CARGOLAB
Privacy policy
This policy explains which personal data CargoLab processes, why it is used and the rights available to you.
Updated: October 23, 2026
1. Controller
Ömer KarakusSaint-Julien-Straße 95020 SalzburgAustriaoffice@cargolab.org2. Website and technical data
A visit involves processing connection data required for delivery, including IP address, time, requested address, browser and device information and technical error details. CargoLab is provided through OpenAI Sites using Cloudflare infrastructure. Cloudflare is involved through that hosting infrastructure.
The purposes are website delivery, security, troubleshooting and availability. Processing relies on Article 6(1)(f) GDPR; our legitimate interest is a secure, working service. Technical data is retained for operational and security purposes and necessary evidence; general retention criteria appear in section 10.
3. Calculators, documents and browser storage
Packing, volume and weight calculations and drafts not saved to an account are generally processed in your browser. The online functions described below transmit the data needed for those functions. Local templates, items, scenarios and preferences may remain in browser storage when you use the relevant save features. Remove them through those features or by deleting website data.
PDF and photo text recognition using PDF.js and Tesseract runs locally in your browser. Program and language files load from this website; document files are not uploaded to an OCR service for this recognition. Exports are created as downloads or browser printouts when selected. You decide where to keep or share those files.
Processing provides the tools you request under Article 6(1)(b) GDPR. Technically necessary device access for expressly requested functions falls under section 165(3) of the Austrian Telecommunications Act 2021. Language, authentication sessions and privacy choices may also be stored in your browser; separate Analytics consent is described below.
4. My CargoLab and sign-in
Supabase provides account authentication and persistent storage. The account database is in eu-west-1 (Ireland). Data includes email address, account ID, authentication and session information, profile details and the projects, calculations, items, templates and preferences you save. These may include customer, supplier or order details you enter. Only enter information needed for your planning that you are entitled to process.
You can sign in using email and the offered authentication methods or Google. Google passes the account information you authorize to the authentication service; a Google profile photo may appear in the account menu. Loading that image sends technical connection data to Google independently of Analytics consent. The current account interface requires email, first name, last name, city and country. Names and initials identify your account; city and country serve private profile management, not location tracking or advertising. Authentication and requested account functions rely on Article 6(1)(b) GDPR. Public tools, imports, calculations and 2D/3D views work without an account.
Date of birth is optional and stored only to complete your private profile at your request. It is not used for age verification, advertising or analytics. The basis is your consent under Article 6(1)(a) GDPR when voluntarily saving this detail. Leave it blank or withdraw by removing it and saving again; your account remains available.
The session is stored locally in your browser and removed locally after 30 days without activity. Signing out ends the local session but keeps saved account content. Items and projects can be deleted individually. Profile settings allow profile and password changes and account deletion after signing in within the preceding 15 minutes and explicitly confirming. Share links are removed first, then sessions are revoked and the account, profile and associated records deleted. If the later step fails, links may already be removed. Account data in this browser is then removed where possible; copies on other devices and downloads already distributed must be removed separately. You may also request deletion using the contact above.
5. Address searches and routes
When you start an address search or route calculation, CargoLab sends search addresses or coordinates, origin, destination, intermediate stops and necessary vehicle parameters server-side to HERE. This provides the geocoding or routing you request under Article 6(1)(b) GDPR. This function is not solely a local calculation.
A CargoLab result cache is valid for five minutes. That technical validity does not describe HERE’s retention or hosting logs. Prefer business addresses and avoid sending additional personal information.
7. Issue reports and suggestions
Submitting a report sends your text, selected language, tool and submission time, plus any optional contact address and screenshots. Calculator inputs are not attached automatically. Text is stored in a private Cloudflare D1 database and images in private Cloudflare R2 storage within the Sites infrastructure. Reports are not public.
The purposes are troubleshooting, follow-up questions and improving CargoLab under Article 6(1)(f) GDPR and our legitimate interest in those activities. Remove confidential details from images. Reports and screenshots become due for deletion 90 days after receipt and are removed through regular automatic cleanup; failed deletions are retried. For earlier deletion, contact the controller above with your report reference.
A text copy of your report, including any optional contact address, is also sent through Resend to the CargoLab mailbox for notification. Screenshots are not sent by email. Automatic 90-day cleanup covers stored reports and screenshots; mailbox copies are deleted separately.
8. Google Analytics and consent
Google Analytics 4 loads on public overview and tool pages only after your voluntary consent (measurement ID G-G1GTMMN67B). It measures website use to improve the service. Without consent, measurement stays off and the tools remain available. The bases are Article 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021.
Google receives page views, referring website, browser/device details, cookie identifiers and IP address. Google states that IP addresses are processed to derive location but are not stored in Analytics. CargoLab sends static page paths and titles without URL queries or fragments. Calculator inputs, documents, profiles and account contents are not sent as measurement data. Google Signals and advertising personalization are disabled; no advertising providers are integrated.
Your privacy choice is stored locally for 180 days; Analytics cookies are configured for 180 days. User and event data retention is 14 months with resetting on new activity disabled. Standard aggregate traffic reports are not affected by that setting.
Use “Privacy settings” on public overview or tool pages to change or withdraw consent at any time. Withdrawal applies to the future. On rejection, measurement is disabled and CargoLab attempts to remove its first-party Analytics cookies. Google may process data in the United States; international transfers are addressed in section 10.
For five calculators, after consent we record once per page visit whether you edit a calculation field. Only the fixed tool identifier and event type, a known AI referral category and a predefined campaign identifier are recorded. Input values, document contents and arbitrary URL parameters are not sent. An edit does not mean that a calculation was completed.
9. Email contact
When you email the address above, we process your address, message and any attachments to handle your enquiry. Email is operated through easyname. Article 6(1)(b) GDPR applies to service-related requests; otherwise processing relies on Article 6(1)(f) GDPR and our legitimate interest in answering enquiries.
Correspondence is generally deleted six months after the enquiry is closed. Legal retention obligations or establishing, exercising or defending legal claims may require longer storage limited to that purpose.
10. Recipients, transfers and retention
Recipients are the providers needed for each feature: OpenAI Sites with Cloudflare for the website and reports, Supabase for authentication and account data, easyname for email, HERE for address or route requests, and Google when you select Google sign-in or consent to Analytics. Depending on the service, providers act as processors with subprocessors or as controllers for their own purposes.
The Ireland database region does not mean all processing takes place in the EU; providers may process data outside the EEA, including in the United States. OpenAI’s published Sites data-processing terms identify OpenAI Ireland for EEA customers and provide for applicable adequacy decisions or standard contractual clauses for onward transfers (Articles 45 and 46 GDPR). Supabase’s data-processing addendum incorporates standard contractual clauses. Google describes the EU–US Data Privacy Framework for eligible transfers and standard contractual clauses. The linked notices explain the respective providers’ recipients, international processing and safeguards; you can request further information from the controller.
Where no fixed period is specified above, retention depends on the necessary functional, security and evidential purpose, legal obligations and legal claims. Deleted active account data may remain in restricted backups until rotation under the relevant service’s retention cycles.
SmartAI processes submitted questions, voluntarily attached images and the current calculator context. Geometric checks are performed by the CargoLab server. When free AI chat is activated, questions, attached images, a bounded conversation history and required calculation data are sent to the OpenAI API; linked shipment identities and account metadata are excluded. Images are resized and re-encoded in your browser without their original file metadata. They are not retained on the CargoLab server or in session storage and are unavailable after reload. CargoLab requests no API response storage. A bounded conversation history is kept in this browser tab’s session storage and can be cleared in the chat. After 30 minutes without an update, the saved session is discarded when the page is loaded again. Request limits retain temporary counters and hashed IP values, not conversation contents. Do not enter confidential documents or personal information in questions.
11. Your rights
Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation. Consent may be withdrawn at any time for the future without affecting earlier lawful processing. Address requests to the controller.
You may complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred; in Austria, the Austrian Data Protection Authority. CargoLab does not make automated decisions about you with legal or similarly significant effects. Packing and routing calculations support your planning and are not such decisions.