Privacy Policy

This Privacy Policy explains how TIOCORE Inc. ("TIO," "TIOCORE," "we," "us," or "our") collects, uses, shares, and protects information when you use the TIO platform and the tiocore.com website (together, the "Service"). By using the Service you agree to the practices described here. Questions can be sent to hello@tiocore.com at any time.

For technical controls, read our Security page. For the actions you authorize an agent to take, see our Terms of Service. To make a privacy request, follow Section 10.

1. Who we are

TIO operates AI agents that do back-office work for freight forwarders and freight brokerages. The Service sits between a customer's email inbox and their transportation management system (TMS). It reads shipment email and documents, prepares records, and writes records to the customer's TMS under the settings the customer has agreed for each action. Our principal place of business is in the United States. For the personal data of customer end users processed through the platform, the customer is the controller and TIO acts as a processor on the customer's documented instructions.

2. Information we collect

• Account and contact data: name, work email, company name, role, and the content of demo requests or messages you send us.
• Email you route to TIO: your mail system copies or forwards email to an agent mailbox that TIO hosts for you on Amazon Web Services. You control which mailboxes are copied, through a rule in your own mail system. TIO does not sign in to your mailboxes. TIO receives the messages, attachments and headers that your rule sends, and stores the content and the data extracted from it in your account.
• Freight and job data: shipment fields, parties, documents, lot numbers, status, and audit-log entries associated with your account.
• Usage and technical data: pages visited, features used, timestamps, device and browser type, and IP address, collected through our site and analytics.
• Cookies and analytics: we use Google Analytics 4, Ahrefs Web Analytics and Vercel Speed Insights to understand site usage and performance. Demo requests come in by email. Each provider processes data under its own policies.

3. How we use information

• Provide, operate, secure, and improve the Service
• Read email and documents and prepare job, quote and filing data for your account
• Write records to your connected TMS, under the setting you have agreed for each action
• Send service communications such as deadline and status notifications
• Respond to support, sales, and demo requests
• Measure and improve site and product performance
• Comply with legal, tax, and recordkeeping obligations and enforce our terms

We do not sell your personal information. We do not use your freight or email data to train AI models.

4. Legal bases for processing

Where the EU or UK GDPR applies, we rely on: performance of a contract (to provide the Service you requested); legitimate interests (to secure, operate, and improve the Service and for business communications); consent (where we ask for it); and compliance with legal obligations. Where TIO acts as a processor, processing is governed by the customer's instructions and the applicable data processing agreement.

5. How and with whom we share information

• Your TMS: shipment data is transmitted to the TMS you connect, at your direction.
• Email delivery (Amazon Web Services): mail you route to TIO is received, and mail an agent sends for you is sent, through Amazon Simple Email Service, acting as our sub-processor.
• Sub-processors: cloud hosting, database, email receiving and sending (Amazon Web Services), AI model providers that read documents and extract fields on our behalf (currently OpenAI and Google), and analytics (Google Analytics) providers, each acting on our behalf under contractual data protection terms. AI model providers receive document and email content only to process it for your account, under API terms that do not permit them to use it to train their models.
• Professional advisers and authorities: auditors, lawyers, and government or law-enforcement bodies where required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

6. Cookies and Do Not Track

The site uses strictly necessary cookies and analytics cookies. You can control cookies through your browser settings. Some browsers transmit a Do Not Track signal; because there is no common industry standard for responding to it, we do not currently respond to DNT signals.

7. Data retention

Audit-log data is retained for at least five years, to align with U.S. customs recordkeeping requirements. Other personal and account data is retained for as long as your account is active or as needed to provide the Service, and afterward only as required for legal, tax, accounting, or dispute-resolution purposes. You may request deletion at any time, subject to those retention requirements.

8. Security

We apply technical and organizational measures including encryption in transit and at rest, role-based access controls, network controls, and audit logging. Each customer's operational data is kept in its own database. The agent write-event journal is append-only for the application, with database controls that protect stored events from application edits and deletion. We record failed security-alert delivery and configure monitoring per customer database. More detail, including the scope of request logging and monitoring, is on our Security page. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect information appropriate to its sensitivity.

9. International data transfers

We are based in the United States and may process information in the U.S. and other countries where we or our sub-processors operate. Where required, transfers of personal data out of the EEA or UK are made under appropriate safeguards such as Standard Contractual Clauses.

10. Your privacy rights

Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. To exercise any of these, email hello@tiocore.com with your name, the email address you used with us, and the request. For access, correction and deletion requests we verify your identity before we act, using information we already hold. We answer within the time the applicable law allows. If we decline a request, we tell you why and how to appeal. You may also complain to your local data protection authority. If your data was provided to us by a customer using TIO as a processor, we will refer your request to that customer. We will not discriminate against you for exercising these rights.

11. U.S. state privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you rights to know, access, delete, correct, and opt out of the "sale" or "sharing" of personal information and the use of sensitive personal information. We do not sell or share personal information as those terms are defined. Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws have comparable rights, including the right to appeal a declined request. Submit requests to hello@tiocore.com. We verify your identity for requests to know, access, correct or delete.

Categories of personal information

In the last 12 months we have collected identifiers (name, work email, company, IP address), professional information (role), internet activity on our site, and the business content customers send through the Service. We collect it from you, from the systems you connect, and from your use of the site. We use and disclose it only for the business purposes in Sections 3 and 5. The sensitive personal information we hold is account sign-in credentials. We use it only to sign you in and secure your account, and we do not use or disclose it for any other purpose.

Authorized agents and appeals

You may use an authorized agent to make a request. We ask the agent for proof of your written permission and may verify your identity with you directly. To appeal a declined request, reply to our decision or email hello@tiocore.com with the subject "Privacy appeal".

California "Shine the Light"

California residents may ask once a year, free of charge, for a list of the categories of personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information for that purpose.

12. Children

The Service is a business tool not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy as the Service or the law evolves. Material changes will be communicated by updating the "Last updated" date above and, where appropriate, by email or in-product notice.

14. Reviewing, updating or deleting your data

You can ask to see, correct or delete the personal data we hold about you by emailing hello@tiocore.com. Customers can also ask us for an export of their job and audit-log data. You can stop sending mail to TIO at any time by turning off the rule in your own mail system, and you can ask us to disconnect a TMS. Deletion is subject to the retention periods in Section 7.

15. Contact

Questions, requests, or complaints about this Policy or your data: hello@tiocore.com.