Privacy Policy

1. Scope and roles

This Privacy Notice explains how the operator identified in the Legal Notice processes personal data in connection with the LogisticsAI website, accounts, workspaces, support, billing and hosted logistics workflows.

We act as controller for website, account, security, sales, billing and support administration. For personal data contained in documents or operational datasets uploaded by a business customer, the customer normally determines the purposes and means of processing and acts as controller; we process that data on its documented instructions under the Data Processing Addendum.

2. Personal data we process

Depending on use of the service, we process the following categories:

• account and organization data, including name, business email, role, locale, authentication identifiers and workspace membership
• customer content, including permit documents, shipment or vehicle records, sample rows used for field mapping, extracted fields, review decisions, reports, exports and related metadata
• commercial and support data, including enquiries, correspondence, subscription status, invoices, tax information and payment references; we do not receive full payment-card numbers
• technical and security data, including IP address, device and browser details, timestamps, request and audit logs, rate-limit events and error telemetry
• optional analytics and support-chat data where the user has enabled the relevant category in Cookie Preferences

3. Sources of data

We obtain data directly from users and customer organizations, from files and systems they connect or upload, from authentication and infrastructure providers, and from the merchant of record or payment provider for subscription administration. A customer must have a lawful basis and all required notices or permissions before submitting personal data about drivers, employees, contacts or other individuals.

4. Purposes and legal bases

We process account, workspace, requested workflow and subscription data as necessary to take steps at your request and perform our contract. We process security, fraud prevention, service reliability, limited product administration and the establishment or defence of legal claims on the basis of our legitimate interests, balanced against individual rights. We process invoices and other records where required by tax, accounting or other law.

Optional PostHog analytics, Google Ads conversion measurement and Crisp support-chat storage are activated only after the relevant consent choice. Consent can be withdrawn at any time without affecting prior lawful processing. Where we act as processor for Customer Data, the customer's legal basis applies and our processing is governed by the Data Processing Addendum.

5. Artificial intelligence processing

Selected features use OpenAI to extract structured fields from permit documents, suggest mappings or generate optional operational insights. The necessary input, which may include an entire uploaded permit or limited sample values, is transmitted to the OpenAI API. Requests are configured with response-object storage disabled. OpenAI states that business/API data is not used to train its models by default; provider abuse-monitoring and other limited retention may still apply unless a separately approved configuration provides otherwise.

AI results are probabilistic and may be incomplete or incorrect. They do not constitute a legal opinion, permit approval, certification or compliance decision. Users must review source references and approve results before operational reliance. The service does not make solely automated decisions that produce legal or similarly significant effects on individuals.

6. Recipients and service providers

We disclose data only where needed to provide, secure, support or bill the service, comply with law, or protect legal rights. Depending on enabled features, recipients may include:

• Supabase for database, authentication and private file storage; the active production project is currently hosted in Ireland (AWS eu-west-1)
• Vercel for application hosting, delivery, aggregate web analytics and performance measurement
• OpenAI for the AI processing described above
• Sentry for minimized error and security diagnostics
• ImprovMX for transactional email delivery and domain forwarding
• PostHog for optional product analytics, Google Ads for optional advertising attribution and completed lead-conversion measurement, and Crisp for optional support chat
• Lemon Squeezy or the checkout provider as merchant or seller of record for payments, invoicing, tax and subscription administration
• professional advisers, authorities or transaction counterparties where legally necessary and subject to appropriate confidentiality

7. International transfers

Our primary database region is in the EEA, but some providers or their approved subprocessors may process data outside the EEA. Where required, transfers rely on an adequacy decision, the EU-US Data Privacy Framework for eligible recipients, the European Commission's Standard Contractual Clauses with supplementary measures, or another lawful transfer mechanism. We do not describe the service as universally EU-only.

8. Retention

We retain personal data only for as long as necessary for the relevant purpose, taking account of contractual, security, dispute and statutory requirements. Account and workspace administration data is generally retained for the contract term and a limited period afterwards. Belgian accounting and tax records may be retained for ten years where required. Security and audit records are retained for a proportionate period and may be preserved longer for an active incident or legal claim.

Customer administrators can delete permit records using the product workflow. The source file, generated exports, extracted content and provider payload are then scheduled for purge, while a content-free deletion record and sanitized audit events may remain. Backups and provider systems follow their documented rotation periods. The service does not currently promise a universal automatic deletion period for all Customer Data; customers should configure or agree retention appropriate to their workflow.

9. Cookies and similar technologies

Strictly necessary storage supports authentication, security, locale and consent choices. Optional analytics and support technologies are controlled through Cookie Preferences. Details, providers and withdrawal instructions are in the Cookie Policy. A consent preference expires after six months so that the choice can be renewed.

10. Your rights

Subject to the GDPR and applicable exceptions, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time. Contact the privacy address stated in the Legal Notice. We may verify identity and will respond without undue delay and in principle within one month; this period may be extended by up to two further months for complex or numerous requests, with notice.

For personal data in Customer Data, contact the customer organization that submitted the data first. We will assist that customer as required by the Data Processing Addendum.

11. Complaints

You may lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Belgium, or with the supervisory authority of your habitual residence, place of work or the alleged infringement. We encourage you to contact us first so we can investigate.

12. Security and incidents

We use measures designed to protect data, including authenticated access, organization-scoped authorization, private storage, encryption in transit, audit trails, rate limiting and restricted service credentials. No system is completely secure. Customers must minimize uploads, control workspace access and avoid submitting special-category data unless expressly agreed and lawfully supported.

We assess security incidents and notify affected customers or authorities where required by applicable law and the Data Processing Addendum.

13. Business service, changes and contact

The service is intended for business users and not for children. We may update this Notice to reflect product, provider or legal changes. Material changes will be highlighted by an updated date or other appropriate notice. Controller and privacy contact details appear in the Legal Notice.