Privacy Policy

1. Scope and our role

CargoFlow is operated by Gant Technology Group LLC, doing business as CargoFlow. CargoFlow is a business-to-business freight and import-operations platform. This policy applies to the CargoFlow website, demo and pilot request forms, the authenticated CargoFlow application, and CargoFlow-operated integrations.

For shipment, customer, document, communication, and other business records submitted by a customer organization, that organization generally decides why the information is used and who may access it. CargoFlow processes those records to provide the service and acts as a service provider or processor where applicable. For CargoFlow's own website inquiries, account security, service administration, fraud prevention, and legal compliance, CargoFlow may determine the relevant processing purposes.

If your employer or another organization issued your account, its own privacy, records-management, employment, contractual, and compliance rules may also apply.

2. Information CargoFlow processes

• Public inquiry information. Name, work email, company, role, team size, requested demo/pilot/partnership or privacy topic, message, consent to be contacted about the request, and submission time.
• Account and security information. Name, work email, role, account status, authentication information, multi-factor authentication status, session/security events, policy acceptance records, privacy-request history, and activity needed to protect access.
• Logistics and business records. Shipment references, bills of lading or airway bills, container numbers, purchase orders, customers, carriers, routing, milestones, tracking information, operational notes, tasks, approvals, rates, billing workflow, handoffs, uploaded documents, email-file metadata and previews, communications, and audit history entered or generated through authorized use.
• Customer Portal information. Customer-viewer name and work email, customer association, portal access status, shipment and document visibility settings, invitation status, release and delay information, customer-facing action notes, quote decisions, pre-shipment requests, customer-created shipment fields, generated or reserved File IDs, report-email preferences, transactional delivery metadata, portal submissions, and related access or activity records.
• Document-security information. File name, type, size, category, upload status, content hash, scan or quarantine status where enabled, and records needed to validate document integrity and control customer-facing release.
• Technical and anti-abuse information. Request, error, reliability, and security information. The public request form may temporarily store a one-way hash derived from the submitting network address to rate-limit abuse; CargoFlow does not need the original address for that control.
• Interface preferences. Non-sensitive settings such as visual theme may be associated with a signed-in user or stored locally in the browser.

CargoFlow is not designed as a repository for Social Security numbers, full payment-card data, personal banking credentials, protected health information, biometric templates, or other highly sensitive consumer data unless a specific CargoFlow feature and written customer agreement expressly authorizes that use. Users should not upload such information merely because a document field permits attachments.

3. Public website, demos, pilots, and privacy requests

CargoFlow uses public inquiry information to respond to the request, evaluate potential demos or pilots, communicate about the requested business relationship, prevent spam or abuse, and maintain a reasonable record of business outreach.

Visitors who do not have a CargoFlow account can use the public Request CargoFlow form and choose Privacy / data request, or email support@cargoflowdg.com. Signed-in users can use Settings → Privacy & Data Requests.

4. Google Workspace and Gmail Carrier Inbox

When an authorized Administrator connects a shared Gmail inbox, CargoFlow may process the Google account email address, OAuth connection status, an encrypted OAuth refresh token, and message information necessary to detect likely carrier replies. For a likely match, this may include Gmail message/thread identifiers, sender, subject, received time, a limited text preview, carrier-match confidence and reason, and an Administrator's classification or summary.

Gmail data is used only for the user-facing Carrier Inbox workflow and related security or legal compliance. A detected message does not automatically change an operational carrier status; an authorized Administrator reviews and classifies it.

Google Workspace Limited Use

• Google user data is not sold or transferred to advertising platforms or data brokers.
• Google user data is not used for advertising, retargeting, or creditworthiness decisions.
• Google user data is not used to create, train, or improve a general-purpose artificial-intelligence or machine-learning model.
• Human access is limited to authorized user-facing review, security/support situations where permitted, or legal obligations.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Customer Portal actions, shipment creation, and service email

When an authorized Administrator creates or sends a Customer Portal invitation, CargoFlow may process the recipient's name, work email, customer association, an invite-token hash, expiration and consumption status, and transactional delivery metadata. Depending on Customer configuration, Customer Portal users may also submit pre-shipment information, accept or decline quotes, generate or reserve a CargoFlow File ID, create shipment records using customer-specific fields, and choose whether to receive scheduled customer status emails. CargoFlow records related identifiers, timestamps, account identity, configuration, and audit information needed to perform and secure those actions.

When transactional email delivery is enabled, the minimum recipient information and customer-visible shipment status needed to send an invitation, service notice, or opted-in scheduled report may be transmitted to the configured email provider. Scheduled customer reports are built from shipment information already approved for Customer Portal visibility and are designed to exclude internal pricing, costs, margin, staff assignments, and internal notes.

Documents, email files, and malware screening

CargoFlow may store uploaded shipment documents and email files, extract limited preview information for authorized users, and calculate a SHA-256 content hash for integrity checking. When document malware scanning is enabled, document bytes and basic file metadata needed to perform the scan may be sent to the configured malware-scanning provider. Scan or quarantine status may be used to prevent a document from being exposed through customer-facing workflows until the applicable security check is satisfied.

Smart Paste and operational automation

Smart Paste currently recognizes supported shipment fields using CargoFlow application logic in the user's browser and presents detected values for review before the user applies them. CargoFlow does not currently send Smart Paste text to a third-party general-purpose AI model. Other rules, calculations, classifications, alerts, and operational suggestions may be generated by CargoFlow or connected data sources and should be reviewed before they are relied on.

Outlook draft workflow

CargoFlow's current Outlook workflow prepares a shipment email draft for user review and then opens Outlook Web through the user's browser. CargoFlow does not currently connect server-side to Microsoft 365 or obtain Microsoft mailbox permissions for this feature. Once the user opens Outlook Web, information entered or sent there is handled under the user's Microsoft account and Microsoft's terms and privacy practices.

Carrier and tracking connections

When an authorized user invokes a configured tracking connection, CargoFlow may transmit a container number, booking reference, transport-document reference, carrier identifier, or similar shipment reference to the applicable carrier or tracking service and receive tracking events, status, routing, and milestone information in return. Carrier information may be incomplete, delayed, or subject to the provider's own terms.

5. How CargoFlow uses information

CargoFlow uses information to provide shipment and carrier workflows; organize documents, tasks, approvals, billing readiness, and audit history; provide authorized tracking and alerts; administer accounts; respond to demos, pilots, support and privacy requests; prevent abuse; troubleshoot errors; protect the service; enforce applicable agreements; comply with law; and improve reliability and usability.

Where a law requires a legal basis for processing, the basis may include performing a contract or requested service, legitimate business interests such as security and service improvement, compliance with legal obligations, or consent where consent is required. A customer organization may have its own legal basis for business records it submits to CargoFlow.

6. Sharing, subprocessors, and connected services

CargoFlow does not sell personal information and does not use personal information for cross-context behavioral advertising or targeted advertising.

Information may be disclosed to infrastructure, database, communications, security, and integration providers only as needed to operate CargoFlow; to authorized users of the customer organization according to role and tenant access; to a connected service when an authorized user intentionally invokes that integration; in a corporate transaction subject to appropriate safeguards; or when disclosure is reasonably necessary to comply with law, protect rights or security, or investigate misuse.

Current technology may include cloud hosting, managed database, transactional email, malware scanning, messaging/queue, Google Workspace, carrier, and similar operational providers. Provider use depends on the feature and customer configuration. See Subprocessors & Connected Services for the current public provider disclosure.

7. Retention and deletion

• Gmail Carrier Inbox message copies: matched Carrier Inbox records are limited to a 30-day review window. After that window, the stored inbox copy is deleted. Human-authored classification outcomes and summaries may remain as operational or audit history without retaining the underlying Gmail message preview.
• Gmail OAuth credentials: the encrypted refresh token is kept only while the connection remains configured. Disconnecting Gmail removes the stored token and CargoFlow attempts to revoke it with Google.
• OAuth state: short-lived authorization state expires after approximately 10 minutes.
• Public anti-abuse fingerprint: the one-way request fingerprint is cleared after approximately 24 hours.
• Public demo/pilot inquiries: inquiries are retained for up to 24 months unless a shorter period is requested or a longer period is reasonably required for an active business relationship, dispute, fraud prevention, or law.
• Customer Portal invitations: invitation tokens are stored as one-way token hashes with expiration, delivery, revocation, and consumption metadata. Expired, consumed, or revoked invite records may be retained for a limited audit and abuse-prevention period before cleanup.
• Document-security records: document content hashes, scan/quarantine status, upload metadata, and related audit records may remain with the underlying organization record for integrity, security, and records-management purposes even after a temporary scan request has completed.
• Accounts and business records: shipment, customer, document, billing, audit, account, and related records are retained according to the customer organization's operational needs, contractual commitments, security obligations, legal requirements, and configured deletion decisions. Audit records may need to outlive an individual user account.

CargoFlow aims to keep personal information only as long as it is reasonably necessary for the stated purpose. Backup or disaster-recovery copies may persist for a limited additional period before cycling out.

8. Security

CargoFlow uses server-side authorization, tenant and role controls, secure authentication cookies, Administrator multi-factor authentication, security-event records, restrictive browser security headers, encryption of connected-service refresh tokens, document integrity hashes, file-type and upload validation, and malware/quarantine controls where enabled. Sensitive information should be encrypted in transit through HTTPS and protected at rest through the service and infrastructure controls available for the relevant data store.

See Security & Trust for a current product-security overview. Security controls reduce risk but cannot guarantee that the service, an integration, or an uploaded file will be free from every vulnerability or malicious condition.

No system can promise absolute security. Users and customer organizations are responsible for protecting credentials and devices, limiting user access to legitimate business needs, promptly removing access that is no longer required, and reporting suspected compromise.

9. Cookies and browser storage

CargoFlow uses essential authentication/session cookies and may use local browser storage for non-sensitive interface preferences. CargoFlow's current website and application do not use advertising cookies or behavioral-advertising trackers. If non-essential analytics or advertising technologies are introduced, the applicable notice and consent controls must be updated before deployment where required.

10. Privacy rights and choices

Depending on where you live, the law that applies, and CargoFlow's role for the data, you may have rights to request confirmation or access, correction, deletion, restriction, a portable copy, withdrawal of consent, or an appeal of a privacy-request decision. Some laws also provide rights to opt out of sale, targeted advertising, sharing for cross-context behavioral advertising, or certain profiling. CargoFlow does not currently engage in those sale or advertising activities.

• Signed-in users can submit and track a request in Settings → Privacy & Data Requests.
• Public website visitors can use the Request CargoFlow form and choose Privacy / data request or email support@cargoflowdg.com.
• An authorized Administrator can disconnect the shared Gmail integration.
• Google access may also be revoked through the connected Google account's third-party access settings.
• A customer organization may deactivate team accounts and control organization-owned business records, subject to contractual, legal, security, and records-retention requirements.

CargoFlow may need to verify the requester's identity and authority before acting. Requests may be limited or declined where permitted by law, including when information must be retained for security, legal claims, another person's rights, or legitimate organization records. Where applicable law grants an appeal right, submit a follow-up privacy request labeled Appeal.

See Data & Account Removal for practical removal steps.

11. International use and transfers

CargoFlow is currently designed primarily for business operations in the United States. If a customer organization authorizes use from another jurisdiction, information may be processed in the United States or other locations where approved service providers operate. Where required, the customer and CargoFlow should put appropriate contractual or transfer safeguards in place before regulated international personal data is introduced.

12. Children

CargoFlow is a business operations service and is not directed to children. CargoFlow does not knowingly invite children to create accounts or submit public business inquiries.

13. Policy changes and contact

CargoFlow may update this policy when features, integrations, legal requirements, or data practices change. Material revisions will receive a new effective date and, for authenticated users when appropriate, a new policy version requiring acknowledgment.

Privacy questions or requests may be sent to support@cargoflowdg.com. Signed-in users may also use Settings → Privacy & Data Requests, and public visitors may use the Request CargoFlow form with Privacy / data request. General business inquiries may be sent to contact@cargoflowdg.com. If an organization issued your account, you may also contact that organization's CargoFlow Administrator.

Business mailing address: Gant Technology Group LLC d/b/a CargoFlow, 6650 Rivers Ave., STE 100, Charleston, SC 29406. For faster privacy requests, please use the contact methods above.