Privacy policy.

1. Who we are and our role

CarShipDesk provides hosted software to auto-transport brokerages. Questions about this policy go to hello@carshipdesk.com.

• Where we decide how data is used (controller). For information about visitors to this website, people who request access, and the account, billing and sign-in information of our customers’ staff, CarShipDesk is the controller, or the “business” under California law.
• Where a brokerage decides (processor). For the records a brokerage keeps in CarShipDesk about its own customers, carriers and staff (“Customer Data”), the brokerage is the controller and CarShipDesk processes the information on its behalf, as its processor or “service provider”, under our Data Processing Addendum. If you are a customer or carrier of a brokerage that uses CarShipDesk, that brokerage’s privacy notice applies to you.

2. Information we collect

• Account and contact information: name, work email, phone number, role, brokerage name and the organizations you belong to. Sign-in is handled by WorkOS; CarShipDesk does not store passwords.
• Request-access form: your name, brokerage, work email, desk size, the load boards you use and your message.
• Billing information: billing contact, plan, seat count and invoices for your CarShipDesk subscription. Card details are entered on our payment processor’s hosted page; we never see or store a full card number.
• Usage and device information: server and application logs of the pages and features used, IP address, browser and device type, timestamps, and error reports.
• Security logs: sign-ins and sessions (device, browser and IP address), and records of sensitive actions such as grant changes, settings changes, payments and exports.
• Communications: emails you send us and our replies.
• Customer Data: whatever a brokerage enters into or connects to CarShipDesk, processed on the brokerage’s behalf as described in section 1.

3. Cookies

We use only strictly necessary cookies: the sign-in session cookies that keep you signed in and protect your session, and cookies that remember interface choices you make in the dashboard, such as theme and density. We use no advertising cookies, and we do not use analytics or tracking tools on the website or in the product today. If that changes, we will update this policy first and offer any choice the law requires.

4. How we use information

• To provide and operate the Service for your brokerage, including the integrations you connect (to perform our contract with the brokerage).
• To secure the Service, verify brokerages, and prevent fraud and abuse (our legitimate interest in a safe service, and legal obligations).
• To support you and reply to access requests and questions (our contract, or our legitimate interest in answering you).
• To bill for CarShipDesk subscriptions (our contract).
• To send service notices, such as security alerts and changes to these policies (our contract and legal obligations).
• To improve the Service using usage and error information (our legitimate interest in a working product).
• To comply with the law and respond to lawful requests (legal obligations).

We do not sell personal information and do not share it for cross-context behavioral advertising, as the California Consumer Privacy Act (CCPA) defines those terms, and we have not done so in the past 12 months. We do not use Customer Data for our own marketing, and we never share one brokerage’s records with another.

5. Service providers and subprocessors

These providers run parts of the Service for us. Each receives only what its function needs and is bound by a contract to protect it.

Integrations a brokerage connects. Central Dispatch, Super Dispatch, RingCentral, the brokerage’s own payment processor account (such as its own Stripe account) and its email provider are the brokerage’s own providers, not ours. When a brokerage connects one, data moves between CarShipDesk and that provider on the brokerage’s instructions and under the brokerage’s agreement with that provider.

Other disclosures. We may also disclose information when the law requires it, to protect the rights, property or safety of CarShipDesk, our customers or others, in connection with a merger, acquisition or sale of assets (with notice to affected customers), or with your consent.

6. How long we keep information

• Account and billing information: for as long as the account is active, plus up to 24 months after it closes, for legal, tax, accounting and dispute purposes.
• Request-access submissions: up to 24 months after our last exchange, unless you become a customer.
• Security logs (sign-in and session records): 12 months.
• Customer Data: as set out in the Data Processing Addendum and the Terms: available for export for 30 days after the subscription ends, then deleted. The audit log inside a brokerage’s workspace is part of its Customer Data.
• Backups: deleted information can remain in backups until they expire on their normal schedule, currently within 35 days.

7. Security

The measures below are in place today:

• Encryption in transit. Connections to the website, the dashboard and the API use TLS.
• Encryption at rest. Stored data is encrypted at rest by our hosting and database providers.
• Tenant isolation. Every brokerage's records are separated by row-level security enforced in the database itself, not only in application code.
• Connected-service credentials. Keys and tokens for load boards, telephony and payment processors are encrypted with a separate key before they are stored.
• Access controls. Each person signs in individually through our authentication provider. Inside a workspace, roles and per-person grants decide who can see and do what. Access to production systems is limited to the CarShipDesk personnel who need it.
• Audit logging. Sensitive actions, such as grant changes, session actions, settings changes, payments and exports, are recorded with who did them and when.
• No stored card data. CarShipDesk never stores a full card number or CVV code. Card entry happens on the payment processor's hosted page.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that affects your personal information, we will notify you and, where we act as a processor, the brokerage, as the law and our agreements require.

8. Your rights and choices

• Depending on where you live, you may have the right to know and access the personal information we hold about you, to correct it, to delete it, to receive a portable copy, and to opt out of its sale, sharing for targeted advertising or profiling. We do not sell or share personal information or use it for targeted advertising or profiling.
• To make a request, write to hello@carshipdesk.com. We will verify it, usually by confirming that you control the email address on file, and respond within 30 days, or within 45 days where the CCPA applies. Where the law allows, we may extend that period once, and we will tell you if we do.
• An authorized agent may make a request for you with proof that you authorized it. We will not treat you differently for exercising your rights.
• If we decline a request, you may appeal by replying to our decision, and we will respond within the time the law requires.
• If your request is about Customer Data that a brokerage holds, for example because you shipped a vehicle with that brokerage, we will pass it to the brokerage and help it respond. You can also contact the brokerage directly.
• Signed-in users can see the personal details we hold for their account on the Profile page of the dashboard.

9. Children

CarShipDesk is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we have, write to hello@carshipdesk.com and we will delete it.

10. Where data is stored

CarShipDesk is offered to businesses in the United States. We store and process personal information in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States.

11. Changes to this policy

When we change this policy, we will post the new version here and update the dates at the top of the page. If a change is material, we will tell customers by email or in the product before it takes effect.