Privacy policy

The company that signs up decides what happens to the data in its own mailbox and its own records. We handle that data for it and for nothing of our own.

Carriers and clients never signed up with us. Their names, addresses and messages are in the application because our customer's mailbox and records hold them. If you are a carrier or a client, the company that wrote to you is the one to ask; we will help it answer.

If you connect a mailbox, the application signs in to it every few minutes and looks at the inbox. For each message it reads the sender, the subject, the date and the two headers that say what the message replies to. That is how a carrier's answer is told apart from the rest of your mail.

Only two kinds of message are kept. One: a message that answers a request the application sent, recognised by our own message identifier in its headers. Two: a message from a carrier this company asked within the last 14 days that carries no such headers — it is set aside for a person to look at, is never read for a price, and never becomes a carrier quotation by itself.

For those two kinds the whole message is kept: its bytes exactly as they arrived, its text, and a record of its attachments.

Every other message is dropped. Nothing about it is written to the database — not the sender, not the subject, not even a count of it against your account. What we will not claim is that it was never looked at: to decide, its envelope passes through our server's memory, and a message that looked like a reply is downloaded whole before being thrown away.

Nothing in your mailbox is deleted, moved, marked or changed. The one thing written there is a copy of an email the application has just sent for you, filed in your Sent folder so your own mail programme shows what went out. No folder is created, and no message that we did not send is ever filed.

There is an older way of receiving carrier replies, at addresses on pricepool.eu. A message arriving there that matches no request is stored, belongs to no customer, and can be seen only by us as the operator. It is the one case where email sits with us rather than with the company it was meant for.

When a dispatcher pastes a client's email to create a shipment, that email is kept whole and unchanged, for as long as the account exists. It is what the shipment was read from and the evidence if a price is later disputed. It usually carries the client's name, address and contact details, and that client never signed up with us.

Two things are read by a machine: a carrier's reply, and the client email a dispatcher pastes. They are sent to Anthropic's API and read by the model claude-opus-5. What is sent is the carrier's own words with the quoted thread stripped away, or the pasted email as it stands. Attachments are never sent. A message the application did not keep is never sent.

Anthropic does not use what is sent through its API to train its models. It keeps what is sent for a limited period under its commercial terms, to run the service and to look for misuse. We have not signed a zero-retention agreement with Anthropic.

Nothing the machine reads acts on its own. Every value it proposes is shown to a dispatcher beside the exact words it was read from, and counts for nothing until a person confirms it.

The application runs on Vercel, and the code that handles your data runs in Washington, D.C., in the United States. The database is with Supabase, on servers in Europe. Data therefore travels between the two on every request and leaves the European Union in ordinary use. This is written plainly because "your data stays in Europe" would not be true.

A mailbox password you type is encrypted on our server before it is stored, with a key that is not in the database, and the stored value is out of reach of the interface your browser talks to. It is never sent back to your browser and never written to a log.

What we will not pretend: whoever holds the application's production settings — that is us — holds both the key and the means to read the stored value. Treat it as a password we could read, and do not reuse it anywhere else.

The server keeps short operational records: which company, which account, how long something took, what kind of failure happened. They hold no message bodies and no words quoted out of a client's email.

When a mail server refuses us, its own wording is kept in that log and never shown in the application, because such wording can describe somebody else's network.

Nothing is deleted by itself. There is no retention period in the application: stored messages, their raw bytes and every email it has sent stay for as long as the account does.

There is no button that deletes a company, exports its data, or erases a single message. On a written request from the company whose data it is, we delete it by hand within 30 days and confirm when it is done.

Deleting a carrier or a shipment inside the application removes that record and what hangs from it. It does not remove mail that has already arrived or email that has already been sent.

If you are our customer, what the application holds for you is on your own screens, and you can ask us for anything beyond them. If you are a carrier or a client, ask the company that wrote to you; we will help it answer. Either way, write to contact@pricepool.eu.

When this policy changes in a way that matters, its version changes and the companies using the application are told. The version each company accepted is recorded against that company.