Privacy Notice

When HaulStory is controller or processor

HaulStory is the controller of personal data that we process for our own purposes. That includes website visits, sales contacts, walkthrough bookings, account administration, service security, and our own business operations.

HaulStory generally acts as a processor for connected customer email, attachments, transport records, extracted transport data, and other customer content that we handle under a customer’s instructions. In that case, the customer determines the purposes and the legal basis.

If your request concerns content controlled by a HaulStory customer, we may need to direct you to that customer.

Personal data we receive and where it comes from

Depending on how you interact with HaulStory, we may receive:

• Contact and company details, such as name, work email, company, and message
• Walkthrough-booking and sales correspondence, including scheduling details and follow-up
• Account and authentication data, such as login identifiers and account settings
• Product usage, support, device, log, and security data
• Personal data contained in connected email, attachments, and transport records, which can include names, email addresses, signatures, and other details written in those materials

This data may come from you, your employer, a HaulStory customer, connected mailboxes, and our service providers.

Why we use personal data and our legal bases

We do not rely on consent for the processing described in this notice.

• Enquiries and walkthrough bookings: steps you request before entering a contract, and our legitimate interest in responding to business enquiries.
• Follow-up with people who contacted us: legitimate interests.
• Account administration, service delivery, and customer support: performance of the customer agreement and legitimate interests.
• Authentication, service security, and fraud or abuse prevention: legitimate interests, and legal obligations where applicable.
• Website measurement with cookie-free Vercel Analytics: legitimate interest in understanding and improving website use.
• Accounting and other records required by law: legal obligations.
• Customer email, documents, and transport content: we act as processor under the customer’s instructions. The customer determines the legal basis.

We use AI to extract, classify, summarize, and recommend, so that people can work with documented transport history. We do not make solely automated decisions that have legal or similarly significant effects on individuals. People remain responsible for operational decisions.

Who receives personal data

We do not sell personal data.

For this website:

• Calendly processes walkthrough bookings
• Vercel Analytics measures website use

For the HaulStory product, personal data may be received by the providers we use to operate the service:

• Vercel — application and website hosting
• MongoDB / MongoDB Atlas — application database and search data
• AWS (S3) — attachment and document storage
• OpenAI API — extraction, classification, matching, embeddings, and Assistant processing
• SendGrid — inbound and outbound email handling
• Upstash QStash — background-job delivery and scheduling
• Google Maps and Google Cloud services — maps, geocoding, places, directions, and route-related processing

For Google Maps Platform, Google and HaulStory act as independent controllers for data collected through Maps services.

We may also disclose personal data when required by law, or in connection with a company transaction such as a merger or sale of assets.

Neither HaulStory nor OpenAI uses customer content submitted through the OpenAI API to train models. HaulStory does not use customer content to train its own models.

International transfers, retention, and security

Some of our service providers may process personal data outside the European Economic Area. Where this happens, we use safeguards recognized under applicable data-protection law, including adequacy decisions, the EU-US Data Privacy Framework where applicable, and the European Commission’s Standard Contractual Clauses.

We retain personal data according to these criteria:

• Customer content: while we provide the service. Customers may request deletion of email, documents, and extracted transport data. Timing and scope are agreed with each customer.
• Enquiries and Calendly bookings: while the conversation or potential business relationship remains relevant, then we delete them.
• Account records: while the account or customer relationship is active, then we delete or anonymize them when they are no longer needed.
• Security and application logs: only while needed for security, troubleshooting, and abuse prevention, following the normal log-rotation cycle.
• Backups: deleted data may remain until it is overwritten through the normal backup cycle.
• Legal and accounting records: for the period required by applicable law, or for establishing, exercising, or defending legal claims.

We restrict access to personal data and use technical and organisational measures to reduce the risk of unauthorised access, loss, or misuse. For more about how we protect information, see the Security page.

Cookies and analytics

We use Vercel Analytics to understand how this website is used so we can improve it. That measurement is based on our legitimate interest. It does not use advertising cookies, cross-site marketing tracking, or other non-essential cookies or similar storage.

We also keep a daily total of how many times visitors choose See HaulStory in action. That total is stored in our application database without the visitor's IP address, email, cookies, URL, referrer, or other identifiers. It is not used for advertising.

We do not currently set non-essential cookies. Because of that, this site does not show a cookie consent banner or a Cookie settings control.

If we later add non-essential analytics or marketing cookies, we will ask for consent before activating them and update this notice.

Your rights

Depending on the context and legal basis, you may have the right to:

• access your personal data
• correct inaccurate personal data
• delete personal data
• restrict processing
• object to processing
• receive personal data in a portable form
• withdraw consent, where processing is based on consent

These rights are not absolute. They depend on the situation and the legal basis.

To make a request, email privacy@haulstory.ai. We may need to verify your identity. If your request concerns customer-controlled content, we may need to refer you to the relevant customer.

You also have the right to complain to a data-protection authority. For Medulla Ltd, the relevant authority is Bulgaria’s Commission for Personal Data Protection.

Changes and contact

This notice was last updated on 20 September 2026.

If we make material changes, we will communicate them through an appropriate channel, such as this page or email. We do not promise a fixed notice period.

Privacy contact:

You may also contact Bulgaria’s Commission for Personal Data Protection.