Privacy Policy

This policy applies to information we process through the Service, our website, and related communications. It does not cover third-party websites, the mail servers of Google or Microsoft, or your own recipients' systems.

For account and billing information about you (our customer), GotFreight acts as a data controller. For the lead, prospect, shipper, and contact data inside your workspace — including data you upload, data we discover for you via our B2B data providers, and the email/reply content flowing through your connected mailbox — GotFreight acts as a processor/service provider acting on your instructions. You are the controller of that data and remain responsible for the lawfulness of your outreach.

We collect the following categories of information:

We use information to provide, operate, and improve the Service, including to:

This section governs our access to data through Google APIs (Gmail) and the Microsoft Graph API (Microsoft 365/Outlook). It exists so you understand exactly how mailbox access is used.

Permissions and purpose: when you connect a Google or Microsoft mailbox, you grant scopes that allow GotFreight to send messages from your mailbox and read messages (such as replies in the threads we started) so we can deliver outreach, detect and sort replies, and maintain your pipeline. We request only the scopes needed to provide the features you enable, and we access your mailbox only to provide those features to you, on your own mailbox.

Limited Use: GotFreight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Equivalent restrictions apply to data accessed via Microsoft Graph. Specifically, data obtained from your connected mailbox is used only to provide and improve the user-facing features you enabled; is not sold; is not transferred to or used by others except as necessary to provide the Service, for security, or to comply with applicable law; is not used for advertising; and is not used to develop, improve, or train generalized or non-personalized AI or machine-learning models. Human access to this data is limited to the narrow cases permitted by the policy (for example, with your explicit consent for support, for security purposes, to comply with law, or where the data has been aggregated/de-identified).

OAuth tokens are stored securely, used solely to operate the Service on your behalf, and are never shared with third parties for their own purposes. You can revoke access at any time by disconnecting the mailbox in GotFreight or via your Google or Microsoft account security settings; revocation stops further sending and reading through that connection.

We share information with the following service providers (subprocessors) strictly to operate the Service. They are authorized to use the data only to provide their services to us, not for their own purposes.

We retain account, CRM, lead, email, and quote data for as long as your account is active and as needed to provide the Service. You can delete individual records within the app at any time.

When you close your account, we delete or de-identify your workspace data within a reasonable period (typically within 90 days), except where we must retain certain information to comply with legal, tax, accounting, or security obligations, resolve disputes, or enforce our agreements. OAuth tokens and mailbox credentials are deleted promptly when you disconnect a mailbox or close your account. Backups are purged on our regular backup-rotation cycle. Aggregated or de-identified data that can no longer be linked to you may be retained.

We use technical and organizational measures to protect information, including encryption in transit (TLS), encrypted storage of sensitive credentials and OAuth tokens, tenant isolation and row-level security so each customer can only access their own workspace, scoped service-role access, access controls, and security headers. Mailbox and secret material are isolated and access-restricted.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for safeguarding your login credentials and for the security of the mailbox and SMTP/IMAP accounts you connect.

You have rights over your personal information, and the data subjects in your workspace have rights you must help honor as the controller of that data.

Access, export, and deletion: you can access and export your account and CRM data from within the Service, and you can delete records or close your account. To request access, correction, deletion, or a copy of personal information we hold about you as a controller, contact admin@gotfreight.io.

GDPR (EEA/UK): if you are in the EEA or UK, you have rights to access, rectify, erase, restrict, and port your personal data, and to object to certain processing, plus the right to lodge a complaint with a supervisory authority. Where GotFreight acts as a processor for your lead/contact data, we assist you in responding to data subject requests; the controller (you) is the appropriate point of contact for those individuals.

CCPA/CPRA (California): California residents have rights to know, access, correct, and delete personal information, and to opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

To exercise rights or ask questions, email admin@gotfreight.io. We may need to verify your identity before acting on a request.

We use cookies and similar technologies that are necessary to run the Service — for example, to keep you signed in, maintain your session, and secure the application. We may use limited analytics to understand product usage and improve reliability.

We do not use third-party advertising cookies or sell data for advertising. You can control cookies through your browser settings, though disabling essential cookies may prevent the Service from working.

GotFreight is operated from the United States, and our subprocessors may process data in the United States and other countries. If you access the Service from outside the United States, your information will be transferred to and processed in the U.S. and other jurisdictions that may have different data-protection laws than your own.

Where required, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and the UK Addendum, and we take steps to ensure your information receives an adequate level of protection.

The Service is a business tool intended only for use by businesses and individuals who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact admin@gotfreight.io and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after an update means you accept the revised policy.

If you have questions, requests, or complaints about this Privacy Policy or our handling of personal information, contact us at admin@gotfreight.io. GotFreight is operated out of California, United States.