Privacy policy

1. What this document covers

This policy covers every part of eCMR One: the public information pages, the free CMR PDF generator, the transport application and the document signing links. It does not cover third-party sites we link to, including the eCMR Hub SDK product site.

We have not appointed a data protection officer. Write to the data protection address in the table above for anything concerning personal data.

2. The free CMR generator (PDF)

The generator at /pl/generator and /en/generator runs entirely in the browser. What you type — sender, consignee and carrier details, the route, the cargo description and remarks — stays in the memory of the open tab. The PDF is assembled locally from a template that was downloaded earlier as an ordinary static file.

Form content is never sent to our server, never stored in a database and never visible to us. Reloading or closing the tab clears it. You do not need an account or an email address to use the generator.

Only the standard requests for the page's files reach the server; these are described in the server logs section.

3. Local application storage

The application at /app requires sign-in. A local copy of drafts, company data and templates is stored in your browser's IndexedDB (ecmr-panel-v1), separately for each account. A document signing link can be opened without an account.

Drafts created in an earlier version without an account are copied to your account at sign-in without overwriting existing documents. Clearing site data removes local copies and changes that have not reached the server.

4. Accounts, sign-in and access security

Creating an account requires an email address and a password. For this we process: the email address, a password hash stored by Supabase Auth (the password is not stored in the database as plain text), the account identifier and the identifier of its separate data area (tenant), the address verification flag, one-time verification and password-reset tokens, and session records.

Supabase Auth runs sign-in on our infrastructure. A short-lived access token is renewed within the session. Signing out revokes the current session; password recovery revokes the account’s existing sessions. The server checks that the session still exists even before its token expires. Sign-in rate limits help prevent brute-force attacks.

Legal basis: Article 6(1)(b) GDPR (performance of the service contract) for running the account, and Article 6(1)(f) GDPR (our legitimate interest in securing the service) for sign-in rate limits and session revocation.

5. Transport documents and third-party data

Once you are signed in, drafts and issued documents sync with the server. They contain the data you enter yourself: names and addresses of the sender, consignee and carrier, loading and delivery places, vehicle registration numbers, the cargo description and weight, document numbers, remarks, and the names of the people signing.

For that content you, the account holder, are the controller of your business partners' and drivers' personal data, and we act as a processor on your instructions. The processing terms, compliant with Article 28 GDPR, are in section 11 of the Terms of service. The document's evidence package and signatures made from a link are different: we decide their scope, retention period and immutability. Section 6a sets out the roles.

Each account's data is isolated at database level by PostgreSQL row-level security. The role the application runs as does not own the tables, is not a database superuser and cannot bypass those policies.

5a. Optional shipment tracking

After the driver starts sharing, the mobile app collects GPS position, measurement time, accuracy, speed and bearing, including in the background. Data reaches our database through the Traccar SDK. We also store the supplied driver name, device changes and estimated route, stops and durations. This operational data is separate from CMR evidence and is not a record of working hours.

The company can review history; recipient link holders only see the current shipment view. The driver or company can end sharing. It also ends on recipient confirmation or after seven days. Detailed positions are deleted 30 days after the session ends; summaries and events after one year. Deleting the last company account removes its tracking data.

The phone may retain unsent positions until connectivity returns. Maps are loaded from OpenFreeMap, whose servers receive the device IP address and requested map areas. Optional HERE routing, once enabled by the operator, receives the position, destination and vehicle parameters to estimate arrival. Link credentials and document contents are not sent to these services.

6. Signatures and consents given on the device

A signature on a document is made with a key generated in your browser. The P-256 private key is created locally, cannot be exported and never leaves the device.

Only the signed assertion reaches the server: the consent identifier, the digest of the document version, the signer's role, the name they supplied, the wording of the statement, the time from the device clock, the normalised signature strokes, the consignee's reservations (if entered) and the public key. We record our own receipt time alongside it. The application cannot alter or delete consent records.

Signing links are issued as scoped tokens, pinned to one document and one role and valid for 7 days; you can revoke them at any time.

We do not collect the device location when a signature is made. The legal basis for processing signature data is Article 6(1)(f) GDPR: the legitimate interest of the parties to the transport and ours in proving that the contract of carriage was concluded and performed, and in establishing, exercising or defending legal claims. A person signing from a link sees a summary of this information on the signing screen; it is information, not a request for consent.

6a. Who is the controller for each operation

“We” here means the service provider: Łukasz Piera, trading as the sole proprietorship identified in the table above, who runs eCMR One. We determine the role separately for each operation, depending on who decides its purpose and essential means:

• Driver accounts, issuing transport documents and their content, sending a signing link by text message or email, optional shipment tracking: the company running the Account is the controller and we are its processor (Article 28 GDPR).
• The document's evidence package, meaning the consent and signature records with the signer's name, the signature record, the device public key, the device time and receipt time, the document and PDF digests and time stamps, including signatures made from a link by people outside the Account (for example a sender's or consignee's warehouse worker, or a driver): we process it as a joint controller with the company that issued the document and sent the link (Article 26 GDPR). We decide the scope of this data, how long it is kept, and that the record cannot be changed or deleted from the Account.
• Service security, server logs, running the Account as a contract with us, and billing: we are the controller.

The essence of the joint controllers' arrangement for the evidence package (Article 26 GDPR):

• The provider informs signers about the processing (the link signing screen and this policy).
• The provider receives and handles data subject requests concerning the evidence package. The contact point is the data protection address in the table above.
• The company that sent the link is responsible for the content of the transport document and for being entitled to give us the link recipient's phone number or email address; it forwards to us without undue delay any request it receives concerning the evidence package.
• The provider is responsible for the security, integrity and retention period of the evidence package and for notifying breaches that affect it.
• Whatever the arrangement, you may exercise your rights against either of us.

7. Email messages

We only send messages needed to run an account: email address verification and password reset. We run no newsletter and no marketing mail.

Supabase Auth sends account messages through the configured mail provider. Email verification and password recovery depend on delivery; contact support if mail cannot be delivered.

8. Server logs

The servers behind the site and the API record standard technical request data: IP address, date and time, the requested resource, the response code, the browser type and a request identifier. This serves service operation, fault diagnosis and abuse detection.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the security and continuity of the service.

9. Retention periods

• Form content in the free generator — until the tab is reloaded or closed; it never reaches the server.
• Drafts stored locally without an account — until you delete them or clear the site data in your browser.
• Account data and synced documents — for the lifetime of the account; after it is closed we delete them without undue delay, and they disappear from backups as those rotate, no later than 30 days.
• Session access: until expiry or revocation; the access token expires after one hour and can be refreshed within an active session.
• Verification, password-reset and signing-link tokens — until used or expired.
• Evidence package (the document, its versions and history, consent and signature records): 6 years from the end of the year of the transport, counted as the year of the document's last event, and longer if there is a dispute, until it is resolved (dispute hold). The database computes this date for every document; the earliest dates fall at the end of 2032.
• The phone number or email address a signing link was sent to, together with the delivery record: 37 days after sending (the link expires after 7 days; the next 30 days are for resolving delivery questions), unless the document is under a dispute hold. Numbers that replied STOP are kept for as long as sending to them must stay blocked.
• Server logs — no longer than 12 months.
• Data needed to establish, exercise or defend legal claims — until the limitation period expires.

10. Recipients of the data

We do not sell data and do not share it for marketing. We use providers who process data only on our instructions, under data processing agreements:

• hosting for the public part of the site — Vercel Inc.;
• application server and database — infrastructure operated by the service operator; Cloudflare, Inc. handles traffic to the server;
• email delivery — Resend, Inc., only when delivery is enabled;
• maintenance and technical support providers, to the extent needed to service the system.

We may also disclose data to public authorities where the law requires it.

11. Transfers outside the EEA

Some infrastructure providers are established in the United States. Transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses, with additional technical measures including encryption in transit.

We provide a copy of the safeguards on request sent to the data protection address.

12. Cookies and browser storage

We use no analytics, no advertising and no cross-site tracking. We only use what the service needs to work, which is why we show no cookie consent banner.

• sb-…-auth-token: the Supabase session cookie, sometimes split into chunks. It stores tokens needed for sign-in and session refresh and is also read by application code in the browser. It uses SameSite=Lax and a renewable storage period of up to 400 days. Keeping the cookie does not grant access after the server revokes the session.
• ecmr_locale, ecmr-app-language and ecmr-app-theme: remember the website language, application language and theme.
• IndexedDB ecmr-panel-v1: local drafts, company details and the signing key. Account drafts, documents, contacts, vehicles, templates and default selections sync with the server. A local copy supports offline work; the private signing key stays exclusively on the device.
• Service worker cache — only the public static files needed for the form and PDF generation. It never stores the application's HTML or API responses.

You can clear cookies and site storage at any time in your browser settings. Clearing site data also erases locally stored drafts.

13. Your rights

You have the right to access your data and obtain a copy, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on our legitimate interest.

You can also export a copy of your application data yourself at any time, from the transport list view.

Send requests to the data protection address. We reply without undue delay and within one month at the latest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your country of residence.

If your data appears in the content of a transport document issued by one of our users, that user is the controller and your request should go to them; on request we will point you to the right contact. We handle requests about the evidence package, including a signature made from a link, ourselves (section 6a). The right to erasure does not cover data needed to establish, exercise or defend legal claims.

14. Is providing data voluntary

Providing data is voluntary but necessary for certain features. Without an email address and password you cannot create an account or sync documents across devices. You can use the CMR generator without an account; form content is not sent to the server.

15. No profiling

We take no decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.

16. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS), secure storage of password hashes, token and active-session verification, per-account isolation at database level, operation permissions, request size limits and restricted database roles.

The service is in testing. Despite these measures we do not recommend keeping the only copy of business-critical documents here — use the data export.

17. Changes to this policy

We may change this policy when the service or the applicable law changes. A new version applies from the day it is published on this page. We notify account holders of material changes by email in advance.