Privacy Policy

PRELIMINARY VERSION — under legal review and may change; the version number below is updated with every change.

Version: 2026-10-17-draft

This page explains what personal data we collect on purago.app, why we need it, who receives it and what rights you have. It follows the Law of Georgia on Personal Data Protection.

1. Who is responsible for your data

Your data is processed by [company name] LLC (identification code [tax ID]), which trades as Pura. In the words of the Law, it is the “controller”.

• Address: 24 Pekini Ave, Tbilisi, Georgia
• Phone: +995 599 030 091
• Email: info@purago.app

We have not appointed a personal data protection officer. For anything to do with your data, use the contacts above.

[LEGAL] P1. The exact name and identification code of the legal entity are still to be filled in. To confirm: the company is not required to appoint a personal data protection officer (Article 33 of the Law).

2. What data we collect

Through the load posting form you give us:

• the loading and unloading addresses, the type of vehicle you need, the weight of the cargo and the loading date;
• if you fill them in: the type of cargo, its volume or the number of pallets, the number of trucks, the loading side, the required temperature, the price you want, and your notes;
• who the invoice is for, an individual or a company; for a company, its name and identification code;
• your name and phone number.

Through the carrier registration form you give us:

• your full name, your phone number, the vehicle types you run and, if you fill it in, the direction you work.

When a form is sent we automatically receive:

• the IP address it was sent from, and the time;
• the result of the check that a person, not a program, is filling in the form (Cloudflare Turnstile);
• a record of your consent: that you ticked the box, when you ticked it, and which version of this policy and of the terms was in force;
• how you reached the form: the campaign tags in the link (UTM parameters: utm_source, utm_medium, utm_campaign, utm_term, utm_content), the first page of our site you opened (the page address only, without parameters), the domain of the site you came from (never the full link), and the page language.

While an order is under way we receive:

• what you tell the dispatcher by phone or email in order to arrange it;
• the documents of the carriage: the handover act and the invoice.

We do not ask for special categories of data, such as data about health or beliefs. Please do not put any in the notes either.

If you only browse the site, we collect nothing through the forms. The site has no user accounts, no analytics and no advertising trackers. The technical providers that see your IP address when a page opens are described in section 5.

3. Why we use your data, and on what legal basis

Under Article 5 of the Law, data may be processed only on one of the grounds listed there. Each purpose below is followed by its ground.

• Handling your request and carrying out the order. We call you, agree the price and the time, find a carrier, arrange loading and delivery, and deal with claims. Ground: entering into a contract at your request and performing it (Article 5(1)(b)), reviewing your application (Article 5(1)(j)), and the consent you give on the form (Article 5(1)(a)).
• The carrier roster. We keep a carrier’s number on the dispatchers’ roster and call when a load comes up on their direction. The grounds are the same: (b), (j) and (a).
• Invoicing, accounting and tax. We issue the invoice and keep accounting and tax documents. Ground: the law, and the duties that legislation places on us ((c) and (d)).
• Protecting the forms from abuse. We use the IP address and the Turnstile check to limit automated and bulk submissions. Ground: our legitimate interest ((i)) — the forms have to keep working, and a dispatcher should not be handed fake requests.
• Knowing where requests come from. The campaign tags show us which advertisement or link works. Ground: our legitimate interest ((i)) — measuring what advertising costs us without following you around other sites.
• Proving consent. We keep the consent record because the Law puts the burden of proving consent on us (Article 32(9)). Ground: (d).
• Legal claims. In a dispute we use the data to substantiate our position. Ground: legitimate interest ((i)).

We do not use your data for direct marketing: we send no advertising, by phone or by email. If we ever intend to, we will ask for a separate consent first.

[LEGAL] P2. The choice of grounds needs confirming. Two questions about consent: (1) is consent obtained through a mandatory tick-box freely given (Article 32(2)), or should we rely on (b) and (j) alone; (2) does consent to data processing have to be kept apart from acceptance of the terms (Article 32(1))? At present both are one box.

[LEGAL] P3. The legitimate interest needs assessing for both purposes, protecting the forms and recording where requests come from (Article 24(1)(d) requires them to be named). Does recording the source need consent instead?

4. Whether you have to provide the data

No law obliges you to provide data. But the fields of the form that are not marked “optional” are necessary for reviewing your request and entering into a contract: without them the form will not send, and we cannot call you. To invoice a company we need both its name and its identification code. The other fields are up to you.

If you would rather not fill in the form, call us: +995 599 030 091.

5. Who receives the data

We do not sell data, and we do not pass it to advertising companies. It goes only to those without whom we could not provide the service.

These process data on our instructions — “processors”, in the words of the Law:

• Cloudflare, Inc. (USA). The site and the database that holds the requests run on its infrastructure, and Turnstile, the check that a person is filling in the form, is its product. Cloudflare processes data under its Data Processing Addendum.
• Resend (Plus Five Five, Inc., USA). This email service sends our dispatchers a notification about each new request; the message contains the contents of the request. Resend processes data under its own Data Processing Addendum.

These also receive data — “recipients”, in the words of the Law:

• The carrier and the driver carrying your load. We pass on the loading and delivery addresses, the cargo details, and the name and number of the contact person on site, so that loading and delivery can happen.
• The customer whose load you carry, if you are a carrier. We may pass on your name, phone number and vehicle plate.
• Our accountant and the tax authority (the Revenue Service, rs.ge), where an invoice or a goods waybill requires it.
• State bodies and courts, only where the law obliges us.

[LEGAL] P4. To check: (1) whether Cloudflare’s and Resend’s standard addenda meet Article 36 of the Law (a written agreement with the mandatory content); (2) for Turnstile, Cloudflare also regards itself as partly an independent controller.

6. Transfers outside Georgia

Cloudflare’s network spans the world, and Resend is registered in the USA. Your data is therefore also processed outside Georgia, including in European Union countries and in the USA. Our relations with these companies are governed by data processing agreements that oblige them to keep data secure and confidential.

[LEGAL] P5. The ground for the transfer under Article 37 of the Law has to be established. Are these states on the list of those with adequate safeguards (Article 38)? If we rely on a contract (Article 37(2)(b)), a permit from the State Audit Office is required (Article 37(3)). If neither works, the written consent of the data subject (Article 37(2)(d)).

7. How long we keep the data

We keep data for as long as the purpose needs it. After that we erase it, destroy it or keep it in depersonalised form, so that it can no longer be linked to you.

• A request that did not become an order — 12 months from the last contact. ([LEGAL] P6)
• A completed order, its invoice and the carriage documents — 3 years from the end of the calendar year in which the carriage was completed; where the law sets a longer period, for that period. ([LEGAL] P7)
• A carrier registration — while we work together and for 24 months after the last contact, or until you ask to be taken off the roster. ([LEGAL] P8)
• The consent record (time, version, IP address) — while we process the data it covers, and for 3 years after that. ([LEGAL] P9)
• The submission counter (IP address and the number of requests sent in an hour) — about two hours.
• Notifications in the dispatchers’ mailboxes — 12 months. ([LEGAL] P10)
• Campaign tags — in your browser until the tab is closed; with a request, for as long as the request itself is kept.

[LEGAL] P6–P10. Every period is a proposal, and the lawyer has to confirm each one. P6 — 12 months. P7 — 3 years rests on Articles 43 and 72 of the Tax Code and Article 129 of the Civil Code; does a longer period apply (to accounting documents, for example)? P8 — 24 months. P9 — 3 years, the limitation period for a contractual claim. P10 — 12 months; to find out: how long Resend itself keeps messages.

8. Your rights

The Law (Chapter III) gives you the right to:

• receive information: whether your data is being processed, for what purpose and on what ground, where we obtained it, how long we keep it and whom we have passed it to;
• see your data and receive a copy free of charge;
• have incorrect, inaccurate or incomplete data corrected, updated and completed;
• have the processing stopped and the data erased or destroyed;
• have the data blocked — for example, while we review your request or while the accuracy of the data is in dispute;
• receive the data you gave us in a machine-readable format, or have it passed to someone else (data portability);
• withdraw your consent at any time, without any explanation.

Withdrawing consent. Write to info@purago.app or call us. Within 10 working days of the request at the latest we stop the processing and erase the data, unless we have another ground for processing it — an invoice and tax documents, for example, have to be kept for the period the law sets. Before withdrawing you may ask us what the consequences will be. Withdrawal does not undo what was lawfully done before it.

How to use your rights. Write to info@purago.app, call us, or send a letter to the address above. We answer within 10 working days at the latest; in special cases this may be extended by another 10 working days, and we will tell you at once. This is free of charge. We may ask you to confirm that the request really is yours — for example, by calling back the number given in the request.

Complaints. If you think we are infringing your rights, you may apply to the State Audit Office, which supervises the lawfulness of data processing in Georgia, or to a court.

[LEGAL] P11. To check: the time limits for answering; when we may refuse a request (Article 16(3), Article 20, Article 32(5)); how the identity of the person asking is confirmed.

[LEGAL] P12. Supervisory authority: Law No 1289 of 17 December 2025 moved the functions of the Personal Data Protection Service to the State Audit Office (Articles 22 and 49 of the Law). The authority’s name and contact details must be re-checked before publication.

9. Automated decisions

No program takes decisions about you, and we do not use profiling: every request is read by a dispatcher. Only two things are checked automatically — whether a person or a program is filling in the form, and whether too many requests are coming from one network. If that check has stopped you by mistake, call us.

[LEGAL] P13. Whether the automatic blocking of a form counts as a decision under Article 19 of the Law.

10. Cookies and browser storage

We use no cookies of our own, neither for analytics nor for advertising. Cloudflare Turnstile runs on the two forms and may set only the technical cookies without which the check cannot work. On the same two pages we keep the campaign tags in your browser’s session storage (sessionStorage); they are deleted when the tab is closed.

[LEGAL] P14. To confirm: that Turnstile’s cookies really are strictly necessary, and that keeping the tags in session storage needs no prior consent.

11. Minors

The service is meant for adults and for companies. We do not knowingly collect the data of minors. If you think a minor has sent us data, tell us and we will erase it.

[LEGAL] P15. The age threshold and its wording: under Article 7 of the Law a minor’s consent is valid from the age of 16.

12. Other people’s data

If you put another person’s data in a request — a contact person at the loading point, for example — tell them beforehand that you are passing their name and number to us and to the driver. When you send the form, you confirm that you are entitled to do so and that this person has been informed.

[LEGAL] P16. Where data is not collected from the data subject directly, Article 25 of the Law obliges us to inform them. When and how we do that has to be settled.

13. Security

The site and the forms work over an encrypted connection (HTTPS). Only our dispatchers and administrators have access to the requests.

[LEGAL] P17. To check: whether this description reflects the real measures (Article 27 of the Law), and whether an incident response procedure exists (Articles 29 and 30: notifying the State Audit Office within 72 hours).

14. Changes to this policy

The policy may need to change. Each version has its own number, shown at the top of the page; we will announce a material change on this page. The consent record keeps which version you agreed to.

The text exists in Georgian, English and Russian. If they differ, the Georgian text prevails.

[LEGAL] P18. Which language version prevails, and how changes are notified.

[LEGAL] P19. The site also works in English and Russian. If we offer the service to people in the European Union, the GDPR may apply as well (Article 3(2); Article 27 — a representative in the Union). That decision should be taken in advance.

Back to the homepage