Privacy Policy

For the data our client companies put into the Service (their customers, partners, shipments, documents and staff), the client company decides why and how it is processed and is the data controller. CargoWorld processes that data on the client's behalf and only on its instructions, as a data processor.

For our own website, demo requests and account administration, CargoWorld AI is the controller. Contact: info@cargoworld.ai, 5041 Stone Moss Way, Hoschton, GA 30548, USA.

Depending on how you use CargoWorld, we process:

We use personal data only to:

A user may choose to connect their own Google (Gmail / Google Workspace) or Microsoft 365 / Outlook mailbox so that e-mails they send from CargoWorld leave from their own address. The connection is optional, made by each person for themself, and can be removed at any time in My settings, or on Google's or Microsoft's account pages.

We request only the permissions needed to send: for Google, "openid", "email" and "https://www.googleapis.com/auth/gmail.send"; for Microsoft, "openid", "email", "offline_access" and "Mail.Send". CargoWorld cannot read, search, change or delete the messages in your mailbox, your contacts or your calendar.

What we receive and keep: your e-mail address (to show which mailbox is connected) and a refresh token that lets the Service send when you ask it to. The token is encrypted (AES-256-GCM) before it is stored, is tied to your user account, is never shown in the browser and is deleted when you disconnect. A copy of each e-mail you send is kept in your company's CargoWorld records, and the mailbox provider keeps it in your Sent folder.

We use this access only to send the e-mails you choose to send from CargoWorld. We do not use it for advertising, we do not sell it, and we do not share it with anyone except as needed to send the e-mail, to meet the law, or with your consent.

CargoWorld's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google or Microsoft APIs is not used to develop, improve or train generalized artificial intelligence or machine learning models, and no person at CargoWorld reads it unless you ask us to for support, it is needed for security or to meet the law.

Some features use an AI model to read text or documents (for example, an inquiry or a pre-alert) and draft a result for a person to check. When a user runs such a feature, the text or document is sent to our AI provider for processing. Under its commercial terms, our AI provider does not use this data to train its models. AI results are drafts: a person at the client company reviews them before they are used.

Data received from Google or Microsoft APIs through the e-mail integration is never sent to an AI provider.

The Service runs in the United States (US East region). We use these sub-processors:

Because the Service is hosted in the United States, personal data entered in Vietnam or other countries is transferred to and stored in the United States. We take the steps the applicable law requires for such transfers, including the documentation required by Vietnamese law, and we require our sub-processors to protect the data.

Client business data is kept while the client company's account is active. When the account ends, or when the client company asks, we delete or return its data within 30 days, except where the law requires us to keep it longer (for example, accounting records). Deleted data may remain in encrypted backups until those backups expire.

Mailbox connections are deleted as soon as the user disconnects or the user is removed. Demo requests are kept for as long as needed to answer them and follow up, and deleted on request.

We protect data with encrypted connections (HTTPS), separation of each company's data, role-based permissions, two-factor authentication, limits on failed sign-ins, passwords stored only as one-way hashes, and encryption (AES-256-GCM) of secrets such as mailbox tokens and API keys. Our hosting providers encrypt stored data. Changes are recorded in an audit log. No system is completely secure; if a breach affects your personal data, we will inform the client company and the authorities as the law requires.

Depending on the law that applies to you — including Vietnam's Law on Personal Data Protection and Decree 13/2023/ND-CP on personal data protection — you may have the right to be informed, to give or withdraw consent, to access, correct or delete your data, to restrict or object to processing, to receive a copy of your data, and to complain to the competent authority.

If your data was entered by a client company (for example, you are one of its customers or contacts), please contact that company first; we will help it answer. Otherwise write to info@cargoworld.ai. We answer within the time the law requires.

Client companies are responsible for the e-mails their users send through CargoWorld and must follow the anti-spam rules that apply to them, including Vietnam's Decree 91/2020/ND-CP on combating spam messages and e-mails and the United States CAN-SPAM Act. The Service supports this by sending from the user's real identity, adding an opt-out line to sales e-mails, keeping a do-not-contact list that is checked before each sales e-mail, and limiting how many sales e-mails each person can send per day.

We use only cookies needed for the Service to work: a session cookie that keeps you signed in, short-lived security cookies during sign-in and mailbox connection, and a cookie that remembers the language you chose on our website. We do not use advertising or third-party tracking cookies.

We may update this policy. The date at the top shows the latest version; for important changes we will inform client companies in advance.

Questions or requests: CargoWorld AI, 5041 Stone Moss Way, Hoschton, GA 30548, USA, info@cargoworld.ai.