Novio ELD LLC, an Ohio limited liability company (“Rivox”, “we”, “us”), provides Rivox TMS, a transportation management system for trucking companies, at rivoxtms.com (the “Service”). This policy explains what information we collect, how we use it, and the choices you have. It applies to the web application, the Rivox driver mobile app, and the Rivox browser extension.
1. Information we collect
- Account information. Name, email address, phone number and role, provided when you or your company administrator creates your account. Sign-in for office users is handled by our authentication provider (Clerk).
- Company and operations data. Loads, brokers, customers, trucks, trailers, drivers, documents (rate confirmations, bills of lading, proofs of delivery), invoices, settlements, fuel and toll records, and messages that your company enters into or uploads to the Service.
- Location data. Truck positions from the ELD or telematics provider your company connects, and, where your company enables it, GPS positions reported by the Rivox driver app while a driver is on an assigned load.
- Connected mailbox data. If a user connects an email account (Google Gmail, Microsoft Outlook, or IMAP), we access that mailbox as described in section 3.
- Usage and device data. Log data such as IP address, browser type, pages visited and actions taken, used for security, troubleshooting and audit trails.
2. How we use information
- To provide, operate, secure and support the Service for your company.
- To dispatch loads, track shipments, generate invoices and driver settlements, and produce reports your company requests.
- To send transactional notifications (load assignments, document requests, invoice delivery) on behalf of your company.
- To bill your company for its subscription.
- To comply with law and enforce our Terms of Service.
We do not sell personal information and we do not use your data for advertising.
3. Connected email accounts (Google, Microsoft, IMAP)
Dispatchers can connect a work mailbox so that broker emails, especially rate confirmations, appear inside Rivox next to the loads they belong to. When you connect a Google account, Rivox requests the following Google OAuth scopes:
- Read email messages (gmail.readonly). Used to read messages and attachments in the connected mailbox in order to identify broker load emails and rate confirmations, group them into conversations, and extract load details (pickup, delivery, rate, reference numbers) into a load record for the dispatcher to review.
- Send email (gmail.send). Used only to send messages that a Rivox user composes or explicitly approves in Rivox, such as replying to a broker, returning a signed rate confirmation, or sending an invoice, from the connected address. If a company administrator turns on automatic broker updates, Rivox also sends load status updates (for example, arrived at pickup or delivered) as replies in the broker's rate confirmation thread for that load. Rivox never sends email from your account unless a user sent or approved it or an administrator turned that automation on; it can be turned off at any time in Settings.
- Email address (userinfo.email). Used to label the connection and prevent the same mailbox from being connected twice.
What we store. For each message we process we store the sender, subject, received time, message and thread identifiers, a short text snippet, the names of attachments, and the load information extracted from the message. Rate confirmation attachments that a user links to a load are stored as documents on that load. OAuth access and refresh tokens are encrypted at rest. We do not store full copies of your mailbox.
Automated processing. To extract load details from broker emails and PDF rate confirmations we use AI models hosted by our sub-processors (see section 5). The content sent for extraction is limited to the message and attachment being processed, and these providers are contractually prohibited from using it to train their models.
Who can see it. Mailbox data is visible only to users of the company that connected the mailbox. Rivox staff do not read your email except when you ask us for support, when required for security or abuse investigation, or when required by law.
Disconnecting. You can disconnect a mailbox at any time from Settings. On disconnect, Rivox deletes the stored OAuth tokens and stops all access. You can also revoke Rivox’s access from your Google Account permissions page. Previously extracted load records remain part of your company’s operational data unless you delete them.
Google API Services User Data Policy. Rivox’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide and improve the user-facing email features described above, is never used for advertising, is never sold, and is not transferred to others except as necessary to provide those features, for security, or to comply with law.
Microsoft and IMAP connections are used for the same purposes under the same limits. IMAP credentials are encrypted at rest.
4. Driver mobile app
The Rivox driver app is provided to drivers by their carrier. It collects the driver’s location while the app is active on an assigned load (and in the background where the carrier enables phone GPS tracking and the driver grants permission), photos the driver takes of paperwork and trailers, and delivery confirmations. This data belongs to the carrier and is used for dispatch, customer tracking, and settlement.
5. Sharing and sub-processors
We share data only with providers that help us run the Service, under contracts that restrict their use of it:
- Amazon Web Services (hosting, database, file storage, transactional email)
- Clerk (authentication for office users)
- Anthropic and Google (AI models used for document and email extraction)
- Mapbox (maps and routing)
- Plaid (bank connection, only if your company enables it)
- Stripe (subscription billing)
- ELD, load board, factoring and broker portals that your company chooses to connect
We may also disclose information when required by law, to protect the rights and safety of Rivox or others, or as part of a merger or acquisition (with notice to you).
6. Retention and deletion
Company data is retained for as long as the company has an active account and for a limited period afterwards to allow reactivation, after which it is deleted or anonymised. Connected mailbox tokens are deleted immediately on disconnect. A company administrator can request deletion of the company’s data at any time by contacting us.
7. Security
Data is encrypted in transit (TLS) and at rest. OAuth tokens and mailbox credentials are additionally encrypted at the application layer. Access is scoped to the user’s company and role, and security-relevant actions are recorded in an audit log.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to certain processing. Office users can update their own profile in the Service; drivers should contact their carrier. For anything else, email us at the address below and we will respond within 30 days.
9. Children
The Service is intended for businesses and is not directed to anyone under 18.
10. Changes
We will post any changes to this policy on this page and update the effective date. If a change materially affects how we handle connected mailbox data, we will notify company administrators by email before it takes effect.
11. Contact
Novio ELD LLC (Rivox) · support@rivoxtms.com