Data Handling

This page is the operator-facing companion to the Privacy Policy. It states, in concrete terms, what data we store, how long we keep it, and how to remove it.

Primary database

Supabase Postgres, AWS us-east-1 (Northern Virginia).

Object storage

Supabase Storage, same region. Holds invoice PDFs. Data exports are NOT stored here — they are generated on demand and streamed directly to the requester (see “Exporting your data”).

Application hosting

Vercel hosting and request processing. Runtime and diagnostic logs have retention controls separate from application records.

Email deliverability

Resend processes transactional email, delivery logs and bounce metadata. Provider retention is separate from application records.

SMS deliverability

Twilio processes operational messages and delivery information. Provider retention is separate from application records.

AI inference

Anthropic API processes submitted booking text and context, and optional assistant requests where enabled. We do not promise zero retention. See the Privacy Policy for the provider guidance.

Active records

Retention depends on record type, service needs and applicable accounting or legal obligations.

Soft-deleted rows

Soft deletion restricts access. The data is kept for 90 days so it can be restored.

Hard-deleted rows

Removal from the active database does not establish that every backup, stored file or provider copy has also been erased.

Database backups

Daily backups are kept for disaster recovery and are not used for day-to-day work. Stored files have separate retention controls.

Authentication and audit records

Kept for security, accountability and service needs under their applicable retention controls. Contact us about a specific record.

Export archives

Not retained. Exports are generated on demand and streamed directly to the requester as a download; the archive is never written to storage.

Owner and super-admin roles can request a ZIP archive from the admin surface. The archive contains the following comma-separated files, each scoped to the requesting organization:

• bookings.csv
• clients.csv
• client_preferences.csv
• drivers.csv
• invoices.csv
• invoice_line_items.csv
• affiliates.csv
• ride_extras.csv
• trip_batches.csv
• booking_groups.csv
• car_types.csv, ride_types.csv, rate_sheet.csv
• audit_trail.csv
• follow_ups.csv
• org_metadata.json

Exports are generated synchronously and streamed directly to your browser as a download — we do not email a link and do not store the archive. Only audit metadata (who requested the export, when, and its scope) is recorded.

Exports are rate-limited to one per hour per organization.

The authenticated workspace-deletion control is owner-only and requires confirmation of the organization code. Individual data requests can also be sent to support@luxdispatch.app without an app account. We may need proportionate identity or authority checks; never send passwords, sign-in codes or private trip links.

Soft deletion takes effect immediately. The organization and all child records become inaccessible to anyone who authenticates into the tenant. The super-admin team is notified by email. The data is kept for 90 days so the company can be restored if it was a mistake.

A request concerning one person does not require deleting an entire workspace. We review the relevant records, operator responsibilities and any accounting or legal retention limits before acting. See the Privacy Policy for the request process and retention limitations.

We give 30 days notice before adding or removing a subprocessor that handles operator or passenger data. Notice is delivered by email to the operator primary contact. A dated change log is published on the Subprocessors page.

Operators who need a signed DPA can request one at support@luxdispatch.app. We countersign the standard contractual clauses appropriate to the operator jurisdiction.

When our carriers (Twilio for SMS, Resend for email) call our webhooks with delivery-status and inbound-message events, we store the raw callback payload for diagnostics and abuse investigation. These webhook records, including the stored payload, are automatically deleted 90 days after they are received.

Data handling inquiries and urgent incidents: support@luxdispatch.app.