Data Handling

This page is the operator-facing companion to the Privacy Policy. It states, in concrete terms, what data we store, how long we keep it, and how to remove it.

Primary database

Supabase Postgres, AWS us-east-1 (Northern Virginia).

Object storage

Supabase Storage, same region. Holds invoice PDFs. Data exports are NOT stored here — they are generated on demand and streamed directly to the requester (see “Exporting your data”).

Application hosting

Vercel edge network. Request bodies are processed in transit and not retained at the edge.

Email deliverability

Resend (US). Stores send logs and bounce metadata for 30 days.

SMS deliverability

Twilio (US). Stores message status for 13 months per Twilio policy; operators can shorten via a data-deletion request to Twilio.

AI inference

Anthropic API. No data retention beyond the duration of the inference request under our subscription plan.

Active rows

Life of the account.

Soft-deleted rows

30 days. Recoverable by contacting support during the window.

Hard-deleted rows

Not recoverable. Removed from the primary database and will roll off backups within seven days.

Point-in-time backup

7 days for the primary database.

Authentication logs

90 days.

Audit-trail rows

2 years (730 days). A weekly retention sweep hard-deletes older rows.

Export archives

Not retained. Exports are generated on demand and streamed directly to the requester as a download; the archive is never written to storage.

Owner and super-admin roles can request a ZIP archive from the admin surface. The archive contains the following comma-separated files, each scoped to the requesting organization:

• bookings.csv
• clients.csv
• client_preferences.csv
• drivers.csv
• invoices.csv
• invoice_line_items.csv
• affiliates.csv
• ride_extras.csv
• trip_batches.csv
• booking_groups.csv
• audit_trail.csv
• follow_ups.csv
• org_metadata.json

Exports are generated synchronously and streamed directly to your browser as a download — we do not email a link and do not store the archive. Only audit metadata (who requested the export, when, and its scope) is recorded.

Exports are rate-limited to one per hour per organization.

Only the owner role can initiate deletion. The request must be confirmed by typing the organization code into the confirmation prompt. We do not accept deletion requests by email because we cannot verify the requester without the authenticated session.

Soft deletion takes effect immediately. The organization and all child records become inaccessible to anyone who authenticates into the tenant. The super-admin team is notified by email.

Hard deletion runs on the nightly cron at 03:00 UTC and removes any organization whose deleted_at timestamp is older than 30 days. After hard deletion, the only traces of the organization are a row in data_deletion_audit and the entries in our backup rotation, which roll off within seven days.

We give 30 days notice before adding or removing a subprocessor that handles operator or passenger data. Notice is delivered by email to the operator primary contact. A dated change log of subprocessor additions lives in the product repository.

Operators who need a signed DPA can request one at hello@luxdispatch.app. We countersign the standard contractual clauses appropriate to the operator jurisdiction.

When our carriers (Twilio for SMS, Resend for email) call our webhooks with delivery-status and inbound-message events, we store the raw callback payload for diagnostics and abuse investigation. These webhook records, including the stored payload, are automatically deleted 90 days after they are received.

Data handling inquiries and urgent incidents: hello@luxdispatch.app.