Privacy Policy

Account and profile information. When you create an account we collect your name, email address, and password (stored in hashed form by our authentication provider). If you sign in with Google, we receive the name, email address, and profile photo Google shares with us for that purpose.

Business and shipment data you provide. Facility and customer/consignee records, hazmat product catalog entries, shipment and manifest details, declarant sign-off information, and any safety data sheets (SDS) or other files you upload. This data is entered by your organization to build compliant shipments and is used to generate shipping papers, barcode labels, and carrier pickup manifests.

AI assistant interactions. If you use the in-app compliance assistant, the messages you send and the assistant's responses are processed to generate answers about hazmat regulations and the rules HazDox enforces. See "How we share information" below for how this data is routed to our AI provider.

Third-party app connections. HazDox lets you authorize external AI applications to connect to your account (via OAuth). If you approve such a connection, the connected app can access the account data and actions you approve, and we log the authorization decision and connected-app activity.

Technical and usage data. We and our infrastructure providers automatically collect information such as IP address, browser and device type, and request logs, used for security, troubleshooting, and keeping the Service running reliably. HazDox does not use third-party advertising or analytics trackers; the only browser storage used for this purpose is local storage needed to keep you signed in.

• Provide, maintain, and secure the Service, including authenticating your sign-ins.
• Generate shipping papers, barcode labels, carrier pickup manifests, and SDS libraries you request.
• Run compliance checks such as per-mode packaging limits, hazard segregation, and air Q-value validation.
• Power the in-app compliance assistant's answers to your questions.
• Send account-related emails, such as sign-up confirmation and authentication messages.
• Diagnose problems, prevent abuse, and improve the Service's reliability and features.
• Comply with legal obligations, including hazmat shipping recordkeeping requirements.

We do not sell your information. We share it only as follows:

• Service providers. Supabase (authentication, database, and file storage), Google (if you choose Google sign-in), and Lovable (application hosting, build, and asset delivery for the Service).
• AI providers. When you use the compliance assistant, your messages are routed through an AI gateway to an underlying AI model provider (currently OpenAI) solely to generate a response to you.
• Apps you authorize. Third-party AI applications you explicitly connect to your account, limited to the access you approve at the time of connection. You can review and revoke these connections at any time from your account settings.
• Legal and safety reasons. If required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of HazDox, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to the confidentiality of your information.

We retain account and shipment data for as long as your account is active or as needed to provide the Service. Shipment and shipping-paper records may be retained for longer periods to meet recordkeeping requirements under applicable hazardous materials transportation regulations (for example, 49 CFR generally requires shippers to retain copies of shipping papers for a minimum retention period). When data is no longer needed for these purposes, we take reasonable steps to delete or anonymize it.

We use industry-standard safeguards to protect your information, including encryption of data in transit (HTTPS), access controls on our database and storage, and authentication through a dedicated identity provider. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

• You can review and update your account information from within the Service.
• You can request access to, correction of, or deletion of your personal information, or an export of your data, by contacting us using the details below.
• You can disconnect Google sign-in or revoke HazDox's access from your Google account settings.
• You can review and revoke any third-party AI application connections from your HazDox account settings at any time.

Depending on where you live, you may have additional rights under laws such as the GDPR or state privacy laws (e.g., the CCPA). Contact us and we will respond consistent with applicable law.

HazDox is a business tool intended for use by facility and shipping personnel and is not directed to children. We do not knowingly collect personal information from children.

Our service providers may process and store information in the United States or other countries in which they operate. By using the Service, you understand that your information may be transferred to and processed in locations outside your own.

We may update this policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by email.

Questions about this policy or your information? Contact ShipMate support:

shipmate@shipmate.com
+1 (310) 370-3600