F FreightAudit AI

FreightAudit AI Privacy Policy

Effective date: October 23, 2026

Controller / business: FreightAudit AI (“FreightAudit AI,” “we,” “us,” or “our”)

Privacy contact: support@freightauditweb.com Operating location: Lahore, Punjab, Pakistan

Publication notice: This policy reflects the current repository configuration, not a legal audit or certification. Have qualified privacy counsel review it before publication. Hosting, retention, subprocessors, and privacy workflows must be verified against the actual production deployment.

1. Scope and our role

This Privacy Policy describes how we collect, use, disclose, and protect information when a business customer or its users access the FreightAudit AI website and service (the “Service”). The Service is designed for business-to-business freight and accounts-payable workflows.

For account and service administration, we generally act as the business responsible for the information we collect directly about account users. For freight documents and operational data that a Customer submits, Customer generally determines the purposes of processing and we process that data to provide the Service. Where required by law, the parties should enter into a data processing agreement that defines their respective roles and instructions.

2. Information we collect

2.1 Account and business information

We may collect and store:

  • username, email address, password verifier, company name, account role, profile settings, and account identifiers;
  • subscription plan, trial start, audit usage counts, payment status, billing period, transaction reference, and related support correspondence; and
  • Google account identifiers and OAuth tokens when an authorized user connects Gmail, plus per-user SMTP host, port, username, security settings, and an SMTP password stored in encrypted form by the application.

The application’s current paid plan is Professional at USD $300 per month. Its free trial is configured for 7 days or 25 audits, whichever happens first. The Service uses Lemon Squeezy-hosted checkout for configured recurring payments. We do not intend to receive or store full payment-card numbers; Lemon Squeezy handles checkout and payment processing under its own privacy policy.

2.2 Customer operational and freight data

Depending on Customer’s use, the Service may process:

  • carrier invoices, freight bills, bills of lading, proof of delivery, rate confirmations, and other uploaded PDF or image documents;
  • extracted text and fields such as load and invoice numbers, carrier names, contact details, billed and approved amounts, rates, line items, accessorial charges, and dispute notes;
  • shipment records, pickup and delivery details, origin and destination, driver check-in events, GPS coordinates or location timestamps, and tracking identifiers;
  • carrier identifiers and business contact information, including names, MC/DOT numbers, and accounts-receivable email addresses;
  • accounting exports, billing entries, status and settlement records, ERP connection metadata, and other operational and financial metadata; and
  • inbound email metadata such as sender, recipient, subject, message identifier, attachment count, processing status, and supported invoice attachments.

Web uploads support PDF, PNG, JPEG, and WebP documents, generally up to 10 MB per file. The inbound email flow currently accepts PDF invoice attachments up to 10 MB. Do not send documents or personal data that Customer is not authorized to disclose.

2.3 Technical information

The Service may process information generated by normal operation, including authentication and session data, timestamps, request and processing status, application error details, record identifiers, device/browser and network information made available by the hosting environment, and security or diagnostic logs. The codebase does not identify a configured third-party advertising analytics service. The actual hosting provider may independently generate infrastructure logs.

3. Tenant separation and shared carrier records

The application links user profiles, freight documents, shipments, batches, and related audit records to a user account and scopes core dashboard and document workflows to the signed-in user. We use these controls to keep each Customer’s primary workspace records separate from other Customers’ workspaces.

Important current limitation: The application also maintains a shared carrier directory. Carrier names, normalized names, MC/DOT numbers, and accounts-receivable email fields are not tenant-owned in the current data model. Carrier records may therefore be reused or updated across customer activity, and carrier-level scorecard or compliance information may be associated with shared carrier records. We do not represent that every carrier-related field or carrier-level aggregate is isolated to a single tenant. Customers requiring strict tenant isolation for all carrier data should contact us before uploading such information.

We do not sell or rent Customer Data or personal information. We use and disclose it only as described in this Policy, including to provide, secure, support, and maintain the Service, to follow Customer instructions, and to comply with law.

4. Purposes for processing

We use information to:

  • create and administer accounts, authenticate users, and apply seat roles and trial or subscription limits;
  • receive, store, render, extract, classify, and analyze freight documents and create audit records;
  • compare invoice charges with contract, shipment, proof-of-delivery, location, and fuel-surcharge information;
  • create dispute drafts, deliver customer-requested emails, produce reports and exports, and support accounting or payment workflows;
  • process subscription payments and reconcile billing events;
  • maintain, troubleshoot, secure, and improve the Service and prevent fraud, abuse, or unauthorized access;
  • respond to support requests and communicate operational, security, billing, or legal notices; and
  • comply with legal obligations and enforce agreements.

We do not use Customer Data to sell advertising or to create advertising profiles.

5. Service providers and other disclosures

We may disclose information to service providers acting on our instructions or to providers a Customer elects to connect. Based on the current code and deployment configuration, these may include:

  • Hosting, database, and file storage: The repository includes a Render deployment configuration with managed PostgreSQL and a persistent media disk. The application can also use local SQLite and filesystem storage. The actual production host, database, and storage must be confirmed by the operator; purchasing a domain from Hostinger does not establish that Hostinger hosts the application.
  • Document extraction: Google Gemini is configured as the primary AI extraction service. OpenAI may also be used if an OpenAI API key is configured. Document content, including rendered document pages and relevant contextual information, may be transmitted to the configured provider to return extracted fields. The provider’s own terms and privacy commitments apply to its processing.
  • Email: Google OAuth/Gmail is available for user-authorized dispute-email sending. Users may alternatively configure their own SMTP service. Email content and recipient information are transmitted through the selected email provider.
  • Billing: Lemon Squeezy provides hosted checkout and subscription payment notifications when configured as the merchant of record. Lemon Squeezy receives information needed to process payments.
  • Inbound email: Customer may configure a third-party inbound email provider to forward messages and PDF attachments to a tenant-specific address. The current application accepts compatible multipart webhook payloads but does not select or control the provider.
  • Government and public data: The Service may query the U.S. Energy Information Administration for diesel price data and the Federal Motor Carrier Safety Administration for carrier authority/compliance data. These queries may include the relevant fuel-series request or carrier identifier.
  • Accounting and payment workflows: QuickBooks Online, Xero, NetSuite, PayCargo-style rails, ACH, or related functions may be presented in the application. Current connectors may simulate or sandbox activity unless separately configured for live use. A CSV export is generated by the application; it does not by itself transmit data to an accounting provider.

We may also disclose information to professional advisers, in connection with a corporate transaction subject to appropriate safeguards, or to authorities where required by law or reasonably necessary to protect rights, safety, and security. We do not authorize service providers to sell Customer Data.

6. AI and automated processing

Automated extraction and rules may produce fields, classifications, discrepancy flags, and recommendations. Such results can be inaccurate or incomplete and must be reviewed by Customer. Uploaded documents may be sent to the configured AI provider as described above. The repository does not establish a contractual no-training setting or a universal retention period for every AI provider; Customers should review the provider terms and should not submit confidential material unless authorized to do so.

The Service does not make the Customer’s final decision to pay, dispute, approve, or record an invoice. Customer remains responsible for human review and the final business decision.

7. Cookies, sessions, and security

The Service uses session and security mechanisms necessary for authentication, maintaining user sessions, and protecting forms against cross-site request forgery. The production configuration enables HTTPS redirects and secure session and CSRF cookies when debug mode is disabled. The repository also configures security headers in production. These application settings do not guarantee that every deployment, storage layer, integration, or third-party system is secure.

SMTP passwords are encrypted by the application using a key derived from the Django secret key. Google OAuth tokens are stored for Gmail functionality; the code does not establish that every token or all database and file storage is encrypted at rest. We apply safeguards intended to protect information, but no online service can guarantee absolute security. Customers must protect credentials and promptly report suspected unauthorized access.

8. Data retention and deletion

We retain account and Customer Data for as long as the account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, maintain security, and enforce agreements. Payment and transaction records may be retained as required for accounting, tax, and payment obligations. Technical logs are retained as needed for operations and security.

The current application does not configure a fixed document-retention period, automatic deletion schedule, or self-service account deletion workflow. Terminating an account does not, by itself, guarantee that uploaded files and related records are immediately deleted. To request an export or deletion, contact us at the email below and identify the account and requested records. We will review and respond in accordance with applicable law and any applicable customer agreement; some information may need to be retained or may remain in backup systems for a period determined by the actual hosting provider.

Before launch, the operator should adopt and publish actual retention periods for active records, closed accounts, security logs, billing records, and backups, and implement a deletion process that can meet those commitments.

9. Privacy rights and U.S. state privacy laws

Depending on where an individual resides and the nature of the information, applicable privacy laws may provide rights to know, access, correct, delete, or receive a portable copy of personal information, and to appeal or object to certain processing. Requests may be sent to the contact in Section 13. We may need to verify the requester’s identity and authority and may deny or limit a request where an exception applies.

9.1 California (CCPA/CPRA) notice

For purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), this section describes categories that may be collected in the preceding 12 months, subject to actual use:

  • identifiers and business contact information, such as names, usernames, email addresses, and account identifiers;
  • commercial and transaction information, such as subscription status, invoice values, load data, and payment references;
  • internet or network activity and technical logs;
  • geolocation information, such as driver check-in coordinates or location timestamps where enabled;
  • professional or employment-related information, such as company, role, carrier, and business contact details; and
  • inferences or derived information, such as extracted document fields, discrepancy flags, carrier analytics, and audit recommendations.

We collect these categories from the Customer and its users, submitted documents, integrations, and the Service’s technical operation. We use them for the purposes in Section 4 and disclose them to the categories of service providers in Section 5. We do not sell or share personal information for cross-context behavioral advertising, and we do not sell or rent Customer Data.

Business contact details and freight-related operational data may relate to employees, drivers, carrier representatives, or other individuals even when provided in a commercial context. A business-to-business context does not automatically remove information from the scope of privacy laws. We do not knowingly collect or process sensitive personal information for the purpose of inferring characteristics about individuals. Requests may be submitted to the privacy contact below. We will not unlawfully discriminate against an individual for exercising a privacy right.

10. International processing

The Customer’s selected hosting, AI, email, payment, and integration providers may process information in countries other than the Customer’s location. Data location and transfer mechanisms depend on the actual deployment and provider settings. Before launch, the operator should identify the production regions and implement any transfer notices, safeguards, or contractual terms required by applicable law.

11. Children

The Service is a business service and is not directed to children under 18. We do not knowingly seek to collect children’s personal information. If you believe a child has provided information to the Service, contact us so we can review the request.

12. Policy changes

We may update this Policy to reflect changes to the Service, law, or data practices. We will post the updated version with a revised effective date and provide additional notice where required. Continued use after a change takes effect is subject to applicable law.

13. Contact us

For privacy questions, rights requests, data export or deletion requests, or suspected privacy incidents, contact: