Privacy & Data Security Policy

1. Information We Collect

This policy covers Linehaul accounts and workspaces, public invoice audits, support, and the public website. Linehaul handles information to provide the freight-invoice workflow, manage accounts and billing, resolve reported issues, and protect service reliability. Your organization chooses which business documents to submit and which teammates may access its shared workspace.

• Account and team information: name, work email address, company/workspace information, authentication records, password hashes, accepted legal-document versions and timestamps, workspace role/ownership status, and team-invitation metadata such as invited email, role, status, inviter, and timestamps. Linehaul does not store your plaintext password, and active invitation bearer tokens are stored in the application database only as cryptographic hashes.
• Company domains, join requests, and sign-up state: email domains an administrator adds and the DNS verification records and results (including when a domain was last checked), join-request settings, and the name, work email address, and decision status of people who ask to join a workspace. While account setup is in progress, your email address, name, chosen plan, and company name are held temporarily in your signed browser session until setup is completed or abandoned. Background-job records (for example, a domain check) record the job type, status, and timestamps.
• Invoice and shipment information: uploaded PDFs or EDI documents and the text, metadata, charges, identifiers, addresses, references, and other structured information extracted from them. This can include files submitted through the public audit workflow as well as authenticated workspaces.
• Workspace configuration and history: review decisions, corrections, duplicate/rebill decisions, dispute and recovery records, carrier alias rules, ERP/GL mappings, export preferences, team roles, processing activity, and other settings required to provide the Service.
• Billing information: purchase/contact details, plan and subscription identifiers, currency, payment status, receipts or transaction references, and information needed to link a purchase to a workspace. Whop handles payment-card entry; Linehaul does not receive the buyer’s full payment-card number from Whop checkout.
• Audit, contact, and support information: the email address and files submitted for a public audit, messages you send, and optional invoice context or diagnostics you choose to attach. Invoice documents and text can contain personal names, addresses, account numbers, and other business or personal information.
• Security and operational information: IP address, browser/request information, timestamps, request identifiers, security events, and application logs used for authentication, rate limiting, troubleshooting, abuse prevention, and reliability.

3. How We Use Information

We use information for document extraction, supported freight-charge and tariff-math review, duplicate/rebill review, dispute evidence and recovery tracking, invitations and access control, exports, billing, support, security, and reliability. Product improvement includes investigating reported extraction or workflow issues and using the aggregated or de-identified statistics described below.

• No sale of invoice data: Linehaul does not sell or rent customer invoice documents or proprietary freight-rate information to data brokers, freight brokers, or advertising networks.
• Automated processing: Linehaul's production PDF parser uses deterministic document-processing and OCR components inside a network-isolated parser boundary. The untrusted PDF process does not receive model-provider credentials or outbound network access.
• AI-assisted fallback: when Linehaul's optional production fallback is enabled, a trusted application process may send bounded extracted invoice text and, for image-only rescue, safe rasterized page previews produced inside the parser sandbox to the configured AI extraction provider. The raw PDF is not handed directly to that provider by the sandboxed parser.
• Data in AI requests: text or page previews may still contain names, addresses, shipment identifiers, charges, and negotiated rates. A limit on input size or pages is not anonymization. Privacy Mode governs Linehaul’s retained invoice record; it does not erase a provider’s copies or determine that provider’s retention, processing location, or model-training practices. Those depend on the applicable provider arrangement. The provider page describes supported optional arrangements.
• Support diagnostics: authenticated support and feedback forms can optionally include extracted fields or parser diagnostics. The interface identifies when extracted invoice text or other business data will be included; those details are not attached unless the user selects the corresponding option.
• Public audits and necessary human access: Linehaul personnel review public-audit submissions and may access workspace or support records when authorized and reasonably needed to investigate a reported issue, protect the Service, or fulfill a privacy request. Public-audit findings and requested exports are sent to the email address supplied by the requester.
• Aggregated and de-identified information: Linehaul may derive statistics from Service usage for reliability, capacity planning, product improvement, and business-to-business marketing. Public statistics must not identify a customer or user or disclose customer-specific invoices, freight rates, carrier relationships, or other confidential business information. Information that can reasonably be linked back to an individual remains subject to the applicable privacy safeguards.
• Feedback: Linehaul may use feedback, suggestions, and feature requests voluntarily submitted to improve the Service and may summarize or use that feedback in business-to-business marketing without identifying the source. Linehaul does not attribute a testimonial or quote to a customer without separate approval.
• Domain verification and join requests: Linehaul performs public DNS lookups to check that an organization controls a claimed domain. If an administrator enables join requests for a verified domain, a person who signs up with a matching, verified work email address may be shown the workspace name and may ask to join; the requester’s name and work email address are shown to that workspace’s administrators, who decide whether to approve. Linehaul does not tell a person whether an email address or domain is registered to a workspace unless that person has verified control of the address.

Operational emails may include verification, invitations, password recovery, requested audit results, billing, and support. Promotional messages are subject to applicable consent and unsubscribe requirements. Requesting an audit or accepting the Terms does not by itself authorize every future marketing message. Organization name/logo permission and separate approval for attributed testimonials are described in Section 7 of the Terms of Service.

4. Public-Site Analytics & Browser Storage

When optional public-site analytics is configured, Linehaul uses Microsoft Clarity only on selected low-sensitivity public marketing and calculator pages. It is excluded from sign-in, registration, team-invitation acceptance, password-reset, checkout, support/contact, enterprise-contact, demo-upload, and authenticated workspace pages. Where Clarity requires consent, analytics is not loaded until the visitor allows it. In other regions, analytics may load automatically on those public pages.

A browser-local preference records an analytics choice when one is made. Visitors can reopen Analytics Preferences from the public footer to allow or decline analytics. Necessary session, security, and anti-abuse technologies may operate separately where required to provide or protect the Service.

If you arrive through a Linehaul link that carries campaign parameters (for example utm_source or ref), Linehaul stores those short values in a first-party cookie for up to 60 days. If you later request a free audit or create a workspace, they are saved with it so Linehaul can tell which outreach led to it. The cookie holds no personal information and is not shared with third parties.

The public demo keeps anonymous daily counts of how it is used: how often it is opened, how many visits reach each step of its guided tour, and how many go on to request an audit or create a workspace. These counts are totals only. Counting adds no cookie or browser storage and records no identifier, IP address, or browsing history, so the counts cannot be linked to you.

Linehaul also uses cookies and browser local/session storage for account sessions, interface preferences, and temporary navigation or activity state. Examples include whether the PDF pane or sidebar is open, dismissed activity notices, and returning to an invoice list. Some preferences stay in that browser and do not follow you to another device. Clearing browser storage can reset them; it does not delete server-side invoice records or cancel a subscription.

5. Service Providers, Security & Workspace Isolation

• Service providers and subprocessors: Linehaul uses third parties for hosting, network/security services, transactional email, billing, encrypted offsite backups, optional inbound-email processing, optional AI-assisted extraction, and selected public-site analytics. The material provider list and the functions/data involved are published on the Linehaul Subprocessors & Service Providers page. Optional services receive information only when their relevant integration is used. Providers such as the payment platform may also handle information for their own payment, security, or legal obligations under their policies.
• Cross-border processing: Linehaul and its providers may process or store information in Canada, the United States, or other jurisdictions where the applicable provider operates. Information processed outside your province, state, or country may be subject to the laws and lawful-access requirements of those jurisdictions. Linehaul limits provider access to the functions reasonably needed to operate the Service and uses contractual, technical, and organizational safeguards appropriate to the service and information involved.
• Workspace isolation: authenticated application operations are designed to scope customer records to the authorized company/workspace. Teammates in the same company workspace can access shared company records according to their assigned permissions, while administrator-only controls protect billing changes, company settings, team management, Email Ingestion, and ERP mappings. Authorized internal support/administrative access is separately controlled and audit logged. A shared workspace is not a private invoice folder for each teammate.
• Security safeguards: safeguards include password hashing, encrypted HTTPS transport in production, access controls, rate limiting, request validation, security logging, tenant scoping, backups, and ongoing vulnerability and dependency review. No Internet-connected system can be guaranteed to be completely secure.
• Other lawful disclosures: information may be disclosed where required by applicable law or a valid legal process, or where law permits disclosure reasonably necessary to address fraud, security incidents, or a threat to someone’s safety. Linehaul limits disclosure to the relevant purpose and information.

6. Retention

Retention depends on the record and its purpose. Active structured invoice records and review/dispute/recovery history support the workspace until removed through applicable lifecycle controls. Temporary upload staging, archived invoices, generated exports, background-job metadata, audit submissions, email/support correspondence, security records, payment records, and backups have separate retention needs and cleanup processes. A source-PDF deletion period is not a deletion period for every related record.

Linehaul retains information only as reasonably needed for the stated service purpose, security, contractual or legal obligations, or a relevant dispute or hold. When that purpose ends, the information is deleted, de-identified, or otherwise securely disposed of. Provider copies and customer-downloaded exports are subject to their own controls; deleting a Linehaul invoice does not recall an export or an email already delivered. Contact the Privacy Officer for retention details relevant to your workspace or a proposed document submission.

7. Privacy Requests

Subject to applicable law, contractual obligations, identity verification, and legitimate retention requirements, you may contact us to request access to or correction of personal information associated with your account, or to request account/data deletion. Workspace administrators can manage teammate access and may also use available in-product export, archive, restore, and deletion tools. Removing a teammate ends that user’s workspace access. Company invoices, settings, and other shared business records remain workspace data subject to the applicable retention and deletion controls.

The workspace owner can also submit a deletion request from Team & Access. That request starts a controlled review; it does not instantly purge the workspace. Linehaul verifies authority and reviews billing, applicable holds, retention obligations, and recovery safeguards before scheduling permanent deletion. An active subscription is handled separately; deletion requests do not by themselves cancel renewal or waive applicable privacy rights. Any required retained records are limited to their relevant purpose, while backup, security, transaction, or legally required records may remain for their applicable retention period.

Requests can also be sent to [email protected]. We may ask for information needed to verify the requester and the workspace involved before acting on a request.

Where consent is the basis for processing, you may ask to withdraw it, subject to applicable legal or contractual restrictions. This can affect the features Linehaul can provide. We explain relevant restrictions or a refusal where permitted and respond within applicable legal time limits. An individual privacy request is distinct from authority to delete an entire organization’s records. You may also raise a complaint with the privacy regulator responsible for your jurisdiction.

8. Age & Business Use

Linehaul is a business freight and accounts-payable service and is not directed to children. Account creation and workspace-claim flows require acceptance of Terms that restrict use to people who meet the applicable age requirement and are authorized to use the Service for the relevant organization. Linehaul does not collect date of birth as part of ordinary registration. If you believe personal information was submitted by someone who was not eligible to use the Service, contact the Privacy Officer so the situation can be reviewed and appropriate action taken.

9. Canadian Privacy Principles

Where Canadian private-sector privacy law applies, Linehaul's privacy program is intended to follow applicable requirements concerning accountability, identified purposes, limiting collection, appropriate use/disclosure/retention, safeguards, openness, access, and complaint handling. Applicable privacy rights and obligations can vary by jurisdiction and context.

10. Policy Changes & Security Incidents

The revision date identifies this policy version. Material changes to how personal information is used or shared will receive appropriate notice and any fresh consent required by applicable law. Updating this policy does not change a user’s historical acceptance record. When a change materially affects how personal information is used or shared, Linehaul will ask signed-in users to review the changed policy and accept it before continuing, and records the version accepted and when. Linehaul investigates suspected security incidents and provides customer, individual, or regulator notifications where required by applicable law. Contact the Privacy Officer promptly if you suspect unauthorized access or disclosure.

11. Contact

For privacy, security, data-handling questions, or privacy complaints, contact the Linehaul Privacy Officer at [email protected]. Privacy complaints will be reviewed and escalated as appropriate under applicable law.