Privacy Policy

Last updated September 10, 2026

HALZAT is freight software for carriers and brokers. This policy explains what we collect, what we do with it, and what we will never do with it. The section on Google account data is the one most people are looking for, so it comes first.

1. Google account data

HALZAT can connect to a Gmail or Google Workspace mailbox that you choose to link. Connecting is optional. The product works without it, and you can disconnect at any time.

What we request, and why

Google permission	What it lets us do	Why HALZAT needs it
`gmail.readonly`	Read messages and attachments in the connected mailbox	To find freight quote requests, rate sheets and booking emails, and turn them into quotes and shipments automatically instead of you retyping them
`gmail.send`	Send a message from the connected mailbox	To send quotes, replies, invoices, statements, bills of lading and proofs of delivery from your own address, through actions you take and email workflows enabled for your workspace
`userinfo.email`	See the email address of the account you connected	To label the connection in your settings, and to make sure a message is sent from the mailbox you actually linked

We do not request permission to delete mail, change your Google account, or read any other Google service. We do not read mailboxes that have not been explicitly connected by the account holder.

The connection permits background scanning of recent messages that match the scan settings. HALZAT reads message text and supported attachments to determine whether they contain freight work; this processing can include messages later classified as unrelated. Email workflows can also send automatically, for example forwarding an uploaded proof of delivery when that workflow is enabled. Not every automated send has a separate confirmation screen.

Limited Use

HALZAT’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, and specifically for data we obtain from your Google account:

We do not sell it. Not to data brokers, not to advertisers, not to anyone.
We do not use it for advertising. No ad targeting, no ad measurement, no audience building.
We do not use it to train generalized AI or machine learning models. We use AI inference to classify messages, extract freight details and prepare outputs for your workspace. Processing may be retried or rerun when you correct a record. We do not authorize our model providers to train generalized models on Google account data.
Humans do not read it except in the narrow cases Google permits: with your explicit prior consent for a specific support request, where required by law, or where strictly necessary for a security investigation. Any such access is logged.

Who else touches it

AI-assisted mailbox processing sends message content to the model service configured for the feature, so Google account data leaves our servers. The services available for this processing are listed below; a message is not automatically sent to every model provider in the list.

Sub-processor	Role	What it can see
OpenAI	Language model that extracts freight details from a message	Message text, supported attachments and relevant workspace context submitted for classification, extraction or drafting through the API.
Anthropic	Claude model service, when configured for the feature	Message text, supported attachments and workspace context submitted through the API.
Amazon Web Services	Amazon Bedrock, when configured to host model inference	Message content and workspace context submitted to the model through Bedrock.
Supabase	Database hosting	Extracted freight records, processed-message content, saved freight attachments and your encrypted Google refresh token.
Vercel	Application hosting	Data processed while serving application requests, together with request metadata and application logs used to operate and troubleshoot the service.

When a connected email feature sends a document or reply, its contents are also shared with the recipients selected for that action or configured workflow. We do not use Google account data outside the purposes described in this policy.

What we store, and for how long

Your Google refresh token, encrypted at rest, so the connection keeps working without asking you to sign in every day. Deleted immediately when you disconnect.
Extracted freight records — the quote, shipment or booking we built from a message. This is your operating record and we keep it while your account is open.
Processed-message records, including message identifiers, sender, subject, snippets and portions of message or attachment text. These support duplicate prevention, the inbox activity view, retries and reviewing extraction results.
Source text and selected freight attachments, such as a rate confirmation PDF, may also be retained with the freight record they support. HALZAT does retain some email content; connecting does not create a complete mailbox backup.

Processed-message content and saved source documents are retained with your workspace; they do not currently expire on a fixed daily schedule. Disconnecting removes the connection credentials but does not delete previously imported messages, documents or operating records. You can request deletion separately using the contact below.

How to revoke access

Inside HALZAT, open the email integration settings and disconnect the mailbox. This deletes our stored connection and requests revocation at Google. You can also revoke HALZAT directly from Google at myaccount.google.com/permissions. New mailbox access stops after disconnect or revocation, although work already in progress may finish. Previously imported records remain until separately deleted.

2. Other data we handle

Account data — your name, work email, company, and role, so we know who is signing in and what they are allowed to see.
Freight and operating data — shipments, quotes, rates, documents, proofs of delivery, invoices and the addresses and contacts attached to them. This is the substance of the product.
Site analytics — page views and referral source across our website and application, to understand usage and which ads bring real carriers. Access tokens in portal paths are redacted before our analytics events are sent. Advertising pixels are enabled only on designated public marketing pages. Our analytics events do not include connected-mailbox message bodies or attachments.
Support messages you send us.

When account verification or password-reset delivery through Resend is enabled, it receives the destination email address and authentication email content for delivery.

We do not sell any of it. We share it only with the sub-processors listed above, with the carriers and partners a shipment is actually being tendered to, and where the law requires.

3. Security

Data is encrypted in transit and at rest. Our server checks the workspace and account permissions for data access. OAuth tokens are encrypted with a key held outside the database. Access to production is restricted to staff who need it and is logged.

No system is perfect. If we discover a breach affecting your data we will tell you promptly and tell you what we know, including what we do not yet know.

4. Your choices

Connect a mailbox, or do not. The product works either way.
Disconnect at any time, from HALZAT or from your Google account settings.
Ask us for a copy of your data, or ask us to delete it, by writing to the address below. We will respond within 30 days.
Closing your account deletes your operating data on request; some records are retained where we are legally required to keep them, such as invoices.

5. Children

HALZAT is business software sold to companies. It is not directed at anyone under 18 and we do not knowingly collect their data.

6. Changes

If we change this policy in a way that affects what we do with your data, we will update the date at the top and tell account holders before the change takes effect.

7. Contact

Privacy questions, data requests and deletion requests: irfan@halzat.com.

Halzat Logistic Technology Inc, a Delaware corporation, Los Angeles, California, USA.

Halzat Logistic Technology Inc, Los Angeles, California, USA.

Loading…