Privacy policy

1. Who is responsible for your data

The controller of the data of people using Spedo (Users) is [OPERATOR: name, address, tax ID (NIP), e-mail] (the Operator). For anything about personal data, write to the Operator’s e-mail address.

Data that Companies upload and create in the service — the carrier list, sent quote requests and loads — is processed on behalf of those Companies under a data processing agreement (Annex 1 to the terms). The controller of that data is the Company. If you are a carrier or a customer of a Company and want to exercise your rights, write to that Company; if you write to us, we will pass the request on to the Company.

2. What data we process, why and for how long

Account

• Data: e-mail address, full name, phone number, password hash (we never know the password itself), language, whether the address is confirmed, Company and role in it, creation date, version and date of acceptance of the terms.
• Purpose and legal basis: creating and running the account, providing the service and contacting you about it (Article 6(1)(b) GDPR); recording acceptance of the terms — demonstrating that the agreement was concluded (Article 6(1)(f) GDPR).
• Period: until the account is deleted. An account without a confirmed address and without a Company is deleted 30 days after it was created.

Sign-in and one-time links

• Data: hash of the session identifier (valid for 30 days), address confirmation links (valid for 48 hours), password change links (1 hour) and invitations to a Company (7 days; they contain the invited person’s e-mail address).
• Purpose and legal basis: signing in and account security (Article 6(1)(b) and (f) GDPR).
• Period: sessions are deleted when they expire, links 7 days after they expire.

Carrier directory (registration on /przewoznik)

• Data: country, NIP or VAT number, name, address, REGON and VAT status (for Polish companies, from the VAT taxpayer register), contact person, phone, e-mail, number and types of vehicles, lanes, notes, language, the accepted version of the terms and the date of consent. For sole traders this is the business owner’s personal data. Source: the carrier.
• Purpose and legal basis: running the directory the carrier asked to join — showing the company to Companies using the service and matching it to transport inquiries (Article 6(1)(b) GDPR).
• Recipients: Companies using the service (they see the details in their lists and Excel files and from then on process them as separate controllers to send transport inquiries).
• Period: until the carrier removes the entry (link sent by e-mail) or the Operator does. A registration whose e-mail address is not confirmed is deleted after 7 days; the confirmation link is valid for 48 hours and the link to change details for 24 hours.

Carrier directory (business contacts)

• Data: the carrier’s name, NIP, address, phone and e-mail, vehicle types and lanes, and the name of the carrier’s account manager (the forwarding employee who worked with it). No freight rates. For sole traders this is the business owner’s personal data. Source: business contacts made on transport orders, added to the directory by the Operator.
• Purpose and legal basis: business-to-business contact about transport — showing the carrier to Companies using the service and matching it to inquiries. This is the legitimate interest of the Operator, the Companies and the carriers (Article 6(1)(f) GDPR).
• Recipients: Companies using the service, as for the registration directory.
• Information and objection: every inquiry message says who is writing and where it got the address (Article 14 GDPR). The carrier can object to the processing at any time (Article 21 GDPR) and remove the entry: it enters its address on the /przewoznik page and gets a link to change or delete the details; it can also write to the Operator.
• Period: until the carrier or the Operator removes the entry. After removal only a hash of the e-mail address is kept, from which the address cannot be read, so that the entry does not return when the directory is updated; it is deleted when the carrier registers the company itself.

Company profile

• Data: NIP, name, address, REGON, VAT status and the White List check identifier, payment term, phone, reply-to e-mail, message signature, optionally the details of the Company’s own SMTP mailbox (password encrypted), the Company’s plan. For sole traders this is the business owner’s personal data. Source: the User and the Ministry of Finance VAT taxpayer register.
• Purpose and legal basis: providing the service to the Company (Article 6(1)(b) GDPR), checking that the Company is genuine (Article 6(1)(f) GDPR).
• Period: until the Company is deleted. A Company not confirmed by the Operator is deleted after 14 days.

Contact register and marketing contact

• Data: full name (contact person), phone, e-mail address, Company or carrier name, NIP or VAT number, country, city, role, account status and plan, sign-in method, language, registration date, date of consent to marketing contact. Source: account, Company profile, carrier directory and “this is my company” reports.
• Purpose and legal basis: serving the Operator’s customers — contacting you about your account, onboarding, plan and how the service works — and keeping a customer register (the Operator’s legitimate interest, Article 6(1)(f) GDPR). We send marketing information and offers by phone or e-mail only with your consent (Article 6(1)(a) GDPR and the Polish Electronic Communications Law); consent is optional and you can withdraw it at any time in Settings → Account (carriers: via the link to change their details), without affecting earlier contact.
• Access: only authorised administrators of the Operator (admin panel protected by a separate token). The register is not shared with Companies or anyone else and is not sold.
• Period: as long as the account, Company profile, carrier entry or report exists — once deleted, the data also disappears from the register. You can object at any time to contact based on legitimate interest.

Statistics and analytics

• Data: a log of events in the service — type (e.g. registration, inquiry analysis, carrier matching, sending, new load, plan change), date, account and Company identifiers, plan, language, loading and unloading countries, cities and regions, vehicle type, weight, number of pallets, a short cargo description, number of recipients and messages sent, and for carriers the country, region, fleet size and number of lanes. The log does not contain the text of inquiries, e-mail addresses or phone numbers.
• Purpose and legal basis: developing and maintaining the service, billing plans, aggregate statistics of the freight market (the Operator’s legitimate interest, Article 6(1)(f) GDPR).
• Period: 36 months. When an account, Company or carrier entry is deleted, its events lose the link to it and remain only as anonymous statistics.

Quote without an account

• Data: the inquiry text or screenshot pasted without creating an account (it may contain data of other people, e.g. a customer or a loading place) and the IP address.
• Purpose and legal basis: preparing a quote at your request before you create an account (Article 6(1)(b) GDPR); data of other people in the text and the IP address — the Operator’s legitimate interest: providing the service and preventing abuse, i.e. a daily limit of quotes per IP address (Article 6(1)(f) GDPR).
• Recipient: the text and screenshot are sent to the Claude API (Anthropic, section 3), which extracts the route, cargo, weight and dates.
• Period: we do not store the text or the screenshot on the server. The IP address is kept for one day in the server’s memory (the limit counter) and does not go into the database. The finished quote waits in the browser storage for up to 2 days for you to create an account (section 5).

Survey on the /demo page

• Data: answers to the survey questions (rating of the presentation and features, willingness to pay, role in the company, number of forwarders and inquiries, tools used), the open answer, the percentage of the video watched, the page language and the date. At the end of the survey you can give your full name, company name, e-mail and phone number and sign up for a free trial. The survey does not require an account. Without contact details the answers are anonymous; please do not include personal data in the open answer.
• Purpose and legal basis: developing the service based on feedback (the Operator’s legitimate interest, Article 6(1)(f) GDPR); trial sign-up — contacting you and preparing access at your request (Article 6(1)(b) GDPR); contact about the survey and its results — the consent ticked in the survey (Article 6(1)(a) GDPR). You can withdraw consent at any time by writing to the Operator; this does not affect the lawfulness of earlier contact.
• Recipients: authorised administrators of the Operator (admin panel). For a trial sign-up the Operator’s team receives an e-mail with the contact details and a few answers.
• Period: we delete contact details 12 months after the survey is filled in, or earlier when you withdraw consent or ask us to. The remaining answers stay without them as anonymous statistics. The IP address is kept for one day in the server’s memory (the per-address survey limit) and does not go into the database.

“This is my company” reports

• Data: e-mail address, phone and description given in the report.
• Purpose and legal basis: checking who represents the Company (Article 6(1)(f) GDPR).
• Period: until resolved, then for 90 days; reports are also deleted with the account.

Security and limits

• IP address: used only in the server’s memory for limits on sign-in, sign-up, password change and access password attempts (for at most one hour); the app does not write it to disk.
• Daily usage counters of the Company (AI analyses, messages sent): kept for 90 days.
• White List responses for checked NIP numbers: used for 24 hours, deleted after 7 days.
• Legal basis: the Operator’s legitimate interest — protecting the service from abuse and keeping within the Ministry of Finance request limit (Article 6(1)(f) GDPR).

Logs

• Application log: errors and events, e.g. deletion of an unconfirmed Company (NIP and name) or a failed e-mail (may contain the recipient’s address); because the service does not send e-mails at the moment, it also contains the recipient, subject and links of system messages (confirmations, invitations, password changes). The log has a fixed size (3 × 10 MB): the oldest entries are overwritten and the whole log is erased with every app update.
• Web server error log: IP address, page address and error description — only when an error occurs; kept for 30 days. We do not keep a log of visits.
• Legal basis: maintaining and securing the service (Article 6(1)(f) GDPR).

Unsent messages

• In the demo, quote requests are not sent to carriers. System messages (confirmations, invitations, password changes) are not sent either. Their sender, recipient, subject and text are saved in the database and deleted after 30 days.

Company data (processed on behalf of Companies)

• Carrier list, sent quote requests (deleted after 12 months) and loads — processed on behalf of the Company, on its instructions and for the duration of the data processing agreement; details in Annex 1 to the terms.
• Text pasted into the inquiry box before sending is not stored on the server. While the page reloads after a language change, the browser keeps a draft in the tab’s storage (see section 5).
• From load and inquiry data the Operator may create aggregate, anonymous statistics (e.g. average rates and margins on lanes) that do not identify the Company, its customer or a carrier (§ 2(4) of Annex 1).

3. Who receives the data

We use these sub-processors:

• OVH SAS (OVHcloud), France — the server that runs the service and stores the database (data centre in France).
• Cloudflare, Inc., USA — sits in front of all traffic to the service (encrypted connection, attack protection). It sees the IP address, the browser and the data sent.
• Anthropic, PBC, USA — Claude API: analysis of the inquiry text and screenshots pasted by the User (also in a quote without an account) and translation of messages to carriers into Polish.

• Ministry of Finance (Poland) — when checking a Company we send the NIP to the VAT taxpayer register API.
• Company Team — people in the same Company see the e-mail addresses and names of the others and who sent a quote request.
• Operator — when reviewing reports and confirming Companies, sees the report and the Company profile; authorised administrators of the Operator have access to the contact register, statistics and survey answers.

4. Transfers outside the EEA

Cloudflare and Anthropic are based in the USA. Data goes there under the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission. You can get a copy of the safeguards from the Operator.

5. Cookies and browser storage

We only use cookies and browser storage needed for the service to work, so we do not ask for consent. We do not use analytics tools, advertising or tracking cookies.

Cloudflare may ask the browser for anonymous reports about connection errors (Network Error Logging).

6. Your rights

• Access and portability: “Download my data” in Settings → Account (JSON file); the Owner can also download the Company data (“Download company data”, ZIP file).
• Erasure: “Delete account” in Settings → Account; the Owner can delete the Company.
• Rectification: the Owner corrects Company data in Settings; for other changes (e.g. e-mail address) write to the Operator.
• Restriction of processing and objection to processing based on legitimate interest — write to the Operator.
• Withdrawing consent to marketing contact: Settings → Account (carriers: the link to change their details) or a message to the Operator.
• Complaint to the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland) if you believe we process your data unlawfully.

7. Do you have to provide data

An e-mail address, a password (or signing in with a provider), your full name and phone number are required to create an account and a Company profile; the NIP is required to create a Company profile. Consent to marketing contact and other data are optional, as are taking part in the survey and giving contact details in it (without an e-mail we cannot sign you up for a trial).

8. Automated decisions

We do not make decisions based solely on automated processing that have legal effects on you (Article 22 GDPR). AI inquiry analysis and the carrier ranking are only a suggestion for the User.

9. Security

Security measures are described in § 5 of the Data processing agreement (Annex 1 to the terms).

10. Changes to this policy

After the Privacy policy changes, you will be asked to accept the new version when you open the app. The version number and effective date are shown at the top of this page.