Privacy Policy

Data Controller

FreightUtils (www.freightutils.com) is operated by Marius Cristoiu, a sole trader based in the United Kingdom. For privacy enquiries, contact contact@freightutils.com.

What Data We Collect

FreightUtils is designed to minimise data collection. Most of the site — calculators, lookups, reference pages, and the unauthenticated portion of the public REST API — can be used without giving us anything beyond what every web request carries: your IP address, your browser's user agent and the address you request, including any URL parameters such as a search term or a calculator input. Our hosting provider records these in its request logs (see Retention). We also use your IP address for rate limiting and abuse prevention, holding it in a rate-limit counter for up to 48 hours (see IP address below).

When you choose to do more, we collect:

• Email address — if you create an account or sign up for a free API key (on /pricing, /api-docs or by signing in), or if you upgrade to Pro. Used to deliver the key, the sign-in and password-reset emails, two follow-up emails when you sign up for a free key on /pricing or /api-docs (tips after two days, a note from the founder after five), and (for Pro) billing-related notifications. We are notified by email of each new sign-up, with its address. Your address is also added to the contact list we keep at Resend — the list the newsletter uses (below); ask us and we remove it.
• API key + plan tier + signup timestamp — stored against your email so you can manage your account.
• Password (optional) — if you choose password sign-in, we store only a salted argon2id hash of your password, never the password itself. It cannot be reversed, and it is never returned by any API or shown to anyone, including us. A new password is checked against known breached passwords without the password leaving our servers: only the first five characters of its SHA-1 hash go to the Pwned Passwords service run by Have I Been Pwned, which sends back every breached hash that starts with them for us to compare here (if it cannot be reached, we compare against a list of breached passwords held on our own servers). Magic-link and OAuth sign-in never involve a password at all.
• OAuth sign-in (optional) — if you sign in with Google, Microsoft, or GitHub, we ask the provider only for your email address (Microsoft's sign-in also takes its basic profile scope) and keep only a verified address, which we use to match or create your account. We never receive your provider password, we do not read or store your contacts, repositories or any other provider data, and we do not post or act on your behalf.
• Per-key request counts (daily and monthly) — aggregated counters to enforce rate limits. Our own audit log of API and MCP calls records the route or tool, the outcome and timing, whether an API key was sent, the type of client (from its user agent) and the country and region — never a request body, an API key, an IP address or an email. Separately, our hosting provider's request logs keep each request's path with its URL parameters, and its IP address, for 30 days (see Retention), so an API key put in the URL (?apiKey=) is recorded there. Send your key in the X-API-Key header instead.
• Per-key, per-endpoint call counts — daily counters of how many calls each API key makes to each endpoint, retained for 90 days and used for quota and service monitoring. The counter holds only the key, a coarse endpoint name, and the date — no request content, no IPs, no emails.
• Payment metadata — if you upgrade to Pro, Stripe processes your payment. We never see or store your card details. We retain only the Stripe customer and subscription IDs and the subscription status, linked to your email.
• IP address — used by our edge for abuse prevention and for rate limiting on the anonymous tiers. It is held as it is (not hashed) in a rate-limit counter that expires after 48 hours, and it appears in the request logs, which are kept as set out under Retention; error reports sent to Sentry have it removed. It is not linked to an account and is not used for anything else.
• MCP server and calls through Claude — tool calls to our MCP server (https://www.freightutils.com/api/mcp) are handled like API requests: the tool's inputs (dimensions, codes, quantities, a goods description, coordinates) travel in the request body, are used to compute the answer and are not stored or logged. Our audit log records the tool name, the outcome, the timing, whether an API key was sent, the type of client and the country and region the call came from — never the inputs, an IP address, a key value or an email. Calls made through Claude (claude.ai, the Claude desktop and mobile apps, Cowork) reach us from Anthropic's infrastructure, so the IP address we see and rate-limit on is Anthropic's, not yours; those calls, when they carry no API key, share one daily allowance. We receive no Claude account details, name, email or conversation content — only the tool call itself. How Anthropic handles your conversations is set out in Anthropic's own privacy policy.
• Newsletter and the ADR quick reference guide (optional) — if you subscribe on a tool page or ask for the guide, your email address is added to the contact list we keep at Resend (the one account holders' addresses join, above) and, for the guide, we email you the download link. The list is for the newsletter the form describes; you can withdraw at any time by asking us to remove you.
• Feedback (optional) — if you send feedback with the button on every page, your message, the page you were on and, if you give one, your email address are emailed to us through Resend and arrive in our mailbox (see Cloudflare below); we use them to reply and to fix the site. A draft you have not sent stays in your browser.
• Documents you upload to the DG document check (signed-in accounts only) — processed transiently: the image or PDF is sent to our document-extraction sub-processor (Anthropic, below), the dangerous-goods line values are returned to you as an editable draft, and the file is discarded. We never write the document to storage, logs or error reports, and we keep no thumbnail. The extraction is field-scoped: the schema has no fields for shipper, consignee, addresses, signatures, phone numbers, air-waybill or reference numbers, and anything of that kind the extractor volunteers is dropped before it reaches you. In plain words: we read the dangerous-goods lines, never the parties. We retain only a per-account daily count of documents checked (no content), for the free-tier limit.

Calculator inputs (dimensions, weights, UN numbers, HS codes, etc.) are used only to compute the result — in your browser or on our server — and are never stored with an account. Inputs sent as URL parameters (a GET request, a search page) are part of the request address, so they appear in the request logs beside your IP address for 30 days; inputs sent in a request body (POST, and every MCP tool call) do not.

Sub-processors

We rely on the following sub-processors to operate the service. Each is a UK GDPR Article 28 processor; none of them receive data for purposes beyond delivering their function to FreightUtils.

A more formal data-processing agreement is available at /dpa.

Retention

• User accounts and API keys: retained while your account is active. Deleted within 30 days of account closure on request.
• Daily / monthly request counters: 48 hours (daily) and 32 days (monthly). The daily counter for anonymous use is keyed on the IP address.
• API and MCP tool inputs: used to compute the response and not stored by us. Inputs sent as URL parameters (GET requests) are part of the request address, which the request logs keep for 30 days; inputs in a request body (POST, and every MCP tool call) are not logged.
• Follow-up emails (the two after a free key): the schedule is held for 10 days, and a record of each email sent for 30 days.
• Contact list (Resend): until you ask us to remove your address.
• Magic-link and password-reset tokens: 30 minutes — one-time use. A password chosen at sign-up waits, hashed, for the same 30 minutes until the email address is confirmed.
• Sessions: up to 30 days from your last activity (renewed while you use the site), never more than 90 days from sign-in; signing out ends a session immediately.
• Payment records (held by Stripe): per Stripe's retention policy — typically 7 years for tax/regulatory reasons.
• Documents uploaded to the DG document check: held in memory by FreightUtils for the duration of the request and then discarded — we keep no copy, thumbnail or log of the document. Our extraction sub-processor (Anthropic) retains API inputs and outputs under its commercial API terms — at the time of writing, deleted from its systems within 30 days of receipt unless flagged for a usage-policy review — and does not use them to train models. The only trace FreightUtils keeps is a per-account count of documents read that day (48-hour expiry) and the per-key, per-endpoint call counters described above.
• Request logs (Vercel runtime logs — each request's path with any URL parameters, its IP address and user agent, and our audit log of API and MCP calls): 30 days. Our own log lines record an email address only as a one-way hash; lines written up to 6 October 2026 by sign-up, newsletter and Pro billing events held the address itself, and the last of them are deleted by 5 November 2026.
• Error reports (Sentry): 30 days.

Lawful Basis

Under UK GDPR Article 6 we rely on:

• Performance of a contract (Article 6(1)(b)) — your account and API key, signing in (magic links, passwords, OAuth and sessions), billing for Pro, and the emails that deliver them.
• Legitimate interests (Article 6(1)(f)) — keeping the service available, secure and working: rate limiting and abuse prevention, the request and error logs, our audit log of API and MCP calls, the breached-password check, our notice of each new sign-up, and the two follow-up emails that help a new key holder get started.
• Legal obligation (Article 6(1)(c)) — payment records kept for tax.
• Consent (Article 6(1)(a)) — the newsletter and the ADR quick reference guide, when you subscribe; you can withdraw it at any time.

International Transfers

FreightUtils is run from the United Kingdom. The providers below process personal data outside the UK, each under a safeguard UK law recognises: the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework), or the EU Standard Contractual Clauses with the UK Addendum issued by the Information Commissioner. Transfers to the European Economic Area rely on the UK's adequacy regulations.

• Vercel (Vercel Inc., USA) — certified to the UK–US data bridge; its data processing addendum also incorporates the Standard Contractual Clauses with the UK Addendum.
• Upstash (Upstash, Inc., USA) — the UK–US data bridge, with the Standard Contractual Clauses and the UK Addendum where that does not cover a transfer.
• Cloudflare (Cloudflare, Inc., USA) — the UK–US data bridge, with the Standard Contractual Clauses and the UK Addendum as the fallback.
• Stripe (Stripe Payments Europe, Limited, Ireland; data is transferred to Stripe, LLC, USA) — the UK–US data bridge for Stripe, LLC, otherwise the Standard Contractual Clauses with the UK Addendum.
• Resend (Plus Five Five, Inc., USA, where it stores all data) — the Standard Contractual Clauses with the UK Addendum; it is also certified to the UK–US data bridge.
• Sentry (Functional Software, Inc., USA) — our error reports are stored in its EU region, in Frankfurt, Germany; for what Sentry stores or reads in the USA, the UK–US data bridge, with the Standard Contractual Clauses and the UK Addendum as the fallback.
• Anthropic (Anthropic Ireland, Limited; data stored in the USA) — document extraction for the DG document check; its data processing addendum incorporates the UK Addendum to the Standard Contractual Clauses to the extent UK law requires.
• Google (Google LLC, USA) — our Gmail mailbox, where email sent to an @freightutils.com address arrives; certified to the UK–US data bridge.

UptimeRobot receives none of your data, and the breached-password check sends only the first five characters of a password's hash, which reveal neither the password nor who you are. Our data processing agreement for Pro customers is at /dpa.

Your Rights Under UK GDPR

You have the right to:

• Access the personal data we hold about you (Article 15)
• Request correction of inaccurate data (Article 16)
• Request erasure of your data (Article 17 — “right to be forgotten”)
• Restrict how we use your data (Article 18)
• Request a portable copy of your data (Article 20)
• Object to processing we base on legitimate interests (Article 21)
• Withdraw your consent to the newsletter at any time (Article 7(3))

To exercise any of these rights, email contact@freightutils.com from the address linked to your account. We respond within 30 days, usually within 2 business days.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the UK's Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/.

Cookies

FreightUtils uses cookies sparingly and only where strictly necessary:

• Authentication session cookie — set only when you sign in to your dashboard. HttpOnly, Secure, SameSite=Lax. Sessions last up to 30 days of activity (renewed while you use the site) with a hard 90-day cap from sign-in; signing out ends the session immediately. PECR-exempt as “strictly necessary for a service explicitly requested by the user”. A short-lived (10-minute) state cookie is set during an OAuth sign-in for CSRF protection.

We do not use first-party analytics cookies. Vercel Web Analytics (anonymous page-view statistics) is cookieless. We do not use Google Analytics, advertising pixels, or any cross-site tracking. There is no cookie consent banner because there is nothing requiring consent under PECR.

Your theme preference (light/dark mode), whether you dismissed the announcement bar or subscribed to the newsletter, and a feedback draft you have not sent are kept in your browser's localStorage. None of it is sent to us — the feedback only when you send it.

Children's Privacy

FreightUtils is a professional reference tool for the freight and logistics industry. We do not knowingly collect information from anyone under 16.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Material changes affecting Pro subscribers will be notified by email at least 30 days before they take effect.

Contact

For privacy enquiries, data subject access requests, or to flag a concern: contact@freightutils.com.