Privacy Policy

1.Who we are

The Sarbon software is made and owned by Sarbon TMS LLC. JOMA Cargo Inc (Joma Cargo Inc, 8153 Garnet Drive, Suite F, Dayton, OH 45458), a trucking company, uses it to run its own fleet office. JOMA Cargo Inc decides what information is kept and why, and is responsible for it (the “data controller”). In this policy, “we” means JOMA Cargo Inc.

2.What Sarbon is

Sarbon is an internal transportation-management web app at sarbon.io, with three companions:

• a Chrome extension, “Sarbon — EZLoads sync”, which has its own page: Chrome extension privacy;
• our Telegram assistant, “Sardor”, which works in the company’s Telegram groups;
• the “JOMA Driver” app, a Telegram Mini App that drivers open from a button in Telegram.

Sarbon turns Amazon Relay loads and payments into EZLoads imports and keeps the fuel, toll, repair, dispute, safety, document and settlement records that go with them.

3.Who may use it

Sarbon is for JOMA Cargo staff and drivers only, and for people 18 or older. It is not directed at customers or at children. There is no open sign-up: a person can ask for a staff account on the sign-in page, and the company decides. Drivers do not get a staff account; they use the JOMA Driver app.

4.Staff accounts and security

For each staff account we keep a name, an email address, a job role and a password. The password is stored only in scrambled (hashed) form by our sign-in provider, Supabase, so we cannot read it. Staff set their own password through a one-time link; the company never sees or sets it.

When someone asks for access, we keep what they type in the form (name, email, phone, the kind of work, a short note) and a scrambled code made from their internet (IP) address, used only to stop the form being flooded. The address itself is not stored.

After you sign in, a session cookie keeps you signed in. If you tick “Keep me signed in on this computer” you stay signed in until you sign out; if you untick it (for a shared computer), you are signed out after 15 minutes without use.

Sarbon records an activity log of what staff do in the app, such as who imported a file, edited a record or opened a driver document, and when. We use it to see who did what, to fix mistakes and to keep the system safe. How staff may use Sarbon is set out in the Terms of Use.

5.Data we store and why

We store what the company needs to run its business and meet its obligations:

• Staff accounts: name, email, role, hashed password, access requests, and the activity log.
• Amazon Relay data: the load, trip and payment files that staff upload, and the results of matching them to what was paid.
• Driver records and documents: see sections 6 and 7.
• Truck records: VIN, plates, registrations, inspections, permits and similar dates.
• Partners: the companies drivers and owner-operators are paid through: name, address, contact details and only the last four digits of their tax number. The full number stays with our accountant.
• Fuel: card transactions with the last four digits of the card, truck, gallons and amounts. We do not store full card numbers.
• Tolls: toll transactions and transponder numbers.
• Repairs: repair invoices, shop, amount and who paid.
• Disputes: loads we are disputing with Amazon, and their status.
• Safety events: warning letters and accidents.
• Settlements: pay summaries for drivers and owner-operators.
• Messages: notes and messages that drivers and dispatch send to “Sardor”.
• Samsara data: trip and position data from the trucks’ ELD devices, and miles by state.

We use this information to run dispatch and payroll, check that Amazon paid correctly, prepare tax and other reports, track compliance dates, and keep the company’s records. We do not use it for advertising, and we do not sell it.

6.Driver and employee data

The driver and employee information in Sarbon is JOMA Cargo’s own human-resources and fleet data. It can include names, phone numbers, email and home addresses, date of birth, CDL numbers and dates, medical-card dates, drug-test status, pay rates and escrow balances. It is kept so the company can dispatch and pay its drivers and keep them compliant with the rules for operating commercial vehicles.

Only signed-in JOMA Cargo staff with a work reason can see it.

7.Driver documents, the JOMA Driver app and Telegram groups

What we collect. Drivers send photos and files to the company, either in the JOMA Driver app or in the company’s Telegram groups, where “Sardor” picks them up. These can be photos or scans of a CDL, medical card, drug-test result, MVR, truck registration, inspection report, insurance card, fuel and toll receipts, repair invoices, tickets and citations, and accident or damage photos. With each one we keep who sent it, when, and in which group, including the sender’s Telegram name and Telegram user number. When a driver opens the JOMA Driver app, Telegram tells us their Telegram name and user number so we know which driver it is.

Why. To keep each driver’s and truck’s file up to date, to pay drivers correctly (receipts, invoices), for safety, and to meet the record-keeping rules for trucking companies, such as expiry dates that must be renewed on time.

Reading the documents. To save typing, each document is read automatically by an AI service from a processing provider, OpenAI, which fills in the type of document, names, numbers and dates. For now, staff check what it found before it changes a driver’s or truck’s record. We send only the document and what is needed to read it. OpenAI’s business terms, as they stand when we write this, say that information sent through its business service is not used to train its models and is kept only for a limited time, for example to detect abuse. We do not use the documents for advertising.

Who sees them. JOMA Cargo staff only, when signed in to Sarbon; each staff account has a job role so access can be limited to the people whose work needs it. In the JOMA Driver app, a driver sees only their own documents and pay.

Where they are kept. In private storage with our database provider in the United States. Files are never public: they open through short-lived links, and every time staff open a driver document it is recorded.

How long. While the driver works or drives for us, and afterwards for as long as required by law, such as the FMCSA rules for driver-qualification files and the tax rules for pay records. Photos that turn out not to be documents (for example a picture of the road) are not filed.

A copy or a correction. A driver can ask the office for a copy of what we hold about them, or for something wrong to be corrected, using the contact details in section 13. We will show you what we have and fix what is wrong.

8.Third-party services

Sarbon relies on the services below. We send or receive only what is needed for the job.

• Amazon Relay: our source of load and payment files. Staff download them there and upload them to Sarbon.
• EZLoads: our dispatch system. Through the Chrome extension, Sarbon reads drivers, trucks, locations and loads, and adds locations and loads.
• AtoB and Fleet One: our fuel cards. Fuel transactions come in through the extension or in files staff upload.
• PrePass: our toll account. Staff upload its toll file.
• Samsara: our ELD provider. Sarbon reads trip, position and mileage data from it.
• Telegram: the messaging app that “Sardor” and the JOMA Driver app run in. Messages, photos and files sent there pass through Telegram.
• OpenAI: reads driver documents and receipts to fill in their details (section 7).
• Google Drive: where the dispatch sheet and some company spreadsheets are kept. Sarbon reads them.
• Vercel: hosts the Sarbon app, in the United States.
• Supabase: hosts the database, file storage and sign-in, in the United States.

Each of these has its own privacy practices. Sarbon does not send email of its own; the only email is the password-reset link our sign-in provider sends when you ask for one. We do not sell data, and we do not share it with advertisers or data brokers. We may disclose information if the law requires it or to protect the company’s legal rights.

9.Cookies

Sarbon uses only the cookies it needs to work: the one that keeps you signed in, one that remembers whether you chose “Keep me signed in on this computer”, and, in the JOMA Driver app, one that keeps the driver signed in. There are no advertising or tracking cookies, and no third-party analytics.

10.Retention

We keep records for as long as the company needs them to run the business, pay drivers, handle disputes, and meet tax, safety and other record-keeping requirements, and as long as the law requires. When a record is no longer needed, we remove it. When a staff member leaves, we turn off their account; their entries in the activity log may be kept so the history stays accurate. If you think we hold something we should no longer have, ask us.

11.Security

Passwords are hashed. Data travels over encrypted connections and is held by Vercel and Supabase in the United States. Access is limited to signed-in staff, document files are private, and staff accounts can be switched off at once. The Chrome extension uses a personal key that can be revoked. No system is perfectly secure, so we cannot promise absolute safety, but we take reasonable care and act quickly on problems we learn about.

If you notice anything suspicious, such as an account used by someone else, tell us at once.

12.Changes

We may update this policy. The date at the top shows the latest version, and we will tell staff and drivers about changes that matter.

13.Contact

Questions, or want to see or correct what we hold about you? Reach us here:

Joma Cargo Inc, 8153 Garnet Drive, Suite F, Dayton, OH 45458
jomacargousa@gmail.com · (513) 760-5662