Privacy Policy

Freyt ("we", "us") provides software that reads freight documents such as rate confirmations and exports structured shipment data to your TMS or other destination (the "Service"). This Privacy Policy explains what personal data we collect, why, how it is protected, how long we keep it, and the choices and rights you have. It applies to our website and the Service, and forms part of our Terms of Service. We do not sell personal data, and we do not use your documents to train third-party foundation models — see Section 5.

1. Who this policy covers and your role

If you are an individual using freyt directly, this policy describes how we handle your personal data as a data controller. If you access freyt because your employer or another organization is our customer, that organization controls the account and the documents submitted to it; we process personal data contained in those documents on the organization's behalf as a data processor — see our Data Processing Agreement. If you have questions about data submitted by an organization you interact with, we recommend contacting that organization first.

2. What we collect

• Account data — name, email address, company, job title, and password (stored using a salted hash, never in plain text).
• Billing data — processed by our payment processors (Stripe and/or PayPal); we never receive or store full card numbers.
• Customer Data — documents you upload or forward for extraction (rate confirmations, bills of lading, PDFs, and related emails), and the shipment data and metadata extracted from them.
• Usage data — pages visited, features used, timestamps, device and browser type, and IP address, collected via server logs and privacy-respecting first-party analytics.
• Support communications — content of messages you send to any of our support channels, and metadata about those messages.

3. How we use it

• To extract, structure, and export shipment data on your behalf, including via third-party AI sub-processors (Section 6);
• To create, secure, and administer your account, and authenticate access;
• To operate, maintain, monitor, debug, and improve the Service and its extraction accuracy;
• To send transactional communications — account, billing, security, and service notices;
• To provide customer support and respond to inquiries;
• To detect, investigate, and prevent fraud, abuse, and security incidents, and to enforce our Terms of Service;
• To comply with legal obligations and respond to lawful requests from public authorities.

We do not use personal data for cross-context behavioral advertising, and we do not sell or share personal data for advertising purposes.

4. Legal basis for processing (EEA / UK users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract with you (providing the Service and account functions); our legitimate interests (securing the Service, preventing fraud, and improving product quality), balanced against your rights and freedoms; compliance with a legal obligation; and, where applicable, your consent (for example, optional marketing communications, which you can withdraw at any time). You may object to processing based on legitimate interests at any time — see Section 10 for how to exercise this right.

5. What we don't do

We do not sell personal data or Customer Data to any third party. We do not use uploaded documents, extracted Output, or account content to train third-party foundation or generative AI models, and we contractually prohibit our AI sub-processors from doing so with data we send them. Any internal improvements we make to our own extraction pipeline rely on aggregate, de-identified patterns only, with direct identifiers (such as names, rates, and addresses) removed or obfuscated before use. Documents are processed solely to extract the fields you requested and are retained only as long as described in Section 7.

6. Sharing and sub-processors

We share personal data only with the following categories of service providers, each bound by a data processing or confidentiality agreement, and only to the extent necessary for them to perform their function:

• Cloud infrastructure — hosting, storage, and compute providers who store and process data on our behalf.
• AI extraction providers — third-party AI/ML providers who process documents you submit to return extracted fields; they act as our sub-processors and are contractually prohibited from using your data to train their own models.
• Payment processors — Stripe and/or PayPal, to process billing.
• Transactional email and error-monitoring providers — to deliver account notices and diagnose technical issues.

We may also disclose data where required by law or legal process, to protect the rights, property, or safety of Freyt, our users, or the public, in connection with a merger, acquisition, or sale of assets (with notice to you where required by law), or with your explicit consent — for example, a TMS integration you configure yourself, which is then governed by that third party's own privacy practices. A current sub-processor list is available on request at support@freyt.space.

7. Data retention

We retain Customer Data and extracted records for as long as your account is active, subject to your plan's history window (30 days on Starter; 12 months on Pro and Team, unless otherwise stated on the pricing page). Raw uploaded documents are deleted after successful extraction or retained for that same window, whichever your plan specifies. Account data is retained for as long as your account exists. On account closure, we delete personal data and Customer Data within 30 days, except records we are legally required to retain — for example, billing and financial records, which may be kept for up to 7 years to satisfy tax and accounting obligations. Data in encrypted backups is purged on a rolling basis and fully cleared within 90 days of deletion from production systems.

8. Security

We use industry-standard technical and organizational measures designed to protect personal data, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access controls that restrict employee access to customer data on a need-only basis, and regular vulnerability assessments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach materially affecting your data occurs, we will notify affected users and, where legally required, relevant supervisory authorities, without undue delay and in accordance with applicable law. To report a suspected vulnerability or incident, contact security@freyt.space.

9. International data transfers

Freyt and its sub-processors may process and store data in the United States and other countries. If you are located in the EEA, UK, or Switzerland, your data may be transferred to countries that have not been found to provide an adequate level of data protection under local law; where this occurs, we rely on Standard Contractual Clauses or another recognized transfer mechanism with the relevant recipient. A copy of our Data Processing Agreement, including transfer terms, is available on request at legal@freyt.space.

10. Your rights

Depending on your location, you may have the right to access, correct, export, restrict, or object to our processing of your personal data, or to request its deletion. You can exercise these rights by contacting support@freyt.space. We will respond within 30 days, or sooner where required by law. We may need to verify your identity before acting on a request, and some rights are subject to exceptions under applicable law (for example, where retention is required for legal or accounting purposes).

• EEA / UK / Switzerland (GDPR): you have the rights described above, plus the right to lodge a complaint with your local data protection supervisory authority.
• California (CCPA/CPRA): you have the right to know the categories of personal data we collect and their purposes, to request deletion, to correct inaccurate data, and to non-discrimination for exercising these rights. We do not sell or share personal data as those terms are defined by California law, so there is no opt-out to request.
• Other jurisdictions: where applicable state or national privacy law grants additional rights, we will honor them on request to the extent required.

11. Cookies and tracking

We use essential session cookies required for the Service to function, and privacy-respecting, first-party analytics with no cross-site tracking, ad-network integration, or behavioral advertising. See our Cookie Policy for the full list of cookies we use, their purpose, and how to manage them.

12. Children's privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact support@freyt.space and we will investigate and delete it as appropriate.

13. Automated processing

The Service uses automated document extraction to produce Output, but does not use personal data to make decisions that produce legal or similarly significant effects about you without human involvement. You remain responsible for reviewing Output before acting on it, as described in our Terms of Service.

14. Changes to this policy

We may update this Privacy Policy as our practices, the Service, or applicable law evolve. For material changes, we will provide notice by email or in-app notice at least 14 days before the change takes effect. The "last updated" date above reflects the most recent revision. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

15. Contact

Privacy questions and rights requests: seucrity@freyt.space · Data Processing Agreement requests: security@freyt.space · Security reports: security@freyt.space