Privacy Policy

1. Two Kinds of Information, and Who Controls Them

This distinction runs through the whole policy, so it comes first.

• Information REDDLAW controls. Personal information we collect for our own business relationship with a customer — accounts and authorized users, billing, support and communications, security and legal obligations. This policy describes how we handle it, and you can exercise the rights in § 9 with us directly.
• Information REDDLAW processes on a customer’s behalf. Personal information that appears inside a customer’s own freight workflow — for example a consignee contact, a driver name on a delivery record, or a contact at one of the customer’s own customers. REDDLAW handles that information on the instructions of the customer who put it there, under our agreement with them.

For the second category, we will not independently delete, correct or disclose that information without consulting the customer who controls it, except where the law requires us to act. If you believe your personal information sits inside a REDDLAW customer’s workflow and you want to exercise a right over it, contact that business. If you reach us instead, we will direct your request to them and assist as our agreement with them requires.

2. What We Collect

2.1 Account and contact information

Name, business email address, phone number, company name and role; credentials in hashed form; and records of account events such as verification and password resets.

2.2 Organization and authorized-user information

The organization a user belongs to, which organization is active for that user, the users permitted to access it, and their roles and permissions.

2.3 Shipment, quote, provider, document and operational data

Shipment requirements and references, origin and destination details, collection and delivery contacts, cargo descriptions, dates and milestones; requests sent to providers and the responses received, including prices and the terms attached to them; provider records, including a customer’s own private provider book where it has one; uploaded and received documents such as commercial invoices, packing lists and transport documents; and the tracking, milestone and exception records generated as a shipment runs.

2.4 Communications and support

Messages sent to and from our operations mailbox, including provider correspondence about a shipment and its attachments; messages submitted through our website contact form; and messages exchanged with our AI assistant, including in the public demo.

2.5 Technical and security records

Server and application logs, IP address and request metadata, error and job records, and the counters used for rate limiting. Rate-limit counters use a truncated one-way hash rather than storing the raw IP address as the counter key.

2.6 Billing information

Business name, billing address, billing country and region, tax identification number where applicable, invoice records and payment status. Card details are entered on our payment processor’s own hosted checkout and are never transmitted to or stored by REDDLAW. We receive confirmation that a payment succeeded and the associated reference, not the card number.

3. Why We Use It

• Account and organization data — to create and secure accounts, authenticate users, control which organization a user can reach, and provide support.
• Shipment, quote, provider, document and operational data — to run the coordination workflow: structuring requirements, contacting providers, organizing responses, making quote contents comparable, keeping documents with the movement, monitoring shipments and surfacing exceptions.
• Communications and support data — to respond to enquiries, correspond with providers about a shipment, keep a record of what was agreed, and improve how we answer.
• Technical and security records — to operate and secure the service, diagnose faults, and detect and investigate abuse, fraud and security incidents.
• Billing information — to charge for our own services, issue invoices, and meet tax, accounting and record-keeping obligations.

We do not use personal information for purposes materially different from those above without identifying the new purpose and obtaining consent where consent is required.

4. Consent

We collect, use and disclose personal information with consent, except where the law permits or requires otherwise. For business-contact information used to operate a freight workflow, consent is ordinarily implied by the act of submitting the information for that purpose, and the purposes are the ones set out in § 3 of this policy.

Where you provide us with someone else’s personal information — for example a delivery contact or a provider’s staff member — you are responsible for having the authority to do so.

You may withdraw consent at any time, subject to legal and contractual restrictions and on reasonable notice. Withdrawing consent for information necessary to run a shipment or maintain an account may mean we can no longer provide the service.

5. Service Providers and Disclosure

We disclose personal information only where it is needed to run the service:

• To providers — the collection and delivery details and operational notes a carrier, customs broker or other provider needs to perform the service.
• To our service providers (subprocessors) — the companies that supply the infrastructure the Platform runs on. As at the effective date above, these are: hosting (Railway), database and document storage (Supabase), transactional email delivery (Resend), email mailbox access for our operations inbox and address lookup (Google), AI model processing (OpenAI), payment processing (Stripe), and rate limiting (Upstash). Each is engaged to process information for us and for the purposes above.
• Where the law requires it — to comply with a legal obligation, respond to lawful process, or establish, exercise or defend a legal claim.
• On a business transfer — to a party to a merger, acquisition or sale of assets, subject to equivalent protection.

We do not sell personal information, and we do not license or otherwise make customer-identifiable operating data available to third parties for their own purposes.

6. AI Processing

REDDLAW uses third-party frontier AI models to assist with tasks such as reading and structuring operational information, organizing provider responses, comparing quote contents, identifying missing information and supporting shipment monitoring. Only the information required for the applicable workflow is submitted to the configured AI provider.

REDDLAW does not use Customer Data to train or fine-tune its own generalized models, create embeddings or vector stores, or build a generalized training corpus. AI processing is performed on a per-request basis: information is sent with the request that needs it and the model returns a result. We keep a record of agent runs for audit and troubleshooting; that record is not a training corpus and is not used as one.

Third-party AI model providers. As at the effective date above, OpenAI is the only AI model provider that receives production customer information. Retention and handling of information submitted to it are governed by that provider’s applicable business and API data terms. We do not add a new AI model provider to production without first reviewing its data-training, retention and human-review terms, confirming the account configuration, and updating this policy.

The public demo. Messages you type into the demo assistant are transmitted to our AI provider so it can reply. The demo runs on seeded, read-only data and does not write to our production systems; demo conversations are not stored in a customer account. Please do not enter confidential or personal information into the demo.

AI outputs are informational. They do not replace legal, customs, regulatory or tax expertise, and critical decisions remain subject to human review.

7. Separation Between Customers

Operational data is scoped to the organization it belongs to. In particular:

• A customer’s private provider book is scoped to that organization. It is not exposed to another organization, is not used to source another organization’s freight, and is not merged into any shared pool. This separation is enforced in the software and covered by automated repository invariant checks.
• A customer’s customer lists, negotiated rates and provider relationships are not used to enrich another organization’s workflow.
• Customer-identifiable operating data is not sold and is not licensed to third parties.

8. Retention

We keep personal information for as long as the account or workflow it belongs to is active, and afterwards for as long as we need it to:

• meet legal, tax, accounting and record-keeping obligations;
• establish, exercise or defend a legal claim, including a dispute about a shipment; and
• investigate fraud, abuse or a security incident.

We do not currently operate an automated deletion schedule. Deletion, access and correction requests are handled individually by our Privacy Officer (§ 9). Where information sits inside a customer’s workflow rather than in our own business records, § 1 applies.

9. Your Rights, and How to Exercise Them

Subject to the limits the law allows, you may:

• ask what personal information we hold about you and how it is used;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete information, where permitted by law;
• withdraw consent, on the terms in § 4; and
• complain to the Office of the Privacy Commissioner of Canada if you are not satisfied with our response.

Send requests to our Privacy Officer at ops@reddlawlogistics.com. We will acknowledge a request and respond within the period PIPEDA allows. We may need to verify your identity before acting, and we will explain any part of a request we cannot fulfil.

10. Security

We apply administrative and technical safeguards appropriate to the sensitivity of the information, including:

• passwords are stored cryptographically hashed, never in plain text;
• sessions use signed, restricted cookies that a browser script cannot read;
• organization-scoped access controls protect operational data;
• data is encrypted in transit;
• incoming webhooks are authenticity-verified before they are acted on;
• rate limiting and access controls protect the service against abuse; and
• administrative access is separated from customer access and is restricted.

No system is completely secure. We do not guarantee that a security incident can never occur, and we will notify affected parties and regulators where the law requires.

11. Cookies and Browser Storage

REDDLAW currently sets no analytics, advertising or marketing cookies. The cookies we do set are strictly necessary to provide secure account access. Our Cookie Policy names them, explains what browser storage the Platform uses, and says what your choices are.

12. Processing Outside Canada

Information may be processed outside Canada, including in the United States and other jurisdictions where REDDLAW’s service providers operate. When information is processed outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement and national security authorities there. REDDLAW uses contractual, organizational and technical safeguards appropriate to the service and information involved.

13. Changes to This Policy

We may update this policy. The effective date at the top reflects the current version. Where a change materially affects how we handle personal information, we will provide notice by an appropriate method such as email to the contact on your account, a notice within the Platform, or another direct communication.

14. Contact

Privacy Officer
REDDLAW Logistics Inc.
Hamilton, Ontario, Canada
Email: ops@reddlawlogistics.com