch.com.
14. Text messages
We do not send SMS text messages.
15. Where the service is offered
Coreway is intended for use in the United States. If you use it from another country, your information will be processed where we and our service providers operate, as described in section 6.
16. Changes to this policy
We may update this policy. We will post the new version on this page with a new “Last updated” date. If a change is material, we will also give notice in the Portal, in the App or by email before it takes effect.
17. Contact
LUXERAN LLC
Tampa, Florida, USA
Email: support@corewaydispatch.com