TruckScanner privacy policy

Version of 28 October 2026 · Effective from publication on truckscanner.it

This policy explains what personal data TruckScanner processes when you visit the truckscanner.it website, why, on what legal basis, how long we keep it and who we share it with. It covers only the website, with its chat and callback form. The app.truckscanner.it platform, which you use with an account, has its own privacy policy, which you can find on Iubenda. We provide it under Article 13 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

1. Who processes your data and how to contact us

The data controller is DIGITAL LOGISTICS S.R.L., Via F.lli Cervi 80, 42124 Reggio Emilia (RE), Italy, VAT number and tax code IT03031930351. In this policy we call it "TruckScanner" or "we".

For any privacy question, or to exercise your rights, write to tech@truckscanner.it. We have not appointed a data protection officer (DPO), because the law does not require us to: requests are handled directly by the controller.

2. At a glance

The website does not use cookies. It only stores in your browser the technical data it needs, and we count page views without your IP address, without your user agent and without any code that identifies you.
The website chat is an artificial intelligence assistant, and it tells you so. Conversations are kept for 90 days, unless you ask us to contact you.
We ourselves do not use your messages to train artificial intelligence models.
If you ask us to call you back, we use your name, email and any other details you choose to give us only to reply to you, and we keep them for at most 24 months from the last contact.
Servers and databases are in Germany, with a backup copy in Finland: all within the European Union. When a provider is based outside the EU or processes data there, the transfer is covered by the safeguards required by the GDPR (section 10).
You can ask at any time for access, correction, erasure and the other rights in section 11, and you can complain to the Italian data protection authority (Garante).

Each processing activity has its own section, from 3 to 8. The tables always cover the same points: what data, why, the legal basis, how long, who receives it and whether you have to give it to us.

3. Website visits and browser storage

When you visit truckscanner.it, the site only stores in your browser the information it needs to work, and no cookies. We do not use analytics or marketing tools, so we do not ask for your consent to this storage: Article 122 of the Italian Privacy Code exempts technical storage. Fonts and images are served by the site itself, without calling third-party services. The full list of what is stored and for how long is in the cookie policy.


What data	In `localStorage`: your choice in the cookie panel (`ts_consent`) and a random code that links that choice to the register in section 7 (`ts_consent_session_id`). In `sessionStorage`, which is cleared when you close the tab: where your visit came from, that is UTM parameters, landing page and referring site (`ts_attribution`), and the code of your chat conversation (`ts_chat_session_id`). To count page views we record the page path, language, referring domain, UTM parameters, device type and the version of the form shown, without IP address, without user agent and without codes that identify you. Vercel, which hosts the site, logs the technical data of each request, including the IP address and the user agent. Our own server, which answers the chat, the forms and the page view count, also writes technical logs that may contain the IP address.
Why	To make the site work, remember your cookie choice, know where people who contact us come from, count visits in aggregate form, and protect the site from abuse and attacks.
Legal basis	Legitimate interest (Art. 6(1)(f) GDPR) in offering a website that works, is secure and can be measured. The page view counts cannot be traced back to you.
How long	Your cookie choice stays in your browser until you change it or clear the site data. Session storage is cleared when you close the tab. The request logs that Vercel keeps for us are kept for at most 30 days. Our server's logs are kept for 90 days, then the system deletes them automatically. Page view counts contain no personal data.
Who receives it	Vercel (website hosting), Hetzner (servers and database of our backend).
Do you have to provide it?	No. You can visit the site without giving us any data. The technical storage, however, is needed for the site to work.

Cloudflare manages the DNS of our domains, that is, it translates names such as truckscanner.it into server addresses. The website traffic does not go through its servers, and Cloudflare does not store anything in your browser.

4. Chat with the website AI assistant

On the website you can ask questions to an assistant based on artificial intelligence. The chat tells you that you are writing to an AI assistant and not to a person, as required by Article 50 of Regulation (EU) 2024/1689 on artificial intelligence (AI Act), and that its answers may contain errors. The assistant answers with information about the TruckScanner service. We recommend that you do not write in the chat any personal data that your question does not need.


What data	The text of your messages and of the replies, the searches made in the knowledge base, your language, the page you write from, the conversation code, your browser's user agent. We do not store your IP address in clear, but a fingerprint of it (hash). If you have asked us to contact you, the assistant also receives your name, so it can address you. For each reply we also record the technical data of the call to the AI model, without the text of the messages.
Why	To answer your questions about the service. To check the quality and cost of the answers, and to prevent abuse.
Legal basis	Answering your questions is a pre-contractual step taken at your request (Art. 6(1)(b) GDPR). Quality and cost control, security and abuse prevention rely on our legitimate interest (Art. 6(1)(f) GDPR) in giving correct answers, keeping the service secure and preventing its misuse. For this we only use the conversation data, with the fingerprint of the IP address instead of the address.
How long	90 days from the last message: every day we delete expired conversations, together with the searches made in the knowledge base. The technical data of the calls to the AI models is kept for 90 days. If you ask for a callback from the chat, the conversation stays linked to the request and we keep it for as long as we keep the request (section 5).
Who receives it	The AI model providers: Amazon Web Services (Anthropic's Claude via Bedrock, EU regions), and only if that does not respond, Google (Gemini via Vertex AI, EU endpoint) and then Mistral AI (EU servers). Voyage AI receives only the text of your question, without the data from the callback form, to find answers in the knowledge base. Hetzner stores the conversations.
Do you have to provide it?	No. The chat is optional: you can use the site without it.

The assistant does not make decisions about you: it answers questions. Any mistakes the assistant makes do not change the terms of the service.

5. Callback requests

From the chat you can ask us to contact you through a short form. The form does not ask for marketing consent: we use the data only to reply to your request.


What data	Name and email (required), phone number and reason for the request (optional), your confirmation that you have read this policy, your language, the page you write from and where your visit came from (section 3), your user agent. Here too we do not store your IP address in clear, but a fingerprint of it (hash).
Why	To contact you and reply to what you asked, for example a demo or a quote.
Legal basis	Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). The box in the form confirms that you have read the policy; it is not consent.
How long	As long as we need to follow up your request, and at most 24 months from the last contact. We delete the data earlier if you ask us to. If you then open an account on the platform, the account data is covered by the platform's privacy policy.
Who receives it	Our sales staff. Hetzner stores the data.
Do you have to provide it?	We need your name and email to contact you: without them we cannot. Phone number and reason are optional.

6. Location search in the request form

On the website's home page you can start a transport request by entering pickup, destination, delivery date and cargo type. While you type the pickup and the destination, we suggest addresses with Google Places. The search is made by our server, not by your browser.


What data	The text you type in the pickup and destination fields and the language of the site. Google does not receive your IP address. To monitor the use and cost of the service we record the first 50 characters of each search, without linking them to you.
Why	To suggest the right address while you type. To monitor the use and cost of Google's service.
Legal basis	Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) for the suggestions. Legitimate interest (Art. 6(1)(f) GDPR) in monitoring use and costs for the search log.
How long	Recorded searches are kept for 90 days: every day we delete expired ones. The site does not store the other data in the form. If you press "Start now", the form data is passed in the address of the app.truckscanner.it platform page, and from there the platform's privacy policy applies.
Who receives it	Google (Places), as an independent controller (section 9). Hetzner stores the search log.
Do you have to provide it?	No, the form is optional. If you use it, the pickup and the destination must be chosen from the suggested addresses.

7. Register of cookie choices and acknowledgements

We keep a record of the choices you make in the cookie panel and of your confirmation that you have read this policy when you ask us to contact you.


What data	Type of choice, action (given, withdrawn, changed), date and time, channel, document version, session code, link to the callback request, where there is one. We do not store the IP address and user agent in clear, but as a fingerprint (hash).
Why	To be able to prove the choices you made and that you read the policy.
Legal basis	Legitimate interest (Art. 6(1)(f) GDPR) in being able to prove the choices and the acknowledgement, as the accountability principle requires (Art. 5(2) GDPR).
How long	Cookie choices for 2 years from when they are recorded. Acknowledgement of this policy for 5 years from when it is recorded. Every month we delete expired entries.
Who receives it	No third party apart from Hetzner, which stores them. Register entries cannot be changed.
Do you have to provide it?	The register is automatic and goes with the choices you make.

8. Security and errors


What data	When our server fails while answering the chat or the forms, we record the error: the point in the code, the address of the request and its data, with email addresses, phone numbers, VAT numbers, tax codes and number plates masked. We do not send the IP address or cookies. Sentry also receives technical data on the performance of requests, sampled and without IP address or cookies. To protect the site from abuse we also limit the requests that come from the same IP address.
Why	To keep the site secure and working, and to find and fix errors.
Legal basis	Legitimate interest (Art. 6(1)(f) GDPR) in providing a secure and stable service. We have limited the data to what is necessary: no IP address or cookies, and the data listed above masked.
How long	Errors are kept for at most 90 days; performance data, according to Sentry's plan. For technical logs the periods in section 3 apply.
Who receives it	Sentry (errors, servers in Germany), Hetzner.
Do you have to provide it?	This data is collected automatically while you use the site. You can object to the processing as explained in section 11.

Legal claims and requests from authorities. We may use data to defend ourselves in court, or to prepare a defence, in case of misuse of the site, based on our legitimate interest (Art. 6(1)(f) GDPR). We may have to disclose data to public authorities when they order us to by law.

How we protect data. We process data with IT tools and with appropriate technical and organisational measures: encrypted connections, access limited to the people who need it, encrypted backups. Within TruckScanner only authorised staff can access the data (administration, support, sales, technical staff).

9. Providers that process data on our behalf

These providers process data on behalf of TruckScanner as processors (Art. 28 GDPR), under a contract that binds them to our instructions and to confidentiality.

Provider	What it does	Where the data is processed
Hetzner Online	Backend servers and database, backups	Germany (Nuremberg); an encrypted backup copy in Finland (Helsinki)
Vercel	Website hosting	Vercel's global network, with main processing in the United States; company based in the United States
Cloudflare	DNS of our domains; website traffic does not go through its servers	Global network; company based in the United States
Amazon Web Services	Anthropic's Claude AI model for the chat (Bedrock)	EU regions
Google	Gemini fallback AI model for the chat (Vertex AI)	EU endpoint
Mistral AI	Fallback AI model for the chat	EU servers
Voyage AI	Knowledge base search for the chat	United States
Sentry	Error reporting and technical performance data	EU servers (Germany)

For the location search (section 6), Google processes the text you type as an independent controller, under the standard contractual clauses, and not as our processor.

You can ask us for the up-to-date list of providers whenever you want by writing to tech@truckscanner.it.

10. Transfers outside the European Union

We keep data in the European Union whenever we can. Some providers are based in the United States or process part of the data there: Vercel, Cloudflare, Voyage AI and Google for Places. Some providers that store data in the EU also belong to groups based in the United States.

These transfers take place with the safeguards required by the GDPR, provider by provider. The EU-US Data Privacy Framework rests on the European Commission adequacy decision (EU) 2023/1795; the standard contractual clauses are those of the European Commission (Decision (EU) 2021/914).

Vercel (main processing in the United States): it is certified under the Data Privacy Framework, and its data processing agreement also includes the standard contractual clauses.
Cloudflare (DNS only): it participates in the Data Privacy Framework; the standard contractual clauses of its data processing agreement apply as a fallback.
Amazon Web Services (Bedrock, Frankfurt region): Amazon.com, Inc. participates in the Data Privacy Framework.
Google Cloud (Gemini, EU endpoint): standard contractual clauses in the Google Cloud Data Processing Addendum; Google LLC participates in the Data Privacy Framework.
Google (Places): standard contractual clauses between independent controllers.
Voyage AI (United States): standard contractual clauses of its data processing agreement; it does not participate in the Data Privacy Framework.
Mistral AI (France, EU servers): no transfer outside the EU.
Sentry (Functional Software, Inc.): data in the EU, in Frankfurt; it participates in the Data Privacy Framework, with the standard contractual clauses as a fallback.

You can ask us for a copy of the safeguards by writing to tech@truckscanner.it.

11. Your rights

Within the limits set by the GDPR (Articles 15 to 22) you have the right to:

access your data and receive a copy;
correct it if it is wrong or incomplete;
erase it, for example when we no longer need it and no law requires us to keep it;
restrict processing, that is, ask us to keep the data without using it, for example while we check a dispute you raised;
receive it in a structured, machine-readable format and have it sent to another controller, for data you gave us with a request of yours, such as the callback form;
object to processing based on our legitimate interest, on grounds relating to your particular situation. We will stop, unless we show compelling legitimate grounds that override yours or we need the data to defend legal claims.

How to exercise them. Write to tech@truckscanner.it. The request is free of charge. We reply within one month, which may become three months for complex or numerous requests: in that case we tell you within the first month and explain why. We may ask you to confirm your identity. If we correct, erase or restrict data, we tell the recipients we had shared it with, unless this is impossible or involves disproportionate effort.

Complaint to the supervisory authority. If you believe we process your data in breach of the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live, work or where the infringement took place, or you can go to court.

12. Minors

The website is designed for transport businesses and professionals. It is not aimed at people under 18 and we do not knowingly collect their data. If you become aware that a minor has given us personal data, write to us and we will delete it.

13. Changes to this policy

We may update this policy when the website, our providers or the law change. The date at the top shows the version in force. If the changes are significant, we will tell you on the website.

For anything this policy does not cover, you can write to us at tech@truckscanner.it.