Privacy Policy

Traffic OS is field-operations software for traffic-control, barricade, and lane-closure companies. It is operated by The Key Bot, 1168 W Pioneer Pkwy, Arlington, TX 76013 (“we”, “us”). This policy explains what we collect, why, who we share it with, and how long we keep it.

Traffic OS is sold to businesses, not consumers. Most personal data in the system is uploaded by a customer company (the “tenant”) about its own employees, its customers, and its jobs. For that data the tenant is the controller and we are the processor — we handle it on their instructions. If you are a driver, a general contractor's superintendent, or a customer of a company using Traffic OS, direct access and deletion requests to that company first; we will support them in responding.

What we collect

Account data

• Company name, business address, business phone, and billing contact
• User names, work email addresses, phone numbers, roles, and hashed passwords
• Plan, seat counts, and subscription status

Operational data your company enters

• Customers, job sites, quotes, jobs, invoices, purchase orders, vendors, equipment, and inventory records
• Daily tickets, including the signature captured on-site and the GPS coordinates and timestamp recorded at the moment of signing — this is the point of the product, and the location is attached to the ticket permanently as the audit record
• Time-clock punches, including the GPS location captured at clock-in and clock-out for crew members
• Photos and file attachments (job photos, receipts, signed documents)
• Expenses and reimbursement records

Technical data

• IP address, browser and device type, and pages visited within the application
• Application error reports and diagnostic traces (via Sentry)
• Session cookies and local storage strictly necessary to keep you signed in and to remember your selected workspace

We do not run advertising pixels or third-party behavioral-ad trackers on the application, and we do not build advertising profiles from operational data.

Location data, specifically

Traffic OS captures location in two places only: when a crew member clocks in or out, and when a daily ticket is signed. It is captured at that moment, not continuously — Traffic OS does not run background location tracking and does not follow a device between those events. Location is visible to administrators of the employing company and is attached to the ticket or punch as part of the audit record.

How we use it

• To provide the service and keep your workspace working
• To send transactional messages — invitations, dispatch and job notifications, ticket and invoice notices, and payment links
• To bill your subscription and metered SMS usage
• To provide support, investigate errors, and prevent abuse and fraud
• To meet legal, tax, and accounting obligations

We do not sell personal information, and we do not share it with third parties for their own marketing.

Text messages

SMS consent and opt-out are covered in detail in our SMS Messaging Terms. In short: messages are transactional, not marketing; reply STOP to opt out and HELP for help; and mobile numbers and SMS opt-in data are never sold or shared with third parties or affiliates for their marketing purposes.

Subprocessors

We use the following providers to deliver the service. Each receives only the data needed for its function.

• Stripe — subscription billing and card payments
• Square — card payments and checkout links, where a tenant has connected Square
• Intuit QuickBooks Online — accounting sync of customers, invoices, and payments, where a tenant has connected QuickBooks
• Twilio — SMS delivery
• SendGrid / Resend — transactional email delivery
• Cloudflare — network delivery and protection for the application's server
• DigitalOcean — storage of encrypted database backups (United States)
• Vercel — web frontend hosting and delivery
• Cloudinary, or an S3-compatible object store (DigitalOcean Spaces / Cloudflare R2) — storage of uploaded photos and documents, depending on the configured storage provider
• Sentry — application error monitoring
• OpenAI and Anthropic — used only for optional receipt and odometer scanning, and only when a tenant enables it. An image submitted for scanning is sent to OpenAI to read the amount, vendor, and date (or the odometer reading); if OpenAI cannot answer, the same image is sent to Anthropic instead. If the feature is not enabled, no data is sent to either.

We may also disclose data when required by law, to enforce our agreements, or in connection with a merger or acquisition — in which case we will give notice before your data becomes subject to a different policy.

Where data is stored

Application data is stored in the United States, on a dedicated server we operate in Texas. Encrypted backups are kept with DigitalOcean in the United States. Subprocessors may process data in other jurisdictions under their own terms. Traffic OS is designed and sold for use in the United States.

Tenant isolation and access

Traffic OS is multi-tenant. Every record is scoped to a tenant, and access is enforced at the data-model layer so one company cannot read another's data. Within a company, access follows role: drivers see only the jobs assigned to them; administrators see the full workspace. Our staff access production data only when needed to provide support, fix a fault, or comply with law.

Retention

• While your subscription is active: we retain your workspace data so the service works and so signed tickets stay available as the audit record they exist to be.
• After cancellation: workspace data is retained for 90 days so you can export it or reactivate, then deleted from production systems. Encrypted backups age out on their own rolling schedule, within 35 days of that deletion.
• Billing and tax records: invoices and payment records are retained for 7 years to meet US tax and accounting requirements, even after an account closes.
• SMS opt-out records: retained indefinitely — we have to remember that a number opted out in order to keep honoring it.
• Error diagnostics: retained up to 90 days.

Security

Data is encrypted in transit with TLS and encrypted at rest by our hosting and storage providers. Passwords are stored only as salted hashes — we cannot read them. Access to production systems is restricted to staff who need it. No system is perfectly secure, and we do not claim otherwise; if we become aware of a breach affecting your data we will notify affected tenants without undue delay and as required by applicable law.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Texas, California, and several other US states provide such rights to residents.

If your data is in a workspace belonging to a company that uses Traffic OS, contact that company first — they control it. If you are our direct customer, or the company does not respond, email contact@thekeybot.com and we will respond within 45 days. We will not discriminate against you for exercising these rights.

Children

Traffic OS is a workplace tool and is not directed to anyone under 16. We do not knowingly collect data from children. If you believe a child's data has been submitted, contact us and we will delete it.

Changes

We will update this page when our practices change and revise the “last updated” date. For material changes affecting existing customers we will give notice by email to account administrators before the change takes effect.

Contact

The Key Bot · 1168 W Pioneer Pkwy, Arlington, TX 76013 · contact@thekeybot.com · (817) 842-3249