Privacy Policy

This Privacy Policy explains how TIO ("TIO," "TIOCORE," "TIO Logistics," "we," "us," or "our") collects, uses, shares, and protects information when you use the TIO platform and the tiocore.com website (together, the "Service"). By using the Service you agree to the practices described here. Questions can be sent to hello@tiocore.com at any time.

1. Who we are

TIO operates AI middleware for freight forwarding back-office operations. The Service sits between a customer's email inbox and their transportation management system (TMS), reads shipment email, assembles job data for human review, and writes approved records to the customer's TMS. Our principal place of business is in the United States. For the personal data of customer end users processed through the platform, the customer is the controller and TIO acts as a processor on the customer's documented instructions.

2. Information we collect

• Account and contact data: name, work email, company name, role, and the content of demo requests or messages you send us.
• Connected inbox data: with your authorization, TIO connects to your email through Nylas, our email integration provider, using your mail provider's API (Google Gmail or Microsoft Graph). TIO reads shipment-related email, attachments, and metadata from the inboxes you designate, and stores the content and the data extracted from it in your account. For Gmail connections, see Section 14 (Google user data and Limited Use).
• Freight and job data: shipment fields, parties, documents, lot numbers, status, and immutable audit-log entries associated with your account.
• Usage and technical data: pages visited, features used, timestamps, device and browser type, and IP address, collected through our site and analytics.
• Cookies and analytics: we use Google Analytics 4 to understand site usage. Demo scheduling is handled through Calendly. These providers set their own cookies and process data under their own policies.

3. How we use information

• Provide, operate, secure, and improve the Service
• Read email and assemble job and filing data for your team to review and approve
• Write approved records to your connected TMS via API, at your direction
• Send service communications such as deadline and status notifications
• Respond to support, sales, and demo requests
• Measure and improve site and product performance
• Comply with legal, tax, and recordkeeping obligations and enforce our terms

We do not sell your personal information. We do not use Google user data, including Gmail content and metadata, to train generalized or non-personalized AI or machine-learning models. We do not use your other freight or email data to train AI models without your explicit, separate consent.

4. Legal bases for processing

Where the EU or UK GDPR applies, we rely on: performance of a contract (to provide the Service you requested); legitimate interests (to secure, operate, and improve the Service and for business communications); consent (where required, for example certain analytics or AI-training uses); and compliance with legal obligations. Where TIO acts as a processor, processing is governed by the customer's instructions and the applicable data processing agreement.

5. How and with whom we share information

• Your TMS: approved shipment data is transmitted to the TMS you connect, via API, at your direction.
• Email providers (Google, Microsoft) via Nylas: inbox access is authorized under your own Google or Microsoft credentials and brokered by Nylas, our email integration provider, acting as our sub-processor. We connect only to the inboxes you designate.
• Sub-processors: cloud hosting, database, email integration (Nylas), analytics (Google Analytics), and scheduling (Calendly) providers acting on our behalf under data processing agreements with appropriate safeguards.
• Professional advisers and authorities: auditors, lawyers, and government or law-enforcement bodies where required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

6. Cookies and Do Not Track

The site uses strictly necessary cookies and analytics cookies. You can control cookies through your browser settings. Some browsers transmit a Do Not Track signal; because there is no common industry standard for responding to it, we do not currently respond to DNT signals, but we limit analytics to what is described here.

7. Data retention

Audit-log data is retained for five years to align with U.S. customs recordkeeping requirements. Other personal and account data is retained for as long as your account is active or as needed to provide the Service, and afterward only as required for legal, tax, accounting, or dispute-resolution purposes. You may request deletion at any time, subject to those retention requirements.

8. Security

We apply technical and organizational measures including encryption in transit and at rest, role-based access controls, network controls, and immutable audit logging. The platform is built toward SOC 2 Type II practices. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect information appropriate to its sensitivity.

9. International data transfers

We are based in the United States and may process information in the U.S. and other countries where we or our sub-processors operate. Where required, transfers of personal data out of the EEA or UK are made under appropriate safeguards such as Standard Contractual Clauses.

10. Your privacy rights

Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. To exercise any of these, email hello@tiocore.com. If your data was provided to us by a customer using TIO as a processor, we will refer your request to that customer. We will not discriminate against you for exercising these rights.

11. U.S. state privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you rights to know, access, delete, correct, and opt out of the "sale" or "sharing" of personal information and the use of sensitive personal information. We do not sell or share personal information as those terms are defined. Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws have comparable rights, including the right to appeal a declined request. Submit requests to hello@tiocore.com; we will verify your identity before responding.

12. Children

The Service is a business tool not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy as the Service or the law evolves. Material changes will be communicated by updating the "Last updated" date above and, where appropriate, by email or in-product notice.

14. Google user data and Limited Use

TIO accesses Gmail data only with your authorization, through Nylas, our email integration provider, and solely to read shipment-related email and assemble job data for your team to review and approve within TIO. TIO's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not transfer or sell Google user data to third parties for advertising, data brokering, or resale; we do not use Google user data to train generalized or non-personalized AI or machine-learning models; and we do not allow humans to read Google user data except your own authorized team acting on your own data within the Service, with your affirmative agreement, or as required for security, to comply with law, or to provide support you request. You can revoke TIO's access to your Gmail at any time through your Google Account security settings.

15. Contact

Questions, requests, or complaints about this Policy or your data: hello@tiocore.com.