Privacy Policy

Road Guardian by Orpyxis Technologies · Last updated 29 October 2026

Last updated: 29 October 2026 · Effective: 29 October 2026

This policy explains how we collect and use your personal data when you use:

Road Guardian Finder, the app customers use to request towing and roadside help;
Road Guardian Truck, the app tow-truck drivers and operators use to receive and complete jobs;
the Road Guardian website, support channels and back-end services at https://rgs.orpyxis.com.

Together we call these the "Service".

1. Who we are

The data controller is Eman Curmi, trading as Orpyxis Technologies, 42, Triq it-Tin, Sannat SNT1443, Gozo, Malta.

Privacy questions and requests: [email protected]
General support: [email protected], or WhatsApp on +1 904 479 8353 (see section 8)
Post: Data Protection, Eman Curmi, trading as Orpyxis Technologies, 42, Triq it-Tin, Sannat SNT1443, Gozo, Malta

We have not appointed a Data Protection Officer because the law does not currently require us to. Please send all privacy matters to [email protected].

2. Summary

We collect the data needed to connect you with a tow or roadside operator, take payment and keep the Service safe.
Customers: Road Guardian Finder uses your location only while you are using the app, to set your pickup point.
Drivers: Road Guardian Truck shares your location only while you have an active job, including in the background and when your screen is locked. It stops when the job ends, when you log out and when you delete your account. While you are online without a job, no location is shared. We keep only your latest position, not a history of where you have been. The customer whose job you accepted can see it while that job is active.
Card payments are processed by Stripe. We never see or store your full card number.
We do not sell your personal data and we do not use it for advertising. The apps contain no analytics or tracking tools.
You can delete your account inside the app. Deletion happens straight away (section 12).

3. What we collect

3.1 Everyone

Account data: email address, password (stored only as a secure hash), name, optional username and profile photo, and your account type (customer or driver).
Compliance records: which terms and policies you accepted and when, and a record of any data export you requested.
Technical and security data: IP address and device details recorded with your login sessions and consents, login and session records, and technical records of requests the apps make to our servers.
Push notification token, if you allow notifications.
Support messages and feedback: the content of emails or WhatsApp messages you send us, any screenshots or attachments, and feedback you send in the app.
No analytics or tracking: the Road Guardian apps contain no analytics, crash-reporting or tracking SDKs, and our servers set no cookies.

3.2 Customers (Road Guardian Finder)

Vehicles: registration plate, make, model, colour, year and fuel type.
Requests: pickup location (GPS coordinates or an address you enter), destination, service type, truck type needed, price, status, completion code, timestamps and any notes you add.
Payments: amount, currency, payment status, any refunds, and Stripe payment references. Stripe gives us limited card details such as card brand and last four digits, never the full number.
Ratings and feedback you give about a job.

3.3 Drivers and operators (Road Guardian Truck)

Identity and eligibility: name, contact details, and the operator business you work for.
Trucks: plate, make, model, capacity, equipment type, status and truck photo.
Location: your latest GPS position, sent only while you have an active job (section 6).
Jobs: jobs you accepted and completed, and their timings.
Earnings and settlement: job values, the fee split (section 7), amounts owed to and by you, and payout records. Operators give bank details to Orpyxis for payouts (for example account holder name and IBAN); these are not collected through the apps.
Tax reporting data, where the law requires it: legal name, address, tax identification number, date of birth (individuals) or company number (businesses), and total payouts. EU platform reporting rules (DAC7) may require us to ask you for this and report it to the Maltese Commissioner for Revenue.

4. Why we use your data and our legal basis

Purpose	Examples	Legal basis (GDPR Art. 6)
Providing the Service	Accounts, creating requests, showing open jobs to drivers with a matching truck type, prices, showing the customer the driver and truck who accepted the job	Contract (6(1)(b))
Driver location during an active job	Showing the customer where their assigned truck is while the job is active; letting authorised Orpyxis staff see where the truck is, to support the job and help with problems or disputes about it	Contract (6(1)(b)); legitimate interests (6(1)(f)) in safe, reliable jobs
Taking payment and paying operators	Charging the customer at booking, manual refunds, calculating the operator share and our fee, manual payouts	Contract (6(1)(b))
Accounting and tax	Financial records, tax authority reporting (including DAC7 where it applies)	Legal obligation (6(1)(c))
Safety, fraud prevention and disputes	Session checks, misuse of completion codes, chargebacks, complaints about a job	Legitimate interests (6(1)(f))
Customer support	Answering emails and WhatsApp messages, handling privacy requests	Contract (6(1)(b)); legal obligation (6(1)(c)); legitimate interests (6(1)(f))
Service emails and notifications	Password and account emails, new-job alerts for drivers, job status updates for customers	Contract (6(1)(b))
Marketing	We do not currently send marketing. If we introduce it, we will ask for your consent first.	Consent (6(1)(a))

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details and you can object (section 13).

Automated processing: the app calculates prices automatically, lists open jobs to drivers newest first, filtered by truck type, and sends new-job alerts to every driver whose truck type matches. We do not make decisions with legal or similarly significant effects about you based solely on automated processing. If you think something went wrong, contact [email protected] and a person will review it.

5. Customer location (Road Guardian Finder)

We ask for location permission "While Using the App" only. We do not track customers in the background.
We use your location to set your pickup point and price your request. You can enter an address by hand instead.
To show your pickup as an address, the app sends the pickup coordinates to OpenStreetMap's Nominatim service (section 9).
Your pickup and destination are shared with the driver and operator who accept your job.
While your job is active, you can see your assigned driver's live position on a map. You can no longer see it once the job ends.

6. Driver location (Road Guardian Truck)

Permission: when you open an active job, iOS asks you to allow location access. If you choose "Always", sharing continues in the background. You can change this at any time in iOS Settings.
When location is shared: only while you have an active job. With "Always" allowed, the app sends your position to our server about every 15 seconds or every 25 metres, including in the background and when your screen is locked, and iOS shows the location indicator. If you allow location only "While Using the App", your position is shared only while the job screen is open. While you are online without a job, no location is shared.
When it stops: when the job ends, when you log out and when you delete your account. While you are online without a job, no location is shared.
What we keep: only your latest position. Each update replaces the previous one, so we do not keep a trail or history of your movements. The latest position stays on our server after the job ends, until a newer update replaces it or you delete your account.
Why: to show the customer where their assigned truck is while the job is active, and so authorised Orpyxis staff can see where the truck on a job is, to support the job and help with problems or disputes about it.
Who sees it: you; the customer whose job you accepted, only while that job is active (their access ends when the job ends); and authorised Orpyxis staff.
Legal basis: if you are a solo driver or operator, we use your location to perform our contract with you (Art 6(1)(b)). If you drive for a fleet or operator, we and that operator rely on legitimate interests (Art 6(1)(f)) in completing jobs safely and handling disputes. We have assessed this, and you can object (section 13). We do not use your location for performance monitoring, scoring or any other purpose.

7. Payments and how money flows

Customers pay by card in the Finder app. The card is charged in full when you book. Stripe processes the payment. For EU accounts this is normally Stripe Payments Europe Limited, Ireland. Stripe receives your card details directly and acts as an independent controller for its own fraud-prevention and legal obligations. See Stripe's privacy policy at https://stripe.com/privacy.
Orpyxis receives the payment on behalf of the operator that performs your job and later pays the operator's share to them by bank transfer. Refunds are made manually by Orpyxis.
To do this, we process the job value, the fee split and the bank details operators give Orpyxis for payouts (not collected through the apps). For drivers who pay platform fees in the app, the same Stripe processing applies.

8. WhatsApp support

You can contact us on WhatsApp at +1 904 479 8353. WhatsApp is a service of Meta. For users in the EU it is provided by WhatsApp Ireland Limited. If you message us there:

WhatsApp and Meta process your phone number, profile name, messages, attachments and metadata. Meta acts as an independent controller under its own terms and may transfer data to the United States. Meta's privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea.
We see your phone number, name and messages, and keep them as support records (section 11).
Please do not send card numbers, passwords or ID documents over WhatsApp.
WhatsApp is optional. You can always use [email protected] instead.

9. Who we share data with

The other party to your job: after a driver accepts your job, customers see the truck's number plate, make, model, equipment type, photo and status (not the driver's name or phone number), and the driver's live position while the job is active. Drivers and operators see the customer's name, pickup, destination, vehicle details and any notes.
Stripe for payments (section 7).
Service providers we use to run the Service:
hosting: the Service, including our map, routing and address-lookup server (maps.orpyxis.com), runs on our own server in Ireland (EU), protected by Cloudflare (a US provider, with transfer safeguards, section 10).
Google (Gmail): we send service emails, such as password-reset and account emails, through Google's Gmail service. Google receives your email address and the content of the email, and may process it in the United States (section 10);
push notifications: Expo's push notification service (Expo is based in the United States), which passes notifications to Apple Push Notification service;
OpenStreetMap Foundation (Nominatim): Road Guardian Finder sends pickup coordinates to nominatim.openstreetmap.org to turn them into an address. The OpenStreetMap Foundation is based in the United Kingdom. See https://osmfoundation.org/wiki/Privacy_Policy.
Apple (Apple Maps): the maps inside the apps are Apple Maps. Your device loads map content from Apple, which receives the map area being viewed and standard device and request data, and handles it under its own privacy policy (https://www.apple.com/legal/privacy/).
Meta / WhatsApp if you contact us there (section 8).
Professional advisers (lawyers, accountants and auditors) under confidentiality.
Authorities, including the Commissioner for Revenue, police and courts, where the law requires it or to protect someone's safety.
A buyer or successor if our business is sold or restructured, under equivalent protections.

We do not sell personal data or share it for advertising.

10. Device storage and international transfers

No analytics or tracking: the Road Guardian apps contain no analytics, crash-reporting or tracking SDKs. We do not use App Tracking Transparency tracking or advertising identifiers. Our servers set no cookies.

Device storage (ePrivacy): the apps store login tokens and similar data on your device because they are strictly necessary for the Service to work.

Transfers outside the EEA: some providers process data outside the EEA:
- United States: Cloudflare (protects our server; traffic to and from the Service passes through it), Google (service emails), Expo (push notifications), Meta/WhatsApp (if you contact us there), and possibly Stripe and Apple. When personal data is transferred to the US, we rely on the EU–US Data Privacy Framework adequacy decision where the recipient is certified, or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
- United Kingdom: the OpenStreetMap Foundation (Nominatim). The UK is covered by an EU adequacy decision.

You can ask [email protected] for details of the safeguards we use.

11. How long we keep data

We do not currently delete most data automatically. Where no fixed period is shown below, the data is kept until you delete your account or until we delete it.

Data	How long
Account and profile	Until you delete your account. Deletion is immediate (section 12)
Job and payment records (amounts, Stripe references, fee split, payouts, balances)	At least 10 years after the end of the financial year, as Maltese accounting and tax rules require. They are not deleted automatically and are kept until we delete them. If you delete your account, they are kept without your name, contact details or the job's locations
Driver tax-reporting (DAC7) data	As long as tax law requires
Driver location	Only the latest position, replaced at each update. Kept until a newer position replaces it or you delete your account
Customer pickup and destination	Kept with the job record until you delete your account, when they are removed from the job record
Operator bank details	Kept with our payout records (see job and payment records)
Support emails and WhatsApp messages	Kept until we delete them
In-app support requests, feedback and records of export requests	Until you delete your account
Server logs	Our system log has a size limit, so its oldest entries are overwritten automatically as new ones are added. A separate log of app requests to our server is kept until we delete it
Push tokens	Until you delete your account
Backups	Full database backups are kept until we delete them. Data you deleted may remain in a backup until that backup is deleted

12. Deleting your account

You can delete your account in either app:

Road Guardian Finder: Profile tab → Delete account
Road Guardian Truck: Account tab → Delete Account (at the bottom of the screen)

You confirm with your password and by typing DELETE. You can also email [email protected] from the email address registered on your account.

Deletion happens immediately. When you delete your account:

we delete or anonymise straight away: your name, email address and username (anonymised); your password (made unusable); profile and truck photos; your driver location; push and password-reset tokens; export requests; feedback; device and location logs; support requests; fleets you closed; truck and car plates; job pickup and destination; and IP addresses and device details stored with your sessions and consents. You are logged out on all devices;
we keep: payment and commission records, job records without location, any outstanding balance, the type and date of the consents you gave, and a record that the account was deleted. We keep these to meet financial and tax laws and to handle any claims (section 11);
backups: your data may remain in database backups until those backups are deleted (section 11).

Deleting your account does not cancel or refund a card payment that has already been made, and any amount you still owe remains owed. Ask [email protected] about refunds.

13. Your rights

Under the GDPR you have the right to:

access your data and get a copy;
correct it;
have it erased;
restrict how we use it;
object to processing based on legitimate interests;
receive it in a portable format;
withdraw consent at any time, where we have asked for it.

Export your data: in Road Guardian Finder (Profile tab → Export my data) or Road Guardian Truck (Account tab → Export my data), send us an export request, or email [email protected]. We send you a copy of your own data within one month.

Contact [email protected] for any request. We reply within one month. We may ask you to confirm your identity.

You can complain to Malta's Information and Data Protection Commissioner (IDPC) at https://idpc.org.mt, or to the supervisory authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.

14. Security

We use encrypted connections (HTTPS), hashed passwords, access controls limited to staff who need access, and session management. No system is completely secure. If a breach is likely to put you at high risk, we will tell you without undue delay.

15. Children

The Service is for people aged 18 and over. We do not knowingly collect children's data. If you believe a child has created an account, contact [email protected].

16. Changes to this policy

If we make important changes, we will tell you in the app or by email before they take effect. The date at the top shows the latest version.