Privacy Policy

1. Who we are

Cargonautic is a white-label SaaS platform that provides freight forwarders and NVOCCs with a branded customer portal for managing quotes, bookings, shipments, documents, and invoices. We operate the platform infrastructure; our customers (freight forwarding companies) operate their own businesses through it.

When we say "we" or "Cargonautic" in this policy, we mean the platform operator. When we say "our customers" or "forwarders," we mean the freight forwarding companies who use Cargonautic to serve their clients.

2. What data we process

We process the following categories of data:

• Account data: Name, email address, phone number, company name, and role (admin, employee, customer, sales rep) for users of the platform.
• Shipment data: Origin and destination ports, container numbers, carrier information, cargo descriptions, weights, volumes, and tracking events.
• Commercial data: Quote details, pricing, invoice amounts, payment status, and document metadata (file names, types, upload dates).
• Branding data: Company logo, color preferences, layout choices, custom terminology, and domain configuration you provide to customize your portal.
• Sales data: Lead contact information, activity logs, and conversion status — used only by Cargonautic's sales team.
• Notification data: Push subscription endpoints (browser push tokens) and notification preferences, if you enable push notifications in your browser.
• Technical data: IP addresses, browser type, and usage logs for security and reliability purposes.

3. Who controls your data

For customer portal users (the clients of freight forwarders), the freight forwarding company is the data controller for your shipment and commercial data. Cargonautic is the data processor on their behalf. If you have questions about how your freight forwarder uses your data, contact them directly.

For forwarder staff (admins, employees), the freight forwarding company is the data controller for your account data. Cargonautic processes this data on their behalf.

For sales leads and prospects, Cargonautic is the data controller. We collect lead information to contact potential customers about our platform.

4. How we use your data

• To provide the Cargonautic platform and its features.
• To authenticate users and enforce role-based access control.
• To track shipments, generate quotes, process invoices, and manage documents.
• To send transactional notifications (shipment updates, quote responses, invoice reminders).
• To provide sales and onboarding support to potential customers.
• To maintain security, prevent fraud, and comply with legal obligations.

5. Data storage and security

Data is stored in PostgreSQL databases hosted on Neon, a serverless Postgres platform. All data in transit is encrypted via TLS. Integration credentials (such as connections to accounting systems) are encrypted at rest using AES-256-GCM. Session tokens are hashed at rest.

Access to data is controlled by Row Level Security (RLS) policies at the database level. Each forwarder can only access their own company's data. Sales representatives are isolated from tenant operational data. Customer portal users can only see their own company's customer-facing records.

We do not store passwords in plaintext. Passwords are hashed using bcrypt. Session cookies are HMAC-signed and httpOnly, with__Host-prefixes and SameSite=Strictattributes in production.

6. Data retention

We retain data for as long as your account is active. When a freight forwarding company cancels their Cargonautic account, we provide a 30-day window for data export. After 90 days, we delete the company's data unless legal obligations require longer retention.

Sales lead data is retained for 24 months from last contact. After that, leads are archived and their personal data is removed.

Security logs and error logs are retained for 90 days.

7. Data sharing

We do not sell your data. We share data only with:

• Infrastructure providers: Neon (Postgres database), Vercel (hosting and custom domain SSL), and cloud providers that process data on our behalf under data processing agreements.
• Payment processors: Stripe processes payments for Cargonautic subscriptions. We do not store full card numbers — Stripe handles all card data.
• Email providers: Resend delivers transactional emails on our behalf.
• Legal authorities: When required by law, court order, or to protect our rights and safety.

Integration connections (such as QuickBooks) are initiated by the forwarder. Data flows to those integrations at the forwarder's direction. We do not share data with integrations without explicit authorization from the forwarder.

8. Your rights

Depending on your jurisdiction (GDPR, CCPA, or other applicable laws), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for processing based on consent.

To exercise these rights, contact your freight forwarder (for customer portal data) or contact Cargonautic directly at privacy@cargonautic.com.

9. International data transfers

Cargonautic and its infrastructure providers may process data in multiple countries. We use providers that offer adequate safeguards for international data transfers, including Standard Contractual Clauses where applicable. If you are in the EU, UK, or another jurisdiction with data transfer requirements, your data may be transferred to the United States or other countries with appropriate legal safeguards in place.

10. Cookies and push notifications

Cargonautic uses only essential cookies for authentication and session management. We do not use tracking cookies, advertising cookies, or analytics cookies. No cookie consent banner is required because we do not place non-essential cookies.

If you install the Cargonautic PWA (Progressive Web App) and grant permission, we may send push notifications for shipment milestones, quote responses, and invoice reminders. Push notification endpoints are stored only to deliver notifications you requested and are removed when you unsubscribe or disable notifications in your browser settings.

11. Children's privacy

Cargonautic is a business-to-business platform. We do not knowingly collect data from children under 16. If you believe we have collected data from a child, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify our customers of material changes via email. The "last updated" date at the top of this page reflects the most recent revision.

13. Contact

For privacy questions or requests, contact us at privacy@cargonautic.com.