Privacy Policy

Waitlist and enquiry information

When you join the waitlist we collect your name, work email address, company name, the dock door range you selected, your role if you choose to give it, anything you write in the notes field, and the fact that you consented to be contacted. We also record the submission time, the IP address the request came from and your browser user agent, so we can investigate abuse of the form.

Account information

For paying customers we hold the account holder and user names, work email addresses, work phone numbers where given, job titles, company name and billing address, and records of your subscription and invoices.

Service data

This is the operational content of the product, and it is what our customers upload or generate. It includes facility and dock door configuration, shift hours and booking rules, appointment dates and times, purchase order and load reference numbers, carrier company names, trailer and equipment types, pallet or case counts, arrival and departure timestamps, dwell durations, and notes your team adds to an appointment.

It also includes limited business contact details for the people involved in an appointment: the name and work email or phone number of a dispatcher or driver, so a confirmation or a delay notice can reach them. That is the extent of the personal information in the product.

Support communications

Emails you send us, and our replies, along with any screenshots or files you attach.

Technical and usage data

Server logs recording IP address, timestamp, requested page, response status, referring page and user agent. In the application we record which features an account uses and errors it encounters, so we can fix problems and understand what to improve.

Payment information

Card and bank details are collected and stored by our payment processor, not by us. We receive the card brand, the last four digits, the expiry date, the billing country and the outcome of each charge. We never see or store a full card number.

This list matters as much as the one above. The Service is not built for, and we do not knowingly collect:

• Social Security numbers, driver licence numbers or other government identifiers
• Full payment card numbers or bank account credentials on our own systems
• Health, medical or insurance records
• Credit reports, consumer credit information or background check results
• Biometric identifiers, including facial images used for identification, fingerprints and voiceprints
• Continuous or precise geolocation tracking of drivers, vehicles or employees
• Driver performance scoring, employment evaluations or any input to hiring, promotion or discipline decisions
• Consumer purchase histories, household data or information about anyone under 18
• Data acquired from data brokers or scraped from third-party sources

Our Terms of Service prohibit customers from uploading these categories. If we discover that such data has been uploaded, we will ask the customer to remove it and may delete it ourselves.

• To run the Service: create and secure accounts, publish booking pages, schedule appointments, send appointment confirmations and delay notices, and produce your reports.
• To generate estimates and suggestions: predicted unload duration, door assignment suggestions, detention risk flags and labor forecasts, calculated from the data in that customer's own account.
• To provide support: answer questions, investigate faults and restore data.
• To bill: process subscription payments, send invoices, recover unpaid amounts.
• To keep the Service safe: detect fraud and abuse, rate-limit forms, investigate security incidents, keep audit logs.
• To improve the product: understand which features are used and where people get stuck, using aggregated and de-identified measurements wherever that is sufficient.
• To communicate about early access: if you joined the waitlist, to tell you when a beta slot opens and what changed. Every one of those emails has a one-click unsubscribe.
• To meet legal obligations: tax and accounting records, and responding to lawful requests.

Model training

Predictions for your account are built from your account's own history. We do not train shared or cross-customer models on your Service data, and we do not use it to produce outputs for any other customer, unless you give us written permission. Where we evaluate model quality across our customer base, we do so on aggregated statistics that cannot be traced back to a person or a company.

Where data protection law requires us to identify a legal basis, we rely on the following:

• Performance of a contract, to deliver the Service to a customer and to bill for it.
• Legitimate interests, to secure the Service, prevent abuse, keep records, and improve the product in ways our customers would expect.
• Consent, for waitlist and marketing email, which you can withdraw at any time.
• Legal obligation, for tax, accounting and lawful requests from authorities.

Where we act as a processor on a customer's behalf, that customer is responsible for identifying its own legal basis for the data it uploads.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have never done so. We share information only in these situations:

Service providers

We use a small number of vetted vendors, each under a written agreement that limits them to processing data on our instructions:

• Cloud hosting and storage in United States data centres, to run the application and hold data
• Transactional email delivery, to send confirmations, alerts and account email
• Payment processing, to take subscription payments and issue receipts
• Error and performance monitoring, to detect and diagnose faults
• Customer support tooling, to manage email conversations with you

A current list naming these providers is available on request from privacy@shoficdigital.com. Customers on a written agreement are notified before we add a provider that processes Service data.

Between a customer and its Carriers

When a Carrier books an appointment, the booking details reach the customer facility, and appointment confirmations reach the Carrier contact. That exchange is the purpose of the product.

Legal and safety

We disclose information if we are legally required to, or where necessary to investigate fraud, enforce our Terms of Service, or protect the rights and safety of people. We review every request, reject those that are overbroad, and notify the affected customer unless we are legally prohibited from doing so.

Business transfers

If we are involved in a merger, acquisition or sale of assets, information may transfer to the acquirer, which remains bound by this policy or a policy at least as protective. We will notify affected customers before any such transfer completes.

• Waitlist entries: until we launch to you and you become a customer, or twenty-four months after your last contact with us, whichever comes first. Sooner if you ask.
• Service data: for as long as the subscription is active. After it ends, we keep it available for export for thirty days, then delete or irreversibly anonymise it.
• Account and billing records: up to seven years after the relationship ends, because tax and accounting law requires it.
• Support email: up to twenty-four months after the conversation closes.
• Server and security logs: up to twelve months, then deleted.
• Encrypted backups: rolling thirty-five day cycle, after which the backup containing the data expires and is destroyed.

Deletion requests are honoured across live systems promptly. Data already written to an encrypted backup is removed when that backup expires on the cycle above.

• Traffic is encrypted in transit with TLS. Stored data and backups are encrypted at rest.
• Each customer account is logically separated, and application queries are scoped to the account making the request.
• Internal access follows least privilege, is limited to staff who need it to operate or support the Service, requires multi-factor authentication, and is logged.
• Passwords are stored using a modern one-way hashing algorithm. We never store them in a readable form and cannot tell you what yours is.
• We patch dependencies on a routine schedule, review code changes before release, and keep audit logs of administrative actions.
• We maintain an incident response process. If a breach affects your data, we will notify affected customers and any required authority without undue delay, and in any case within seventy-two hours of confirming it.

We describe our practices honestly and do not claim certifications we do not hold. If your procurement process needs a security questionnaire completed or a written data processing agreement signed, write to privacy@shoficdigital.com and we will work through it with you.

No system is perfectly secure. Please use a strong, unique password, enable multi-factor authentication where offered, and remove users who leave your company.

Depending on where you live, you may have the right to:

• know what information we hold about you and get a copy of it;
• correct information that is wrong or incomplete;
• have information deleted;
• receive it in a portable, machine-readable format;
• object to or restrict certain processing;
• withdraw consent to marketing email at any time;
• be free from discrimination for exercising any of these rights.

California residents

Under the California Consumer Privacy Act as amended, we confirm that in the preceding twelve months we have not sold personal information and have not shared it for cross-context behavioural advertising. We do not use or disclose sensitive personal information beyond the purposes permitted by that Act. We do not offer financial incentives in exchange for personal information. You may exercise the rights above, including through an authorized agent, using the contact details below.

How to exercise a right

Email privacy@shoficdigital.com from the address you want us to look up, or write to the postal address below. We verify requests before acting, and we do not charge a fee. We respond within thirty days, or forty-five days where the law allows and we tell you why we need longer.

If the data is held in a customer's account and we are acting as a processor, we will forward your request to that customer and support them in answering it.

To stop marketing email, use the unsubscribe link in any message or reply asking us to remove you. Operational email about an active subscription, such as billing and security notices, continues while the account exists.

We are based in the United States and the Service is hosted in United States data centres. If you use the Service from outside the United States, your information is transferred to and processed there, where data protection law may differ from your own.

Where a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland is involved, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the technical and organisational measures described in the security section. Copies of the relevant terms are available on request.

This marketing website sets a single cookie, a session identifier, and only after you interact with the waitlist form. It exists to protect the form against cross-site request forgery and to show you the confirmation message after submitting. It is strictly necessary, contains no personal information, and expires when you close your browser.

We do not run advertising pixels, social media trackers, session recording or cross-site profiling on this website. Fonts and the stylesheet framework are loaded from public content delivery networks, which receive your IP address as a normal part of serving those files.

The application itself, once launched, uses cookies for authentication and for remembering interface preferences such as your default facility. Those are described in the application.

We honour Global Privacy Control and Do Not Track signals where your browser sends them. Since we do no behavioural advertising, there is nothing for those signals to disable.

The Service is a business tool sold to companies and is not directed at children. We do not knowingly collect information from anyone under 18. If you believe a child has provided us information, write to privacy@shoficdigital.com and we will delete it.

When we change this policy we update the effective date at the top of the page. For material changes, such as a new category of data or a new purpose, we notify customers and waitlist members by email at least thirty days before the change takes effect. Earlier versions are available on request.

Privacy questions, requests and complaints go to our privacy contact:

SHOFIC DIGITAL LLC
17 S Lexington St Ste 100, Harrisonville, MO 64701, United States

• Privacy: privacy@shoficdigital.com
• General and support: support@shoficdigital.com

We answer privacy email during United States business hours and aim to reply within five business days. If you are in the European Economic Area or the United Kingdom and are not satisfied with our response, you may complain to your local supervisory authority.