Privacy Policy

• Controller: BRENA LARISSA MEDEIROS DE SOUZA LTDA, CNPJ 68.040.813/0001-49, Rua Visconde do Rio Branco, 1488, Conj. 909, Andar 09, Curitiba, PR, 80420-210, Brazil.
• Privacy contact, including for requests under the LGPD (our channel with data subjects, art. 41 LGPD), the GDPR and the UK GDPR: privacy@freightwizard.app.

We are the controller for your account data, billing data and the data we need to run and secure the service. When you use Freightwizard for your business, the content of your mailbox and the documents you upload may contain personal data of other people (your customers, carriers, agents). For that content we act on your instructions as a processor (operador under the LGPD); your business is the controller. Business customers can ask us for our data processing agreement at privacy@freightwizard.app.

• Account data: your name, email address and profile picture from Google or Microsoft, which provider you signed in with, and when you signed in.
• Mailbox access: the access and refresh tokens Google or Microsoft give us when you connect your mailbox. They are stored encrypted (AES-256-GCM) and are only used to act in your mailbox on your behalf.
• Email content: Freightwizard reads emails from your mailbox to show them to you and, when you ask for it, to analyse them. Emails are fetched from your mailbox when needed; we do not keep a copy of your mailbox.
• Analysis results: for each analysed email we store the subject, the sender address, and the result (for example type of request, priority, ports, Incoterm, cargo and container details, missing information, a summary and a suggested reply). We do not keep the text of the email itself.
• Documents: when you upload a document for analysis or comparison, we store an extract of its text (up to 5,000 characters) and the analysis result.
• Business data you enter: company profile (company name, tax and registration numbers, address, contact details), quotes, rate cards, shipments, customer portal links and notes.
• Lookups: when you use a lookup (for example a company or tax number check, or container tracking), the identifier you look up is sent to the service that answers it (see section 5).
• Subscription and billing: your plan, trial usage, and the Stripe customer and subscription references. Card details are entered on Stripe's pages and never reach us.
• Usage and cost records: which actions you took (for example "email analysed", "reply sent"), when, and how much AI processing they used. We use these for usage limits, billing and to improve the service.
• Technical data: the API keeps short-lived server logs (IP address, time, requested path, errors) to run and secure the service.

We do not use advertising or tracking cookies, analytics tools or tracking pixels, and we do not sell personal data.

• To provide the service you signed up for: sign-in, showing and analysing your emails, drafting and sending replies you approve, quotes, documents, shipments and customer portals. GDPR / UK GDPR art. 6(1)(b) (contract); LGPD art. 7, V (performance of a contract).
• To bill subscriptions and keep accounting and tax records. GDPR art. 6(1)(b) and (c) (legal obligation); LGPD art. 7, II and V.
• To keep the service secure, prevent abuse and fix errors. GDPR art. 6(1)(f) (legitimate interests: a secure and working service); LGPD art. 7, IX (legitimate interest).
• To enforce usage limits and improve the service using aggregated usage and cost records. GDPR art. 6(1)(f); LGPD art. 7, IX.
• To answer your messages and requests. GDPR art. 6(1)(b) or (f); LGPD art. 7, V or IX.

Where we rely on legitimate interests you can object at any time (section 8). We do not process sensitive personal data on purpose; please do not use Freightwizard for it.

Freightwizard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

In particular, for data from your Gmail or Outlook mailbox:

• We use it only to provide and improve the features you use in Freightwizard: showing, analysing, organising and answering your emails.
• We transfer it to others only as needed to provide those features (the processors in section 5, such as the AI provider that analyses an email), to comply with the law, or as part of a merger or acquisition with notice to you.
• We do not use it for advertising, we do not sell it, and we do not use it to train or improve general-purpose AI or machine-learning models.
• People at Freightwizard do not read it, unless you ask us to (for example for support), it is needed for security (for example investigating abuse), or the law requires it.

Permissions we ask for: Google: read, compose, send and modify Gmail messages, and your basic profile (name, email). Microsoft: read and write mail, send mail and your basic profile, with offline access so the connection keeps working. We only act in your mailbox when you use a feature: for example, a reply is only sent when you send it.

You can remove Freightwizard's access at any time: Disconnect in Freightwizard, or in your Google account (https://myaccount.google.com/permissions) or Microsoft account (https://account.live.com/consent/Manage).

We use the following service providers (processors / operadores). They process personal data only on our instructions and under data protection terms.

• Supabase (database): stores account, analysis and business data. Region eu-central-2, Zurich, Switzerland.
• Vercel (hosting of the website and the API): API in region fra1, Frankfurt, Germany; the website is served from Vercel's global network.
• Anthropic (AI analysis): receives the content of an email or document when you ask for an analysis or a reply suggestion. United States. Under Anthropic's commercial terms, this data is not used to train its models.
• Google and Microsoft: your mailbox provider and sign-in. They receive the actions you take in your mailbox through Freightwizard.
• Stripe (payments): subscriptions, invoices and card payments.
• Cloudflare (domain name service for freightwizard.app).
• Lookup services, only when you use them: Serpro and Siscomex (Brazilian government services, for example CNPJ and customs data), the European Commission (for example VAT number checks), Terminal49 and Portbase (container and shipment tracking). They receive the identifier you look up.

We may also disclose data when the law, a court or a competent authority requires it, or to protect our rights, and to a successor company in a merger or acquisition (you will be told in advance).

Freightwizard is operated from Brazil, and some providers are in the United States. When personal data from the European Economic Area, the United Kingdom or Brazil is transferred to a country without an adequacy decision, we use the safeguards the law provides: the European Commission's Standard Contractual Clauses (with the UK addendum), the EU-U.S. Data Privacy Framework where the provider is certified, and for Brazil the standard contractual clauses of the ANPD (Resolution CD/ANPD 19/2024) or another mechanism of art. 33 LGPD. Switzerland, where our database is hosted, is recognised by the European Commission as providing adequate protection.

You can ask us for a copy of the safeguards at privacy@freightwizard.app.

• Login sessions (with the mailbox tokens): until you disconnect, after 30 days without use, or after 90 days at most. We keep at most 5 sessions per account; older ones are removed, and expired sessions are deleted daily.
• Analyses, documents, quotes, rate cards, shipments, customer portals and company profile: as long as your account exists, or until you delete them or ask us to.
• Subscription and billing records: as long as the law requires for accounting and tax purposes.
• Usage and cost records: as long as your account exists; afterwards only in anonymised form.
• Server logs: about 1 hour.

When you ask us to delete your account, we delete or anonymise your data within 30 days, except what we must keep by law. Backups are overwritten in the normal backup cycle.

If you are in the European Economic Area or the United Kingdom (GDPR / UK GDPR), you have the right to: access your data; have it corrected; have it erased; restrict its processing; receive it in a portable format; object to processing based on legitimate interests; and withdraw consent where we rely on consent. You can also complain to a data protection authority, for example in the country where you live or work (in the UK: the Information Commissioner's Office).

If you are in Brazil (LGPD, art. 18), you have the right to: confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with consent; information about who we share data with; information about the possibility of not giving consent and its consequences; and revocation of consent. You can also petition the Autoridade Nacional de Proteção de Dados (ANPD).

To use any of these rights, email privacy@freightwizard.app from the address linked to your account. We may ask you to confirm your identity. We answer within one month (GDPR) and within 15 days for a complete access request under the LGPD. If your request concerns emails or documents a business customer controls, we will pass it to them or help them answer it.

We protect your data with technical and organisational measures, including: encryption in transit (HTTPS) and of mailbox tokens at rest (AES-256-GCM); login sessions in a secure, HttpOnly cookie, with only a hash of the session stored on our side; database access limited to our server; automatic expiry of sessions; and access to production systems limited to the people who need it. If a personal data breach puts you at risk, we will inform you and the competent authorities as the law requires.

We only use what is strictly necessary for the service to work, so no consent banner is needed:

• __Host-fw_session (cookie): keeps you signed in. Secure, HttpOnly, valid for 30 days.
• __Host-fw_oauth_state (cookie): protects the sign-in with Google or Microsoft. Valid for 10 minutes.
• Browser storage (localStorage and sessionStorage) for your settings on your own device: language and theme, email signature, notes, labels and folders, workflow statuses and assignments, the AI auto-detect setting, the dismissed trial banner and basic profile details for display. This stays in your browser; you can clear it in your browser settings.

We do not use advertising, analytics or third-party tracking cookies. Stripe sets its own cookies on its payment pages to prevent fraud; see Stripe's privacy policy.

Freightwizard uses AI to classify and summarise emails, extract shipment details and suggest replies. These results are suggestions for you to review. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

Freightwizard is a business tool for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

We may update this policy when the service or the law changes. The date at the top shows the latest version. We will tell you about important changes by email or in the app before they take effect.

BRENA LARISSA MEDEIROS DE SOUZA LTDA, CNPJ 68.040.813/0001-49, Rua Visconde do Rio Branco, 1488, Conj. 909, Andar 09, Curitiba, PR, 80420-210, Brazil. Email: privacy@freightwizard.app.