Privacy Policy

1. Information We Collect

• Account information — your name, business name, email, an optional phone number, and password. Account login passwords are stored hashed, never in plain text.
• Carrier credentials — the API keys, tokens, account numbers, and carrier account passwords you connect. The sensitive secrets among these — API keys, tokens, and passwords — are encrypted at rest (AES-256-GCM) and are used only to make requests to the carriers on your behalf.
• Shipment data — origin/destination addresses, weights, dimensions, freight classes, quotes, bills of lading, labels, and tracking events you create or retrieve, including the consignee and bill-to details you enter.
• Usage & device data — log data, IP address, browser type, and actions taken in the Service, used to operate, secure, and improve the product.
• Analytics and error reports — privacy-friendly page-view and performance measurements (Vercel Web Analytics and Speed Insights, which do not use cookies) and a small set of named product events that never carry names, emails, addresses, account numbers, or prices; and, when something breaks, an error report containing the page address, browser type, error message, and your account and organization identifiers. Error reports we send outside our own systems for diagnosis are first stripped of emails, phone numbers, street addresses, and names.
• Carrier data — rates, transit times, tracking events, proof-of-delivery images, bills of lading, and invoice and charge amounts that your connected carriers return for your shipments, including through the invoice-audit feature.
• Tracking-share recipients — the email addresses you enter when you share a tracking update, and the message you add.
• Partner Program information — if you apply to or join our Partner Program: your name, email address, PayPal email address, website or audience details you provide, referral and commission records, and, where tax law requires, a completed IRS Form W-9, which contains your legal name, address, and taxpayer identification number (a Social Security number or employer identification number).
• Billing information — when paid billing is enabled, your plan, billing interval, and transaction history. Card details are entered directly into our payment processor (Stripe) and are not stored by Flutter Freight.

2. Categories of Personal Information We Collect (California disclosure)

For California residents, this section maps the information we handle to the categories of personal information defined under the California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code § 1798.140). For each category we describe the information, where we get it, why we use it, and the categories of recipients we may disclose it to. We collect this information directly from you when you register for and use the Service, automatically from your device and browser as you use the Service, and from the carrier accounts you choose to connect.

Identifiers and California customer‑records information (§ 1798.140(v)(1)(A)–(B)). Examples: your real name, business or company name, postal address, email address, telephone number, account username, a unique account identifier, and online identifiers such as IP address. Sources: you, and automatically from your device. Business purpose: to create, authenticate, and secure your account, provide and operate the Service, and communicate with you. Recipients: our service providers (hosting, database, email); the carriers you connect, where an identifier forms part of a shipment; and legal, safety, or corporate‑transaction recipients as described in this Policy.

Commercial information (§ 1798.140(v)(1)(D)). Examples: your subscription plan and status, billing and transaction records, and records of the quotes, bookings, shipments, bills of lading, and labels you create through the Service. Sources: you, and generated by your use of the Service; billing records via our payment processor once paid billing is live. Business purpose: to provide the Service, process transactions, maintain records, and support you. Recipients: our payment processor (for billing), hosting and database providers, and the carriers you transact with.

Internet or other electronic network activity information (§ 1798.140(v)(1)(F)). Examples: log data, IP address, browser and device type, pages and features viewed, and actions you take in the Service. Sources: automatically, from your device and our servers. Business purpose: to operate, secure, debug, and improve the Service and to detect and prevent abuse. Recipients: our hosting and infrastructure providers.

Geolocation data (§ 1798.140(v)(1)(G)). Examples: approximate location inferred from IP address, and the geocoding of postal addresses you type (for example, origin and destination addresses on a shipment), performed in your browser by our mapping provider. We do not collect precise (GPS‑level) geolocation about you. Sources: automatically (IP), and from addresses you enter. Business purpose: security and fraud prevention (IP), and address lookup and validation to build shipments (typed addresses). Recipients: our mapping provider (Mapbox), which receives typed addresses to return address suggestions.

Professional or employment‑related information (§ 1798.140(v)(1)(I)). Examples: your job title or role and your business contact details, and the business‑contact details of the consignee and bill‑to parties contained in the shipments you create. Sources: you. Business purpose: to operate your account and to prepare shipping documents and transmit shipment details to carriers. Recipients: the carriers you select. Where consignee or bill‑to details identify a California resident, we handle that information as a service provider on behalf of the customer who uploaded it.

Sensitive personal information (§ 1798.140(ae)). See the dedicated section below. In summary, the carrier account credentials you connect (API keys, tokens, and account numbers used to access your carrier accounts) are treated as sensitive personal information. We use them only to make requests to the carriers on your behalf. For Partner Program members only, the taxpayer identification number on a Form W‑9 is also sensitive personal information, used only for tax reporting.

We do not collect the following CCPA categories: characteristics of protected classifications (§ 1798.140(v)(1)(C)); biometric information (E); audio, electronic, visual, thermal, olfactory, or similar information (H); education information (J); or inferences drawn to create a profile about you (K).

3. Sensitive Personal Information

Some of the information you provide is treated as “sensitive personal information” under the CPRA. Specifically, when you connect a carrier account, you provide account log‑in credentials, API keys, tokens, and account numbers that allow access to your account with that carrier. Under Cal. Civ. Code § 1798.140(ae), credentials that allow access to an account are sensitive personal information, and we treat them accordingly.

We collect these credentials for one reason: so the Service can authenticate to the carriers you choose and, at your direction, retrieve rates, generate documents, book shipments, and pull tracking. We do not use your carrier credentials to infer any characteristics about you, we do not use them for advertising or profiling, and we do not sell or share them. They are encrypted at rest (AES-256-GCM), access is restricted, and each organization’s credentials are isolated from every other organization’s.

Because we use sensitive personal information only as necessary to perform the Service you have requested, and not to infer characteristics about you, the CPRA’s “right to limit the use and disclosure of sensitive personal information” does not apply to our use, and we are not required to offer a “Limit the Use of My Sensitive Personal Information” choice. You can remove any connected carrier credential at any time from your account settings, which stops all further use of that credential.

Partner tax forms. If you are a Partner Program member and tax law requires us to collect an IRS Form W‑9 before paying you, the form contains your Social Security number or other taxpayer identification number, which is sensitive personal information. We collect it only to meet our federal tax reporting obligations (for example, filing Form 1099‑NEC), store it in a private, access‑restricted storage location that only authorized Flutter Freight administrators can open, never share it except with tax authorities or our tax and accounting advisers as required, and never use it to infer characteristics about you.

We do not collect any other categories of sensitive personal information (such as other government identifiers, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of your mail, email, or text messages, genetic or biometric data, or information about your health, sex life, or sexual orientation).

4. How We Use Information

• To provide the Service — connect carriers, return quotes, generate documents, book, and track shipments;
• To secure the platform, detect abuse, and troubleshoot errors;
• To communicate with you about your account, support requests, and service updates, and to send the shipment notifications you choose in your notification settings;
• To send tracking links and tracking emails to the recipients you choose;
• To run the Partner Program — attribute referrals, calculate and pay commissions by PayPal, and meet tax-reporting obligations;
• To bill your subscription, once paid billing is enabled;
• To improve features and performance, and to comply with legal obligations.

We do not use personal information for advertising, and we do not use the shipment data or third‑party personal information you upload to train artificial‑intelligence models.

5. How We Share Information

We do not sell your personal information. We share information only as needed to run the Service:

• Carriers — we transmit shipment details and your connected credentials to the carriers you choose, to obtain rates, documents, tracking, and invoice amounts. Where you use address validation, the address is sent to that carrier’s own address-validation service under your own carrier account.
• Service providers / subprocessors — vendors that process data on our behalf under contract: Supabase (database and file storage), Vercel (application hosting, web analytics, and performance measurement), Mapbox (address lookup / geocoding), our email providers (Microsoft 365 and Resend) for account and transactional email, and, for paid plans, our payment processor (Stripe).
• De-identified error diagnostics — we use Anthropic to help diagnose software errors. Before an error report is sent, automated filters remove email addresses, phone numbers, street addresses, and names, so Anthropic receives only internal account and user identifiers and technical details, not your personal information.
• People you choose — when you share a tracking link or send a tracking email, the recipients you choose (and anyone they forward the link to) can see the shipment details shown on that page.
• Partner payouts and taxes — for Partner Program members, PayPal (to pay commissions to the PayPal email you provide) and tax authorities (for required information returns).
• Legal & safety — when required by law, or to protect the rights, safety, and property of Flutter Freight, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Our role for uploaded shipment data. When a business customer uploads personal information about third parties (for example, consignee or bill‑to names and addresses), Flutter Freight acts as that customer’s service provider and processes the data only on the customer’s behalf and instructions. For business customers, our Data Processing Addendum sets out these service‑provider commitments and is available for our business customers on request.

6. Do We “Sell” or “Share” Your Personal Information?

We do not sell your personal information, and we do not share it for cross‑context behavioral advertising. Under California law, a “sale” means disclosing personal information to a third party for monetary or other valuable consideration, and “sharing” means disclosing it to a third party for cross‑context behavioral advertising (targeted advertising across different businesses’ sites or services). We do neither. We do not use your personal information, or the third‑party personal information you upload, to serve you or anyone else targeted advertising, and we have no advertising business.

We also do not knowingly sell or share the personal information of consumers we know to be under 16 years of age. The Service is intended for business use and is not directed to minors.

Twelve‑month statement. In the preceding 12 months, we collected the categories of personal information described in the “Categories of Personal Information We Collect” section above, and we did not sell or share (as those terms are defined under the CCPA/CPRA) any personal information, and we did not use or disclose sensitive personal information for any purpose that would give rise to a right to limit. In that same period, for a business purpose, we disclosed personal information only to our service providers and to the carriers you direct us to transact with. The categories we disclosed for a business purpose were:

• Identifiers and California customer-records information;
• Commercial information;
• Internet or other electronic network activity information;
• Geolocation data;
• Professional or employment-related information; and
• To your chosen carriers only, the sensitive personal information (carrier credentials) needed to act on your behalf; and
• For Partner Program members, to tax authorities as required by law, the taxpayer information on Form W-9.

Transmitting your shipment details and your connected credentials to the carriers you select, and to our service providers who process data on our behalf under contract, is not a “sale” or “share”: carriers receive the data at your direction to perform the service you requested, and our service providers are contractually restricted to processing the data only to provide services to us.

7. How We Protect Your Data

We apply industry‑standard safeguards. Data is encrypted in transit (TLS). The connected carrier credentials you provide — API keys, tokens, and passwords — are encrypted at rest using AES‑256‑GCM, and account login passwords are stored hashed. We do not encrypt every field: for example, your account email and carrier account numbers are stored in standard form and protected by access controls and tenant isolation, so that each organization can access only its own data. Our database denies direct access by default and is reached only through our server; administrative access is limited to authorized personnel; and Partner tax forms are kept in a private storage location. No system is perfectly secure, but we work to protect your information and to respond promptly to incidents. You help protect your account by using a strong, unique password, not sharing logins, and removing users and carrier connections you no longer need.

8. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, and no longer than permitted by law. The retention period, or the criteria we use to set it, for each category is:

• Account and profile information (identifiers, professional and business-contact information): retained for the life of your account and deleted, or de-identified, within approximately 30 to 90 days after your account is closed, except where a longer period is required by law or to resolve disputes.
• Carrier credentials (sensitive personal information): retained only while the carrier connection is active, and deleted promptly — within approximately 30 days — after you disconnect the carrier or close your account.
• Shipment records, bills of lading, labels, and tracking (commercial and professional information): retained for the life of the account and for a period afterward to support recordkeeping, disputes, and legal compliance; the criteria include applicable transportation-recordkeeping norms and any legal hold.
• Billing and transaction records (commercial information): retained for the period required by tax, accounting, and audit obligations, typically up to seven years.
• Usage, log, and security data (internet/network activity, IP-based geolocation): retained for a limited period for security, debugging, and abuse prevention, typically 12 to 24 months, then deleted or aggregated.
• Partner Program records: referral, commission, and payout records are kept for as long as you participate and then for the period tax and accounting rules require, typically up to seven years. Forms W-9 are kept for at least four years after the last information return they support, as IRS rules require, and then deleted.
• Tracking-share recipient emails: kept with the shipment record they relate to and deleted with it.

Where information is retained in encrypted backups, it is deleted on our regular backup‑expiration cycle after it is deleted from active systems. Some records may be retained longer where necessary to comply with a legal obligation, establish or defend legal claims, or enforce our agreements.

9. Your California Privacy Rights

If you are a California resident, you have the following rights regarding the personal information we hold about you as an account user. To exercise any of these rights, see “How to Submit a Privacy Request” below.

• Right to know / access: request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it.
• Right to a portable copy: receive the personal information you have provided to us in a portable and, to the extent technically feasible, readily usable format.
• Right to delete: request that we delete personal information we have collected from you, subject to legal exceptions (for example, information we must keep to complete a transaction, comply with a legal obligation, secure the Service, or exercise or defend legal claims).
• Right to correct: request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: direct us not to sell or share your personal information. As explained above, we do not sell or share personal information, so there is nothing to opt out of; we honor Global Privacy Control signals as an opt-out preference regardless.
• Right to limit use of sensitive personal information: as explained in the Sensitive Personal Information section, we use sensitive personal information only to provide the Service you requested and not to infer characteristics, so this right does not apply to our use.
• Right to non-discrimination: you will not receive discriminatory treatment for exercising any of these rights (see the Non-Discrimination section below).

Requests about shipment data you upload. If your request concerns personal information contained in shipments a Flutter Freight customer uploaded about you (for example, if you are a consignee named on a shipment), we act as a service provider to that customer. Please direct your request to the customer that arranged the shipment; we will assist that customer in responding as required by law.

10. How to Submit a Privacy Request

How to submit. You may submit a privacy request by emailing us at privacy@flutterfreight.com. Because we operate exclusively online and interact with you directly through your account, email is a designated method for submitting requests.

What happens next. We will confirm receipt of your request within 10 business days and explain how we will process it. We will respond to a verifiable request within 45 calendar days of receiving it. If we need more time, we may extend our response by up to an additional 45 days (90 days total) and will notify you of the extension and the reason before the initial 45‑day period ends. There is no fee to submit a request, unless it is manifestly unfounded or excessive, in which case we will tell you why and, where permitted, may charge a reasonable fee or decline the request.

Verifying your identity. To protect your information, we must verify your identity before acting on a request to know, delete, or correct. We will match the information in your request against the information in your account and may ask for additional information to confirm you are the person the data is about. We use any information you provide for verification only, and delete it afterward. If we cannot verify your identity, we may be unable to fulfill the request, and we will explain why.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof that you gave them signed permission to act for you (or a valid power of attorney), and we may still require you to verify your own identity directly with us and to confirm that you authorized the agent.

11. Your Right to Non‑Discrimination

We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you the Service, charge you a different price or rate (including through discounts or penalties), provide you a different level or quality of Service, or suggest that you will receive any of these, because you exercised a privacy right.

We may not be able to complete a transaction or provide a feature if the personal information at issue is necessary to do so; for example, if you ask us to delete, or you disconnect, the carrier credentials required to obtain rates, we will no longer be able to return rates for that carrier. That is a direct consequence of the request, not discrimination. We do not offer financial incentives in exchange for the collection, sale, or retention of personal information; if that ever changes, we will describe the incentive and its material terms here and obtain your opt‑in consent.

12. Automated Decision‑Making

We do not use your personal information for automated decision‑making or profiling that produces legal or similarly significant effects about you. If we introduce any such processing in the future, we will update this Policy and provide any notice and choices required by law before doing so.

13. Data Breach Notification

We maintain safeguards designed to protect your information, and we maintain an incident‑response process. If we discover a breach of the security of the system that compromises unencrypted (or encrypted‑with‑compromised‑key) personal information we own or license, we will notify affected individuals in the most expedient time possible and without unreasonable delay, and in any event within 30 days after discovery, consistent with Washington’s data‑breach notification law (RCW 19.255) and the breach‑notification laws of the other states where affected individuals live, which may impose additional or shorter requirements that we will also follow. Where a single breach requires us to notify more than 500 Washington residents, we will also notify the Washington State Attorney General within 30 days, as required by that law. Notification may be delayed only as needed for the legitimate needs of law enforcement, or to determine the scope of the breach and restore the integrity of our systems.

Where the affected data is personal information that a customer uploaded to the Service and that we hold on the customer’s behalf but do not own (for example, consignee or bill‑to details), we will notify that customer of the breach immediately following discovery so that the customer, as the owner of the data, can notify the affected individuals; we will cooperate with and support the customer in doing so.

14. Where Your Data Is Stored, and Changes to Our Subprocessors

Data residency. We host and store personal information in the United States, using the service providers listed below. When you type an address into the Service, that address is sent from your browser to our mapping provider (Mapbox) to return address suggestions; this happens in your browser and is limited to the address text you enter. We do not otherwise transfer personal information outside the United States, except that when you book an international shipment, the shipment details necessarily go to the carrier you chose and, through it, to customs and carrier operations in the destination country. The Service is intended for U.S. businesses and is not directed to individuals in the European Union or United Kingdom.

Subprocessors. We use the following categories of service providers (subprocessors) to operate the Service, each under a contract that restricts them to processing data only to provide services to us: database and file storage (Supabase), application hosting, web analytics, and performance measurement (Vercel), address lookup and geocoding (Mapbox), email and productivity (Microsoft 365), transactional email (Resend), and, for paid plans, payment processing (Stripe). This is the same list as Section 6 of our Data Processing Addendum. Anthropic receives only de‑identified error reports, as described in Section 5, and is therefore not a subprocessor of personal information. We maintain a current list of subprocessors and will make a materially updated list available on request.

Changes to subprocessors. Before we add or replace a subprocessor that processes your personal information, we will update our subprocessor list and, where we have committed to do so in a customer agreement, provide advance notice and a reasonable opportunity to object. If you have a signed Data Processing Addendum with us, its notice and objection terms control.

15. Cookies

We use only first‑party cookies that we set ourselves, and no third‑party analytics or advertising cookies:

• Session cookie (essential) — an httpOnly cookie that keeps you signed in. Because it is httpOnly, it cannot be read by client-side scripts. It is deleted when you sign out and otherwise expires at the end of your session lifetime.
• Signed-out notice (essential) — a short-lived cookie, lasting about one minute, that lets the sign-in page explain why you were signed out.
• Referral cookie (Partner Program) — if you arrive through a partner’s referral link, a first-party cookie stores that partner’s referral code for 60 days so the partner can be credited if you subscribe. It contains no other information about you and is not used for advertising.

We also store a few non‑personal preferences in your browser’s local storage (for example, whether you have finished or dismissed the onboarding tour). Our web analytics and performance measurement (Vercel Web Analytics and Speed Insights) do not use cookies. You can control cookies through your browser settings, but disabling the essential session cookie will break core functionality such as signing in. We honor Global Privacy Control signals as described in Section 9.

16. Children’s Privacy

The Service is for business use and is not directed to children under 18. We do not knowingly collect personal information from children under 18; if we learn that we have, we will delete it. If you believe a child has provided us personal information, contact us at the address below.

17. Other U.S. State Privacy Rights

Depending on where you live, state privacy laws (for example, in Colorado, Connecticut, Virginia, Oregon, Texas, and other states with comprehensive consumer privacy laws) may give you rights similar to those described in Section 9 — to access, correct, delete, or obtain a copy of your personal information, and to opt out of targeted advertising, sale, or profiling. Many of these laws exempt information collected in a business or employment context, but we will honor these requests from any account user regardless of where you live, using the process in Section 10. If we deny your request, you may appeal by replying to our decision or emailing privacy@flutterfreight.com with “Appeal” in the subject line; we will respond to the appeal within the time required by law (generally 45 to 60 days) and, if we deny it, tell you how to contact your state attorney general.

Washington residents. Washington’s My Health My Data Act applies to “consumer health data.” We do not collect, use, or share consumer health data, so that law does not apply to the Service. If that ever changes, we will publish the separate consumer health data privacy policy the law requires before collecting any.

18. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the updated Policy here and change the “Effective date” above. If we make a material change, we will notify account users by email or in‑app before the change takes effect. We will not use personal information we collected under an earlier version of this Policy in a materially different way without first giving you notice and, where the law requires, obtaining your consent.

19. Contact

Privacy questions, requests, or appeals? Contact Flutter Freight LLC at privacy@flutterfreight.com.