Privacy Policy

This Policy explains how GENOMA HQ TECHNOLOGY LTDA (CNPJ 49.213.490/0001-01, Avenida Paulista, 1106, sala 01, 16º andar, Bela Vista, São Paulo/SP, CEP 01310-914), which operates CargoIA, processes personal data on the website (https://cargoia.com.br), the platform (https://painel.cargoia.com.br), the CargoIA app, the API and the MCP server, under Brazil's General Data Protection Law (Law 13,709/2018, "LGPD"). Capitalized terms mean what they mean in the Terms of Use. The Portuguese version of this Policy prevails over this translation.

1. Who decides about the data

• CargoIA is the controller of the data of website visitors, of whoever has access to the platform (name, e-mail, sessions, billing) and of the market data it gathers.
• The Customer is the controller of the personal data it puts in about third parties — for instance, shippers' and drivers' contacts on a recorded freight. For that data CargoIA is the processor: it handles it as the Customer instructs and as the Terms say, and forwards data subjects' requests to the Customer.

2. What data we process

Website visitors. The website sets no cookies of its own and uses no analytics or advertising tools. If you write to us through the contact form, we receive your name, e-mail, company, phone (optional), team size and message; they reach our mailbox and are not stored in a database. The website's hosting records technical access data, such as the IP address.

Platform and app users.

• Sign-up: name, e-mail, password (kept only as a hash), language and time zone.
• Sessions: the date, IP address and browser or device of each session — you see them, and can end sessions, on your profile.
• Account: the organizations, each person's role and permissions, invitations (the invitee's e-mail and who invited them) and licenses.
• Use: the quotes and freights you record, the lanes you follow, conversations with the assistant (kept whole, visible only to whoever had them) and each person's record of assistant use (model, volume and cost).
• Feedback and sales requests: the message, the page and browser details, and a screenshot if you attach one.
• Integrations: API keys (kept only as a hash), webhook addresses and the deliveries made to them.

Billing. Stripe processes payment and receives the account's name, the administrator's e-mail and language; the card, the CPF or CNPJ and the billing address are given to Stripe directly. CargoIA keeps the subscription's status and its references at Stripe, never card details.

The app. The app keeps on the device what it needs to work without a signal — the session (in the system's secure storage), quotes, the freight exchange and conversations — and erases it all on signing out. Camera and location are asked for only when a feature needs them, and only while the app is in use.

Market data. To measure the price of freight, CargoIA gathers freight offers published in public sources and in public groups and channels of freight offers on messaging apps. An offer may carry the name and phone number of whoever posted it or of the contact it names. Those details serve only to record and check the offer: they are never shown to Customers, who see only the lane, the cargo, the vehicle and the price.

3. Purposes and legal bases

Purpose	Legal basis (LGPD)
Create and keep the account, authenticate, provide the Service and support	Performance of a contract (art. 7, V)
Charge the subscription and issue receipts	Performance of a contract and legal obligation (art. 7, V and II)
Send the Service's e-mails (confirmation, invitations, reports, billing notices)	Performance of a contract (art. 7, V)
Answer questions through the AI assistant	Performance of a contract (art. 7, V)
Security and fraud prevention	Legitimate interest (art. 7, IX)
Measure and improve the Service with aggregated data	Legitimate interest (art. 7, IX)
Gather published freight offers for the price history	Legitimate interest, over data made public by the data subject (art. 7, IX and § 4)
Answer a sales inquiry	Pre-contractual steps at the data subject's request (art. 7, V)

We do not sell personal data, do no targeted advertising and make no automated decisions with legal effects on you.

4. Whom we share it with

Only with suppliers that help us provide the Service, each with the least it needs:

• Stripe — payments;
• OpenRouter and the model providers it calls (such as DeepSeek and Google) — the content of questions to the assistant and the data looked up to answer them; reading the texts and pictures of freight offers;
• Resend — sending e-mail;
• Vercel — hosting the website;
• Hostinger — the domain and the mailbox;
• the infrastructure provider of the platform's servers;
• OpenStreetMap Foundation — your browser downloads map images from it, which exposes your IP address to it;
• GraphHopper — only when an organization chooses it as its map provider: it receives the routes' addresses and coordinates.

We also share data when the law or an order of a competent authority requires it, or to defend rights in legal proceedings.

5. International transfers

Several of these suppliers process data outside Brazil, mainly in the United States and Europe. Those transfers rest on the cases of article 33 of the LGPD — such as those needed to perform the contract with you and the suppliers' contractual clauses — and we require them to protect the data in line with this Policy.

6. How long we keep it

• Account and usage data: while the account exists. Deleting the account erases its organizations and their records from the platform.
• Each person's sign-up (name and e-mail): while it exists; deleting an account does not erase it.
• Sessions: valid for 7 days, and can be ended on your profile.
• Technical logs of the services: up to 15 days.
• Webhook deliveries: 30 days.
• Links to exported reports: valid for 7 days.
• Billing: payment records stay with Stripe, under its own policy.
• Assistant use: while the account exists, for the monthly credit count.
• Market data: while it is part of the price history.
• Contact form messages: in our mailbox, while useful to the conversation.

7. Your rights

Under the LGPD you may ask for: confirmation that we process your data and access to it; correction; anonymization, blocking or erasure of data that is unnecessary or processed unlawfully; portability; information on whom we share it with; review of automated decisions; and to object to processing based on legitimate interest.

Write to contato@cargoia.com.br, which is also the channel of our data protection officer. We answer within 15 days. If the data was put in by a Customer, we forward the request to it, as the controller. You may also complain to Brazil's National Data Protection Authority (ANPD).

8. Security

Passwords and API keys are kept only as hashes; all traffic uses TLS; each account's data is isolated from the others'; files are uploaded and downloaded through signed, short-lived links; and each person reaches only what their role allows. No system is infallible: if a security incident may bring relevant risk or harm, we will notify the affected data subjects and the ANPD, as the law requires.

9. Cookies and device storage

• Website: no cookies of its own.
• Platform: only necessary cookies — the session, the account and organizations selected, the language and the side menu's state — and the theme preference in the browser's storage. There are no analytics or advertising cookies.
• App: the data described in section 2, kept on the device and erased on signing out.

10. Children and teenagers

The Service is meant for businesses and people over 18, and we do not knowingly process children's or teenagers' data.

11. Changes to this Policy

We may update this Policy. Material changes will be announced by e-mail or in the Service before they apply. The date of the last update is at the top of this page.

12. Contact

Controller: GENOMA HQ TECHNOLOGY LTDA, CNPJ 49.213.490/0001-01, Avenida Paulista, 1106, sala 01, 16º andar, Bela Vista, São Paulo/SP, CEP 01310-914. E-mail: contato@cargoia.com.br.