Data & Account Removal
This page explains how to disconnect Google access and request access, correction, restriction, or deletion of CargoFlow information.
1. Submit a privacy or data request
CargoFlow or the customer organization may need to verify identity, authority, and the relevant data before acting. A request may be limited where information must be retained for another person's rights, security, fraud prevention, contractual obligations, legal claims, regulatory requirements, or legitimate organization records.
2. Disconnect the shared Gmail inbox
An authorized CargoFlow Administrator can disconnect Gmail directly from the application.
CargoFlow removes the stored encrypted OAuth refresh token, stops future Gmail sync, and attempts to revoke the token with Google. The Gmail mailbox itself is not deleted or changed.
The Google account owner may also revoke CargoFlow through Google's third-party access controls.
3. Gmail Carrier Inbox retention
- Matched Carrier Inbox message copies are retained for no longer than 30 days and then removed from the Carrier Inbox store.
- Short-lived OAuth authorization state expires after approximately 10 minutes.
- After an Administrator classifies a carrier reply, the human-authored outcome and summary may remain as operational or audit history. Older stored Gmail sender/subject details are minimized after the 30-day review window.
- Disconnecting Gmail removes the stored OAuth refresh token but does not automatically erase independent business records or human-authored summaries that are subject to a separate retention obligation.
4. CargoFlow account deactivation or deletion
A CargoFlow Administrator can deactivate a team account so it can no longer sign in. A signed-in user can request deletion from Settings → Privacy & Data Requests. If account access is unavailable, contact the Organization's CargoFlow Administrator, submit a public Privacy / data request, or email support@cargoflowdg.com.
Deleting or deactivating an account may not erase audit records identifying actions previously performed by that user when those records are needed for security, business integrity, legal claims, or regulatory/contractual records.
5. Customer Portal invitations and customer-viewer accounts
An authorized Organization Administrator may deactivate a Customer Portal viewer, revoke unused invitations, change what shipments are shared, and control which eligible documents are visible to that customer. Portal invitation tokens are stored as one-way hashes rather than reusable plain-text tokens in the invite record.
Expired, consumed, or revoked invitation records and delivery metadata may remain for a limited audit, troubleshooting, security, and abuse-prevention period before cleanup. Deactivating a portal viewer does not automatically delete organization-owned shipment history or documents.
6. Shipment, customer, document, and business records
Shipment records, customer data, purchase orders, uploaded documents, document hashes and security status, tracking events, approvals, rates, billing records, communications, handoffs, and other operational information are generally controlled by the customer Organization. CargoFlow will not silently destroy organization records merely because an individual user requests account deletion.
Requests involving organization-owned records are reviewed against the Organization's instructions and applicable contractual, customs, transportation, legal, security, audit, and records-retention requirements.
7. Public demo and pilot request data
Public demo/pilot inquiries are retained for up to 24 months unless a shorter period is requested or a longer period is reasonably required for an active business relationship, dispute, fraud prevention, or law. The one-way anti-abuse fingerprint associated with the request is cleared after approximately 24 hours.
To request deletion or correction of a public inquiry, use the Request CargoFlow form and choose Privacy / data request, or email support@cargoflowdg.com. Include the same work email used for the original inquiry so CargoFlow can locate the record.
8. Request tracking and appeals
Authenticated privacy cases record status changes and resolution details so the process remains auditable. Public requests may be routed through the secure inquiry workflow for review. If applicable law gives you a right to appeal a decision, submit a follow-up request clearly labeled Appeal and identify the prior request.
9. What deletion cannot guarantee
Deletion from active application records may not immediately remove information from encrypted backups, disaster-recovery copies, security logs, or records that CargoFlow or the customer Organization must retain. Those copies should be isolated from ordinary use and allowed to expire or be deleted under the applicable retention cycle, unless preservation is legally required.
10. Questions
Questions about a specific deletion, retention, account, or Google-access request can be sent to support@cargoflowdg.com, submitted through Settings → Privacy & Data Requests, submitted through the public Privacy / data request option, or directed to the Organization that provided the CargoFlow account.