Privacy Policy
Kang TMS ("Kang", "we") is software for trucking carriers. A carrier ("you") uses Kang to run its trucks: loads, drivers, compliance papers, invoices and pay. This policy says what data Kang reads, why, where it is kept, who it is shared with, and how to have it deleted.
1. What Kang reads
- What you put into Kang: loads, customers, drivers, trucks and trailers, pay plans, and the papers you upload.
- A Gmail or Microsoft 365 mailbox you connect (sections 3 and 4): the email messages and attachments in it.
- Telegram truck groups you add Kang's bot to (section 5): the messages, photos, voice notes and files posted in them.
- Data you connect from other services: your ELD (truck locations and hours of service), your fuel cards, your factoring company, QuickBooks, and public FMCSA records.
- Drivers' own entries on Kang's driver links: the driver application, signatures, and papers the driver sends.
2. How Kang uses it
Only to do the carrier's work in Kang: build loads from rate confirmations, file bills of lading, proofs of delivery and receipts, keep drivers' qualification files and expiry dates, answer brokers' status questions from the ELD, prepare invoices, settlements and tax returns, and check every assignment against federal rules. Kang does not sell data, does not use it for advertising, and does not build profiles of anyone for any other purpose.
3. Google user data (Gmail)
Kang TMS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What Kang accesses
When a carrier connects a mailbox, Kang asks Google for access to read and organise it (gmail.modify) and to
write drafts and send replies (gmail.compose). Kang reads
the messages and attachments that arrive in that mailbox, and, once, the last 90 days of messages — including what the person sent
and archived, so Kang learns who in the company handles what.
How Kang uses it
Kang's AI staff do the inbox duty in the mailbox. Kang reads each message and gives it one outcome:
- Filed: what the message carries goes into the carrier's records in Kang — a rate confirmation becomes a load, a signed bill of lading the load's proof of delivery, a driver's medical card goes to the driver's file.
- Done: a routine request, such as a broker asking for the carrier's insurance certificate, is answered from the carrier's file.
- To the team: a message that belongs to a coworker is handed to them (below).
- Needs you: a message that needs the person's judgement gets a reply drafted for them, in Kang and in their Gmail Drafts.
- Archived: advertising and newsletters are marked read and archived; phishing is flagged.
Kang labels each message in Gmail with what it did ("Kang/Filed", "Kang/Done" and so on), marks it read and archives it, so the inbox stays empty and nothing is lost: every message stays in the mailbox under its label. Kang creates drafts, and it sends an email only when the person taps Send, or for a kind of reply the person (or the carrier's owner) has put on auto. Kang never deletes email. A message from a government agency, a court, an insurer, a drug-testing service or an ELD provider is never archived without a person.
How Kang stores it
Each message is stored encrypted at rest in the carrier's own space in Kang (US data centers), separated from every other carrier by database row-level security. Kang keeps a fingerprint (SHA-256) of each message so the same message is never stored twice. Access tokens from Google are kept encrypted and are used only to read the connected mailbox.
Who it is shared with
- AI model providers that read papers for Kang: Anthropic and Microsoft Azure AI. They receive a message or attachment only to read it for the carrier — for example, to pull the pickup and delivery from a rate confirmation — under their commercial terms, which do not allow them to train their models on it. Kang asks each for zero data retention.
- The carrier's own coworkers: when a message belongs to a coworker, Kang sends that coworker a one-line description of it through Telegram, with the message itself one tap away inside Kang, behind sign-in.
- Kang's hosting, storage and email-delivery providers (Microsoft Azure, Supabase, IDrive e2, Cloudflare, Resend), only to run Kang.
- No one else. Kang does not sell Google user data, does not use it or transfer it for advertising, does not use it to determine credit-worthiness or for lending, and does not allow humans to read it, except: with the carrier's permission for a specific message; when needed for security (for example, investigating abuse); to comply with law; or when the data has been aggregated and anonymized for Kang's internal operations.
- Kang does not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models.
Disconnecting and deleting
A carrier can disconnect Gmail in Kang (Settings → Mailbox) or at myaccount.google.com/permissions. Kang then stops reading and organising the mailbox at once. Email that Kang stored is deleted within 30 days of a written request to [email protected], except a paper that became part of a record the carrier must keep by law (for example, a driver qualification file under 49 CFR 391.51), which is kept for the period the law requires.
4. Microsoft 365 mailboxes (Outlook)
When a carrier connects a Microsoft 365 mailbox, Kang asks Microsoft for permission to read and organise the mail
(Mail.ReadWrite) and to send mail as the person (Mail.Send), and to keep that access while the person is away
(offline_access). Kang does the same inbox duty there as in section 3: one outcome for each message, marked read and moved
out of the inbox under a "Kang" category, drafts in the person's Drafts folder, and email sent only on the person's tap or under a
kind of reply they put on auto. Kang never deletes email. The same sharing and deletion rules as in section 3 apply. A carrier can
disconnect in Kang (Settings → Mailbox) or at myapps.microsoft.com.
5. Telegram truck groups
When a carrier adds Kang's bot to a truck group, the bot posts and pins a notice saying it reads and saves everything posted in the group for the carrier's records. Kang reads the group's messages and files to do the work in section 2. A group Kang cannot match to a truck or driver within 24 hours is forgotten: nothing from it is kept. Drivers applying through Kang acknowledge this notice on the application.
6. Drivers' personal data
Social Security numbers and dates of birth are encrypted at rest, are never written to Kang's own logs, and are shown masked in the office. Motor vehicle records are handled under the Driver's Privacy Protection Act: every read is logged with who read it, for what purpose and when, and every disclosure to a provider that reads it for Kang is recorded.
7. Security
Data is encrypted in transit (TLS) and at rest. Each carrier's data is separated by row-level security that the database enforces. Compliance papers are kept in storage that cannot be overwritten. Access by Kang staff is limited, logged and reviewed.
8. Retention
Kang keeps the carrier's records for as long as the carrier uses Kang and for the periods federal rules require (for example, 49 CFR 391.51, 395.8 and 396.3). When a carrier leaves, its data is deleted within 90 days of a written request, except records the law requires the carrier to keep, which are returned to the carrier first.
9. Your choices
You can see, correct, export or delete your data by writing to [email protected]. You can disconnect Gmail, remove Kang's bot from a group, or disconnect any service at any time.
10. Changes and contact
If this policy changes, the new version is posted here with its date, and carriers are told in Kang before it applies. Questions: [email protected].