← Return to Cargo Optix

Privacy Policy

Effective Date: September 18, 2026 • Version: 2.1

1. The Core Principle: Client-Side Processing

Cargo Optix is engineered with a privacy-by-design architecture. Your cargo manifests, SKU dimensions, packaging weights, and container packing configurations are parsed and calculated entirely within your browser session (via client-side WebAssembly and WebGL). Cargo manifests and operational packing sheets are never uploaded, persisted, or processed on our backend servers. Closing your browser tab clears all transient calculation data immediately.

2. Information We Collect

When you register for an account, sign in, or interact with our services, we collect:

• Account Details: Name, work email address, company name, and encrypted credentials managed securely via Supabase Auth.
• Usage & Rate Budgeting: The number of calculation runs consumed, subscription tier, and timestamps of service interaction.
• IP Addresses & Security Logs: We log client network IP addresses during signup and calculation requests. These logs are retained for exactly 30 days strictly to prevent multi-account automated quota abuse and brute-force attacks. We never use IP data for behavioral profiling or advertising tracking.
• Payment Records: When purchasing usage credits or subscriptions, transactions are processed directly by Stripe. Cargo Optix never receives, processes, or stores your payment card numbers or bank credentials.

3. Sub-Processors & Hosting Infrastructure

We partner only with industry-leading infrastructure providers adhering to ISO/IEC 27001, SOC 2 Type II, and GDPR compliance standards:

• Supabase: Authentication, user session management, and encrypted client profile databases.
• Stripe: PCI-DSS Level 1 certified billing and payment processing.
• Vercel: Global edge CDN delivery and static asset caching.

4. Encryption & Security Controls

All communication between your client device and our edge endpoints is strictly enforced over TLS 1.3 / HTTPS with HTTP Strict Transport Security (HSTS). Data at rest in our databases is encrypted using AES-256 with granular PostgreSQL Row-Level Security (RLS) policies guaranteeing customer data isolation.

5. Data Subject Rights (GDPR & Global Compliance)

Under GDPR, UK GDPR, and international data privacy regulations, you retain full ownership of your personal information. You have the right to request access to, rectification of, or complete erasure of your account and personal records at any time. We honor all verified data rights requests within 30 days.

To exercise your rights or submit questions, contact our Data Protection Officer at: support@cargooptix.com.