Privacy Policy

Last updated: 28 September 2026

This Privacy Policy explains how Carlifty ("Carlifty", "we", "us") collects, uses and protects personal data when you visit carlifty.com, create an account or use the Carlifty platform (the "Service"). It also explains how we handle personal data contained in load offers that transport companies send to us.

We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable national data protection laws.

1. Who is responsible for your data

The controller of your personal data is the operator of Carlifty. Carlifty is currently in a free beta stage and is not yet operated by a registered legal entity. When a legal entity is registered, this policy will be updated with its full details and you will be informed in advance (see section 13).

For any privacy-related question or request, contact us at support@carlifty.com.

2. Who the Service is for

Carlifty is a business-to-business service for vehicle transport carriers and dispatchers. The Service is intended only for people aged 18 or older acting in a professional capacity. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

3. Data we collect when you use the Service

3.1 Account data

When you sign up and use your account, we process:

• your name and email address;
• your password, stored only in hashed form (we never store or see your password in plain text);
• whether your email address has been verified;
• your organization membership and role within the Service;
• your trial period dates;
• content you create in the platform, such as loads you save.

Purpose: to create and manage your account, verify your email address, let you sign in, reset your password and provide the Service. Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR).

3.2 Session and security data

When you sign in, we create a session that stores your IP address, browser user agent and the session's creation and expiry times.

Purpose: to keep you signed in, protect your account and prevent abuse. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the Service secure (Art. 6(1)(f) GDPR).

3.3 Searches and locations you enter

When you search for loads, the places you type and the routes you plan are sent to our mapping providers to suggest addresses and calculate routes. We do not send your name or email address with these requests.

Purpose: to provide load search, address autocomplete and route calculation. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.4 Emails we send you

We send you transactional emails, such as email verification and password reset messages, and notices about material changes to this policy.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.5 Contacting us

If you email us, we process your email address, name and the content of your message to answer you.

Legal basis: our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR), or performance of a contract where your message concerns your account.

3.6 Technical error logs

Our servers record technical error logs to detect and fix problems. These logs do not record IP addresses, but may contain an internal account identifier where an error relates to a specific account.

Legal basis: our legitimate interest in operating a reliable and secure Service (Art. 6(1)(f) GDPR).

3.7 Visiting our website

Pages that show a map load map tiles from OpenFreeMap. To deliver these tiles, OpenFreeMap receives your IP address and standard browser information. Fonts and scripts are served from our own servers.

Legal basis: our legitimate interest in displaying maps as part of the Service (Art. 6(1)(f) GDPR).

3.8 Product analytics

To understand how the Service is used and improve it, our servers record usage events and send them to PostHog: the platform pages you open, the load search filters you use (place names, radii and ranges, without coordinates), when you open the contact details of a load offer, and when you sign up and verify your email address. Events are linked to an internal account identifier and your selected language, never to your name or email address. They are recorded by our servers only, no analytics cookies or scripts run in your browser.

Legal basis: our legitimate interest in understanding and improving the Service (Art. 6(1)(f) GDPR). You can object at any time (see section 9).

We do not use advertising or tracking tools.

4. Data about people in load offers

This section is for people who work at transport, logistics or brokerage companies and whose details appear in load offers we receive. We did not collect this data from you directly, so we are informing you under Art. 14 GDPR.

4.1 Where the data comes from

Transport companies, brokers and dispatchers send load offers by email to loads@carlifty.com. We collect the load offers from those emails.

4.2 What data we process

• the sender, recipient and copy (CC/BCC) email addresses, subject and date of the email;
• the full content of the email;
• business contact details found in the email: company name, company email address and address, and the names, phone numbers and email addresses of contact persons.

4.3 Why we process it and on what basis

We process this data to extract load offers (pick-up and delivery locations, number of vehicles, prices and routes) and to show these offers, together with the contact details needed to arrange the transport, to registered users of the Service.

Legal basis: our legitimate interest, and the legitimate interest of carriers using the Service, in making commercial load offers that were distributed for business purposes easier to find and act on (Art. 6(1)(f) GDPR). We only use business contact details in a professional context. You have the right to object at any time (see section 4.5).

4.4 Who sees it and how long we keep it

• The load offers and contact details are shown to registered, signed-in users of the Service. They are not published to the public.
• The email content is processed by OpenAI to extract load and contact details automatically (see section 6). No decisions with legal or similarly significant effects are made about you by this processing.
• Emails and extracted contact details are anonymised 12 months after we receive the email. After that, only non-personal data (such as routes, distances and prices) is kept, for statistics.

4.5 Your right to object

You can object to this processing or ask us to delete your details at any time by emailing support@carlifty.com from the email address concerned, or telling us which company and contact details are affected. We will delete or anonymise your data within one month, unless we have compelling legitimate grounds that override your interests.

5. Cookies

We only use cookies that are necessary for the Service to work or that remember choices you make. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent.

In production, the session cookie name may be prefixed with __Secure-.

6. Who we share data with

We do not sell personal data. We share personal data only with service providers (processors) that help us run the Service, under agreements that require them to protect it and use it only on our instructions:

We may also disclose personal data where required by law, or to establish, exercise or defend legal claims.

7. International data transfers

Some of our providers are located outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we make sure it is protected by:

• an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified US companies and the adequacy decision for the United Kingdom; or
• Standard Contractual Clauses approved by the European Commission.

You can request more information about these safeguards by contacting us.

8. How long we keep data

We may keep data longer where we are required to by law, or where it is needed to establish, exercise or defend legal claims.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• rectify inaccurate or incomplete data (you can change your name and password in your account settings);
• erase your data ("right to be forgotten");
• restrict our processing of your data;
• data portability, meaning to receive data you provided to us in a structured, machine-readable format;
• object to processing based on our legitimate interests;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where you believe an infringement took place.

To exercise any of these rights, email support@carlifty.com. We will respond within one month. We may ask you to confirm your identity before acting on a request.

10. Deleting your account

To delete your account, email support@carlifty.com from the email address linked to your account. We will delete your account and associated data within one month.

11. Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, access restricted to what is necessary and hosting in the EU. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach where required by law.

12. Is providing data required

Providing your name, email address and a password is necessary to create an account. Without them, we cannot provide the Service to you.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed.

For material changes, such as a change of controller, new purposes of processing or new categories of data, we will email registered users at least 14 days before the changes take effect.

14. Contact

For any questions about this policy or your personal data, contact us at support@carlifty.com.