Privacy Policy

1Who this covers

Two groups use TrukRun. Operators are the food truck owners and staff who create an account, build a menu and run orders. Customers are the people who scan a truck’s QR code or open its link to order. Where a rule applies to only one group, we say so.

2What we collect

From operators

• Account details. Your email address, a password (stored only as a hash), and your name. If you sign in with Google, we receive your name, email address and profile picture from your Google account and nothing else.
• Truck details. Truck name, phone number, city, service locations and hours, menu items, prices and photos, promo codes, and settings such as pickup windows and pause rules.
• Menu photos. If you use menu import, the photo you upload is sent to an AI model to read items and prices. You review the result before anything is saved.
• Billing. Your plan, subscription status and invoice history. Card numbers are entered on Stripe’s pages and never touch our servers.
• Payouts. If you connect Stripe to take card orders, Stripe collects the identity and bank details it needs. We store only your Stripe account id and its readiness status.

From customers

• Order details. Your name, mobile number, the items you ordered, pickup time, notes, tip and how you paid. The truck sees this to make and hand over your order.
• SMS consent. Whether you ticked the box to receive order texts or go-live alerts, and when. Consent is never pre-ticked.
• Ratings and replies. A rating you send by text after an order, and any reply to a truck’s message.
• Nearby search. If you press “Find trucks near me” and allow location access, we round your location and send it with the directory search. The search link and standard hosting logs may contain that approximate location. We do not continuously track you. You can search by city instead.
• Catering requests. Name, phone, email, event date, guest count and notes you submit on a truck’s catering form.
• Payment. Card payments are processed by Stripe. We receive a confirmation and the last four digits at most; we never see or store a full card number.

Automatically

• Session cookies that keep an operator signed in. We do not load Google Analytics, Meta Pixel, advertising cookies or third-party analytics trackers. Optional analytics is disabled. Essential sign-in cookies do not require an analytics opt-in.
• Rate limiting. A salted hash of your network address for a short window, so one device cannot flood a truck with orders. The address itself is not kept.
• Logs. Standard server logs and an audit trail of order events (placed, cooking, ready, refunded) with timestamps.

3How we use it

• To run the service: show menus, take orders, route tickets to the kitchen screen, send order status texts, and pay trucks.
• To bill operators for their plan and to collect the TrukRun fee on card orders.
• To keep a customer’s order history with one truck so repeat orders are faster and the truck can recognise regulars.
• To answer support requests and to notify operators about their account, orders and payments.
• To detect abuse, enforce our terms and comply with the law.

We do not sell personal information, and we do not use customer data to advertise to customers.

4Text messages (SMS)

Customers only receive texts after ticking a consent box at checkout or on a truck’s “text me when they open” form. Messages are transactional and service-related: order accepted, order ready, running late, a request to rate the order, and go-live alerts from a truck you subscribed to. Message frequency varies with your orders and subscriptions. Message and data rates may apply.

Reply STOP to any message to opt out; you will get one confirmation and nothing further. Reply HELP for help, or email adam@smartscale25.com. Your mobile number and your consent are used only to send these messages. Mobile information is never shared with third parties or affiliates for marketing or promotional purposes. The messaging providers that carry our texts receive your number solely to deliver them.

5Who we share it with

We share data only with providers that help us run TrukRun, each under its own privacy terms and only for the purpose named:

• The truck you order from. Operators see the order details of their own customers, never another truck’s.
• Stripe for card payments, payouts and subscription billing.
• Supabase (database and sign-in) and Vercel (hosting), both in the United States.
• Messaging providers (our SmartScale messaging platform, with Twilio as a fallback) to deliver texts you consented to.
• Resend to email operators order pings and account notices.
• Anthropic to read menu photos an operator uploads for import.
• Google when an operator chooses Google sign-in.
• On Autopilot plans, an operator’s customer list is mirrored into that operator’s own SmartScale CRM account so they can follow up with their regulars. That account belongs to the operator.

We may also disclose information when the law requires it, to protect the rights and safety of trucks, customers or the public, or as part of a merger or sale of the business, in which case this policy continues to apply.

6Google sign-in and Google user data

If you sign in with Google, we request only your basic profile (name, email address, profile picture). We use it to create and identify your TrukRun account and to show your name in your dashboard. We do not read your Gmail, Calendar, Drive or any other Google data. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect Google from your account at any time at myaccount.google.com; your TrukRun account keeps working with an email and password.

7How long we keep it

• Operator accounts and truck data: while the account exists, then deleted within 30 days of a deletion request.
• Orders and payment records: seven years, as tax and accounting rules require, then deleted or anonymised.
• Customer profiles held by a truck (name, phone, order count): while the truck’s account exists, or until you ask us to remove yours.
• SMS consent records: at least four years after the last message, as carrier rules require, even if you opt out sooner.
• Menu photos sent for import: processed and not retained by us after the import completes.

8Security

Data is encrypted in transit and at rest. Access to production systems is limited to the people who run TrukRun and is logged. Card data is handled entirely by Stripe, a PCI Level 1 provider. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.

9Your choices and rights

• Operators can edit account and truck details in the dashboard and can ask us to delete the account and its data.
• Customers can opt out of texts at any time by replying STOP, and can ask us to delete the profile a truck holds for their number.
• Anyone can ask what data we hold about them, ask for a copy, or ask for a correction.

Email adam@smartscale25.com with your request. We may need to confirm you control the email address or phone number in question. We answer within 30 days. Residents of states with privacy laws (including California and Texas) have the rights those laws provide; we honour them for everyone and we do not discriminate for exercising them.

10Children

TrukRun is for adults running a business and for customers of legal age to order on their own. We do not knowingly collect information from anyone under 13. If you believe a child has given us data, email us and we will delete it.

11Changes

When this policy changes we update the effective date at the top. For material changes we email operators and show a notice in the dashboard before the change takes effect.

12Contact

Gangsta Geeks LLC dba TrukRun
Dickinson, Texas
adam@smartscale25.com