Privacy Policy

Cartra AI, LLC (“Cartra,” “we,” “us,” or “our”) is a Delaware limited liability company. We provide Cartra AI Logistics (the “Service”), a workflow-automation product for logistics and freight-forwarding teams, available at logistics.cartra.ai. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.

This policy applies to the Service and our related websites. The Service is built for businesses, and most people use it on behalf of an employer or other organization (a “Customer”). When we process information on behalf of a Customer, such as the contents of a mailbox a user connects or files uploaded to the Service, we do so under our agreement with that Customer, and the Customer controls that information. If you use the Service through your organization, its own privacy practices also apply. Your use of the Service is also governed by our Terms of Use.

Information we collect

Information you provide

• Account information. Your name, work email address, and password. Your work email address (usually its domain) determines which organization your account belongs to. Passwords are stored only in hashed form.
• Content you submit. Messages and prompts you send to the AI assistant, files you upload, voice input you record (which is transcribed into text), skills and instructions you create, and workflow settings such as email categories and folder mappings.
• Connection settings. Server addresses and access credentials you enter to connect business systems, such as freight ERP software.
• Communications. The contents of messages you send us, for example when you ask for support.

Information collected automatically

• Log and device information. IP address, browser and operating system type, pages and resources requested, timestamps, and error details.
• Usage information. The features you use and the actions you take, including logs of automated workflow runs, such as when a run occurred, which message it processed, and the result.
• Cookies and browser storage. See Cookies and similar technologies below.

Information from your organization

Your organization may give us information about you, such as your name and work email address, so that we can set up your account and associate it with the right organization.

Information from connected third-party services

When you connect a third-party account, such as a Microsoft Outlook mailbox, we receive information from that service as permitted by the access you grant. For a mailbox, this can include email messages and attachments, sender and recipient details, folder names, and basic profile information such as your email address. When you or your organization connect a business system, such as freight ERP software, the Service may retrieve records from it, such as shipment or booking details, when needed to complete a task you have set up, or when an AI app you connected asks for them (see The e-Freight connector for AI apps).

How we use information

We use the information we collect to:

• Provide and operate the Service, including creating and authenticating accounts and associating them with the right organization.
• Carry out the features you and your organization enable, such as answering questions in chat, transcribing voice input, reading and classifying incoming email, moving messages into folders, and looking up records in connected business systems.
• Keep the Service secure, including sending one-time verification codes and detecting and preventing fraud, abuse, and unauthorized access.
• Troubleshoot problems, monitor performance, and maintain and improve the security, reliability, and operation of the Service.
• Communicate with you about the Service, including security notices and responses to your requests.
• Comply with legal obligations and enforce our terms.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: performing our contract with you or your organization; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and your consent, where required, which you may withdraw at any time.

AI features and your data

The Service uses AI models to power features such as the assistant, voice transcription, and email classification. To provide these features, the relevant content, such as your prompt, an uploaded file, or an email being classified, is sent to third-party AI model providers, which process it and return a result to us.

• We do not use your content to train AI models. Your prompts, chats, files, voice input, emails, attachments, records from connected systems, and the outputs the Service generates from them are not used to train or fine-tune any AI model, whether ours or anyone else’s.
• AI model providers process data only to provide the Service. Third-party AI model providers process your content only to provide the Service to you and your organization, not for their own purposes.
• Review AI outputs. AI-generated responses and classifications can be inaccurate or incomplete. Review them before relying on them, especially for decisions that affect shipments, customers, or payments.

These commitments cover Cartra and the AI model providers we use. An AI app that you connect to the e-Freight connector yourself, such as ChatGPT or Claude, is not one of our providers. See The e-Freight connector for AI apps.

How we share information

We share information only as described below.

• Service providers. We use trusted vendors (sometimes called subprocessors) to run the Service. They fall into these categories: cloud hosting and infrastructure; database and authentication; AI model providers; integration and connectivity providers that manage connections to third-party accounts; document-processing providers that extract text from files and attachments; and email delivery providers that send verification codes and service messages. They may use information only to provide services to us and must protect it. A current list is available on request.
• Your organization. Your organization and its authorized administrators may access information associated with your account and your organization’s use of the Service, such as workflow settings and run logs. Other users in your organization may be able to see files and other content added to shared workspaces.
• Services you connect. When a feature acts in a connected service, such as moving an email into a folder or querying an ERP system, we send that service the information needed to complete the action.
• AI apps you connect. When you connect an AI app, such as ChatGPT or Claude, to the e-Freight connector, we send that app the records it requests on your behalf and an access token that identifies you. See The e-Freight connector for AI apps.
• Legal and safety reasons. We may disclose information when we believe in good faith that it is required by law or legal process, or necessary to protect the rights, property, or safety of Cartra, our users, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will continue to protect it as described here or notify you of any material change.
• With your consent. We may share information for other purposes when you or your organization direct us to.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Third-party integrations

You connect accounts such as Microsoft Outlook through the provider’s own authorization flow (OAuth). We never see or store your password for that service. We use the permissions you grant only to provide the features you or your organization enable, such as reading messages to classify them and moving them into folders.

You can revoke access at any time by disconnecting the account in the Service or by removing Cartra’s access in the provider’s account settings. After you disconnect, we stop retrieving new data from that account. Credentials you enter to connect business systems are encrypted when stored and are used only to make the requests your features need. Each third-party service handles your data under its own privacy policy.

The e-Freight connector for AI apps

The e-Freight connector lets you use your organization’s records in e-Freight, a freight-forwarding system, from an AI app you choose, such as ChatGPT or Claude. You add the connector, or the “Cartra Logistics” plugin, to the app, sign in with your Cartra account, and approve the connection. The app can then look up records when you ask it to. The connector is read-only: it cannot create, change, or delete records. It works only for organizations that have linked their e-Freight account to Cartra, and each person can read only the kinds of records their organization allows. The connector is part of the Service, so the rest of this policy also applies to it. This section describes what is specific to it.

Information we collect and keep

• Account information. Your name, work email address, password (stored only in hashed form), and the organization you belong to, as described above. The connector uses your Cartra account and does not create another one.
• Connection records. When you approve an app, we record which app you connected and the address it returns to, your account and organization, the access you approved, when you connected it, when it last used the connection, and whether it was revoked. The codes and refresh tokens that keep the app connected are stored only in hashed form. Access tokens are not stored.
• Access settings. Which kinds of e-Freight records each person may read (Operations, Billing, Costs, and Search), as set by Cartra and by your organization’s e-Freight access managers, and who last changed them.
• Requests from the app. For each request, the app sends us the name of the tool it wants to use and its inputs, such as a reference number, a company name, or a date range. We receive only these inputs, not your conversation with the app.
• Request logs. For each request, we log your Cartra user ID, the app’s client ID, your organization’s e-Freight account identifier and access level, the tool used, the time, how long the request took, its result (for example, success, error, or refused), the app’s software name and version, and the IP address the request came from (usually the app’s server), shortened so that it identifies a network rather than a single device. These logs do not contain your email address, the tool’s inputs, or the records returned. The software that queries e-Freight for us may record a tool’s inputs, such as a reference number or search term, when it logs a warning or an error.

We do not store the records the connector returns. They pass through our servers to the app and are not kept after the request is complete.

Information we return to the AI app

When the app asks, the connector retrieves records from your organization’s e-Freight account and returns them to the app. These records belong to your organization, and we process them on its behalf. Depending on your access, they can include:

• Business contact details. Names, addresses, contact names and job titles, phone and fax numbers, and email addresses of your organization’s customers, shippers, consignees, notify parties, agents, carriers, truckers, vendors, and other business partners.
• Business partner profiles. Carrier and FIRMS codes, payment terms, and compliance flags, such as a government screening hold.
• Shipment details. Bookings, house and master bills, reference numbers (such as air waybill, bill of lading, container, and purchase order numbers), routes, flights and vessels, dates and milestones, cargo descriptions, pieces, weights and volumes, customs and release status, trucking and delivery appointments, and proof-of-delivery dates.
• Financial details. Customer invoices and receivables, vendor bills and payables, charges, costs, amounts paid and due, payment references, and shipment profit.
• Staff references. The e-Freight user codes or names of your organization’s staff recorded on these records, such as the operator assigned to a shipment, the sales representative on an invoice, or who verified or approved a vendor bill.

The app also receives the access token we issue for the connection. It contains your email address, your Cartra user ID, identifiers of your organization and its e-Freight account, and your access level.

How we use this information

• To sign you in, show you what you are approving, issue and renew the app’s access, and apply your organization’s access settings.
• To retrieve the records the app asks for and return them to it.
• To keep the connector secure and working, including enforcing usage limits, detecting and preventing misuse, investigating problems, and keeping a record of which accounts and apps used it.

We do not use this information for advertising, we do not sell it, and we do not use it to train AI models.

Who receives it

• The AI app you connect. The app’s provider, such as OpenAI for ChatGPT or Anthropic for Claude, receives the records returned to the app and the access token, and handles them under its own terms and privacy policy, not ours. For example, it may keep them in your conversation history, and your settings with that provider decide whether it may use your conversations to improve its models. That provider is not our service provider, and we do not control it. Review its privacy policy and settings before you connect.
• The provider of e-Freight. The connector reads records using your organization’s e-Freight account, so the provider of e-Freight, which already holds these records for your organization, receives each request, such as the reference number being looked up. We do not send it your name, email address, or Cartra user ID.
• Our service providers. Our hosting, database, and authentication providers store and process the information above to run the connector, as described in How we share information.
• Your organization. Your organization’s e-Freight access managers, and Cartra administrators, can see what you may read and how many apps you have connected, and can change your access or disconnect your apps.

How long we keep it

• Account information is kept as described in Data retention.
• Connection records. Access tokens expire one hour after they are issued. Refresh tokens expire 30 days after they are issued, and an app in regular use receives a new one each time it renews its access. We keep a connection’s records while it is active and delete them within 90 days after it is revoked or expires. Deleting your account deletes them at once.
• Access settings are kept until your organization or your account is deleted. If you leave your organization, your own setting is kept and applies again if you rejoin.
• Request logs are deleted automatically by our hosting provider, currently after 7 days and in any case within 30 days.

Your choices

• Disconnect an app. Sign in to Cartra and open Settings → Account → Connected apps, then choose Revoke, or remove the connector in the AI app. A revoked app can no longer renew its access, and an access token it already holds stops working within an hour.
• Control what people can read. Your organization’s e-Freight access managers choose, in Settings → e-Freight access, which kinds of records each person’s apps can read, and can disconnect a person’s apps. The consent screen and Settings → Account → Connected apps show your current access.
• Delete your account. Email team@cartra.ai from the address on your account. Deleting your account also deletes your connection records and access settings. Records an AI app has already received stay with that app; delete them there, for example by deleting the conversation.

You can also exercise the rights described in Your rights and choices.

Cookies and similar technologies

• Essential cookies. We use cookies to keep you signed in and to protect your session. The Service cannot work without them.
• Browser storage. We store interface preferences, such as your light or dark theme and layout settings, in your browser’s local storage. These are not used to track you.

We do not use advertising cookies or third-party tracking cookies. Because we do not track you across sites, the Service does not change its behavior in response to browser “Do Not Track” signals.

Data retention

We keep account information for as long as your account is active. We keep content and workflow data, including chats, files, skills, settings, and run logs, until you or your organization delete it or the Customer’s account ends, subject to the Customer’s instructions. We keep log information for a limited period for security and troubleshooting. The retention periods specific to the e-Freight connector are listed in The e-Freight connector for AI apps.

When information is no longer needed, we delete or de-identify it within a reasonable period, unless we must keep it longer to meet legal obligations, resolve disputes, or enforce our agreements. Copies in backups may persist for a limited time until they are overwritten.

Security

We use technical and organizational measures designed to protect your information, including encryption in transit, encryption of stored credentials for connected business systems, email verification at sign-up, and access controls that limit who can reach customer data. No system is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and tell us right away at team@cartra.ai if you suspect unauthorized access to your account. If a security incident affects your personal information, we will notify you or your organization as required by law.

International data transfers

Cartra is based in the United States, and we and our service providers may process information in the United States and other countries whose data protection laws may differ from those where you live. When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or other lawful transfer mechanisms.

Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your personal information.
• Receive a copy of your information in a portable format.
• Object to or ask us to restrict certain processing.
• Withdraw consent where we rely on it.

If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with your local data protection authority. Residents of certain U.S. states have rights to know what personal information we collect and how we use and disclose it, to access, correct, and delete it, and to opt out of its sale or use for targeted advertising. We do neither. We will not discriminate against you for exercising your rights.

To make a request, email team@cartra.ai. We will verify your identity, for example by confirming you control the email address on your account, and respond within the time required by law. You may use an authorized agent where the law allows, and you may appeal a decision by replying to our response. If your request concerns information we process on behalf of your organization, we may refer you to your organization and will help it respond.

You can also disconnect integrations at any time and delete content, such as files and skills, where the Service offers that option.

Children’s privacy

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above. If we make material changes, we will give more prominent notice, such as an email or a notice in the Service, before they take effect. If you continue to use the Service after an update takes effect, the updated policy applies.

Contact us

If you have questions about this policy or our privacy practices, contact Cartra AI, LLC at team@cartra.ai.