Overview

Veztra provides a business-to-business logistics operations platform for monitoring shipments, preparing carrier follow-ups, packaging claims, supporting customs holds and cross-border documentation, and coordinating workspace activity. This Privacy Policy explains how we collect, use, disclose, and protect information when organizations and their authorized users use the service.

This Privacy Policy is written for a United States and Canada B2B SaaS launch. Where a privacy law gives an individual or organization additional rights, we will honor those rights as required by that law.

Information We Collect

We collect account and workspace information such as names, business email addresses, roles, workspace names, authentication identifiers, plan information, workspace settings, branding settings, and user activity in the service.

Customers may upload, enter, or connect logistics data, including shipment tracking numbers, carriers, order numbers, recipient names, recipient contact details, shipping addresses, product details, HS codes, invoice and claim details, support ticket content, notes, CSV files, and related operational records.

When a customer shares a buyer-facing tracking link for a shipment, the recipient (who is not a Veztra account holder) may use that one-time link to submit a corrected shipping address or a hold-for-pickup request. We store the submission as a proposed change for the customer's team to review and confirm. Veztra does not email buyers directly.

We also collect technical and usage information such as device and browser information, IP address, pages viewed, actions taken, session events, errors, diagnostics, and information stored through cookies, localStorage, or sessionStorage.

How We Use Information

• *Provide, secure, maintain, and improve the service.
• *Authenticate users, manage workspaces, roles, invitations, and access controls.
• *Process CSV imports, normalize logistics records, and maintain workspace-scoped operational data.
• *Draft carrier follow-ups, claim packages, customs documents including commercial invoices, morning briefs, and shipment summaries for human review.
• *Operate billing, subscription, entitlement, quota, and customer support workflows.
• *Send service communications, transactional email, workspace notifications, and operational alerts.
• *Detect, investigate, and prevent abuse, security incidents, unauthorized access, and violations of our Terms.
• *Comply with legal, tax, accounting, regulatory, and dispute-resolution obligations.

AI Processing

The service may use AI providers, including Anthropic (for drafting and the knowledge assistant) and Voyage AI (for the embeddings that power knowledge search), to generate drafts, summaries, recommendations, and structured outputs from workspace context. AI output is designed to be reviewed and approved by authorized users before any external action is taken.

Customer Data is processed to provide the service and AI drafts; it is not used to train Veztra models. We do not sell Customer Data. Customers should not rely on AI output as legal, customs, tax, brokerage, or compliance advice.

Service Providers and Integrations

We may disclose information to service providers that help us run the service, such as hosting, database, authentication, billing, AI, email, scheduling, analytics, observability, customer support, and security providers. Current or planned providers may include Supabase, Vercel, Anthropic, Voyage AI, Resend, Sentry, PostHog, Stripe, Cal.com, Open-Meteo, and similar vendors.

Customers may connect third-party integrations such as carrier systems, commerce platforms, helpdesk and ticketing systems, messaging tools, email providers, and inbound or outbound webhooks. Examples include FedEx, UPS, USPS, DHL, Canada Post, Shopify, WooCommerce, BigCommerce, Zendesk, Freshdesk, Gorgias, Intercom, Slack, Resend, generic email routing, and webhook connections. Carrier lookups use tracking numbers only and do not send buyer personal information to the carrier; commerce and helpdesk integrations may carry buyer names, contact details, shipping addresses, and support ticket content. When a customer connects an integration, we process credentials, configuration data, sync events, and operational data needed to provide that connection.

Cookies and Local Storage

We use cookies and similar technologies for authentication, session management, security, preferences, product functionality, analytics, diagnostics, and remembering choices such as selected workspace or landing page theme.

The service may use browser localStorage and sessionStorage in development, demo, or product workflows to persist session state, selected organization, dashboard preferences, collapsed panels, and temporary workspace data. Browser storage can usually be cleared through browser settings.

Product analytics (PostHog) runs only with your consent. You can change or withdraw that choice at any time via cookie preferences; withdrawing consent also deletes the analytics identifiers stored in your browser.

How We Share Information

We share information with authorized users in the same customer workspace, with service providers acting on our behalf, with integrations enabled by the customer, and with professional advisors or authorities when needed to comply with law, protect rights, prevent harm, or complete a corporate transaction.

We do not sell personal information. We do not disclose Customer Data for cross-context behavioral advertising. If our practices change, we will update this Privacy Policy and provide any legally required choices.

Security and Retention

We use administrative, technical, and organizational safeguards designed to protect information, including workspace-scoped access controls, tenant isolation, encrypted credential storage where applicable, audit logging, and telemetry sanitization. No system can be guaranteed perfectly secure.

We retain most operational data for as long as needed to provide the service, meet legal and accounting obligations, resolve disputes, enforce agreements, and maintain security. Some data has a defined retention window: AI assistant conversation history is deleted after 30 days, and internal job-processing logs are kept for 14 to 30 days. Customers can export many records directly from the product, and workspace owners and admins have a built-in tool that anonymizes a buyer's personal identifiers on request, designed to honor erasure requests under PIPEDA and similar laws. Customers may also request deletion or export of Customer Data by contacting us, subject to legal, security, and contractual limits.

Cross-Border Processing

We may process and store information in the United States, Canada, and other countries where we or our service providers operate. These countries may have privacy laws that differ from the laws where a user or customer is located.

Where required, we use contractual, technical, and organizational measures intended to protect information transferred across borders.

Privacy Rights

Depending on location and applicable law, individuals may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about how personal information is used and disclosed. California residents may have additional rights under California privacy laws where those laws apply. Canadian individuals may have rights under PIPEDA or substantially similar provincial privacy laws.

To exercise rights, contact us at privacy@getveztra.com. We may need to verify the request and may refer workspace-level requests to the customer organization that administers the account.

Children

The service is intended for business use and is not directed to children. We do not knowingly collect personal information from children under 13 or the age required by applicable law.

Changes and Contact

This Privacy Policy is effective as of August 6, 2026. We may update it from time to time, and will revise the effective date when material changes are made.

For privacy questions or requests, contact privacy@getveztra.com.