Privacy policy

Version 2026-10-22, effective from 2026-10-22.

Draft for legal review. The operator’s details will be filled in before the service is made available.

This is a translation provided for convenience. The Polish version is binding.

1. Who is responsible for your data

The controller of the data of people using Spedo (Users) is [OPERATOR: name, address, tax ID (NIP), e-mail] (the Operator). For anything about personal data, write to the Operator’s e-mail address.

Data that Companies upload and create in the service — the carrier list, sent quote requests and loads — is processed on behalf of those Companies under a data processing agreement (Annex 1 to the terms). The controller of that data is the Company. If you are a carrier or a customer of a Company and want to exercise your rights, write to that Company; if you write to us, we will pass the request on to the Company.

2. What data we process, why and for how long

Account

Data: e-mail address, name (if you give it), password hash (we never know the password itself), language, whether the address is confirmed, Company and role in it, creation date, version and date of acceptance of the terms.
Purpose and legal basis: creating and running the account, providing the service (Article 6(1)(b) GDPR); recording acceptance of the terms — demonstrating that the agreement was concluded (Article 6(1)(f) GDPR).
Period: until the account is deleted. An account without a confirmed address and without a Company is deleted 30 days after it was created.

Sign-in and one-time links

Data: hash of the session identifier (valid for 30 days), address confirmation links (valid for 48 hours), password change links (1 hour) and invitations to a Company (7 days; they contain the invited person’s e-mail address).
Purpose and legal basis: signing in and account security (Article 6(1)(b) and (f) GDPR).
Period: sessions are deleted when they expire, links 7 days after they expire.

Company profile

Data: NIP, name, address, REGON, VAT status and the White List check identifier, payment term, phone, reply-to e-mail, message signature, optionally the details of the Company’s own SMTP mailbox (password encrypted). For sole traders this is the business owner’s personal data. Source: the User and the Ministry of Finance VAT taxpayer register.
Purpose and legal basis: providing the service to the Company (Article 6(1)(b) GDPR), checking that the Company is genuine (Article 6(1)(f) GDPR).
Period: until the Company is deleted. A Company not confirmed by the Operator is deleted after 14 days.

“This is my company” reports

Data: e-mail address, phone and description given in the report.
Purpose and legal basis: checking who represents the Company (Article 6(1)(f) GDPR).
Period: until resolved, then for 90 days; reports are also deleted with the account.

Security and limits

IP address: used only in the server’s memory for limits on sign-in, sign-up, password change and access password attempts (for at most one hour); the app does not write it to disk.
Daily usage counters of the Company (AI analyses, messages sent): kept for 90 days.
White List responses for checked NIP numbers: used for 24 hours, deleted after 7 days.
Legal basis: the Operator’s legitimate interest — protecting the service from abuse and keeping within the Ministry of Finance request limit (Article 6(1)(f) GDPR).

Logs

Application log: errors and events, e.g. deletion of an unconfirmed Company (NIP and name) or a failed e-mail (may contain the recipient’s address); because the service does not send e-mails at the moment, it also contains the recipient, subject and links of system messages (confirmations, invitations, password changes). The log has a fixed size (3 × 10 MB): the oldest entries are overwritten and the whole log is erased with every app update.
Web server error log: IP address, page address and error description — only when an error occurs; kept for 30 days. We do not keep a log of visits.
Legal basis: maintaining and securing the service (Article 6(1)(f) GDPR).

Unsent messages

In the demo, quote requests are not sent to carriers. System messages (confirmations, invitations, password changes) are not sent either. Their sender, recipient, subject and text are saved in the database and deleted after 30 days.

Company data (processed on behalf of Companies)

Carrier list, sent quote requests (deleted after 12 months) and loads — processed on behalf of the Company, on its instructions and for the duration of the data processing agreement; details in Annex 1 to the terms.
Text pasted into the inquiry box before sending is not stored on the server. While the page reloads after a language change, the browser keeps a draft in the tab’s storage (see section 5).

3. Who receives the data

We use these sub-processors:

OVH SAS (OVHcloud), France — the server that runs the service and stores the database (data centre in France).
Cloudflare, Inc., USA — sits in front of all traffic to the service (encrypted connection, attack protection). It sees the IP address, the browser and the data sent.

Ministry of Finance (Poland) — when checking a Company we send the NIP to the VAT taxpayer register API.
Company Team — people in the same Company see the e-mail addresses and names of the others and who sent a quote request.
Operator — when reviewing reports and confirming Companies, sees the report and the Company profile.

4. Transfers outside the EEA

Cloudflare is based in the USA. Data goes there under the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission. You can get a copy of the safeguards from the Operator.

5. Cookies and browser storage

We only use cookies and browser storage needed for the service to work, so we do not ask for consent. We do not use analytics tools, advertising or tracking cookies.

Name	Type	Purpose	Duration
sid	cookie	keeping you signed in (not readable by page scripts)	30 days
spedo_access	cookie	remembering that the access password was entered	30 days
lang	cookie	chosen language	1 year
lang	local storage	chosen language	until browser data is cleared
qDraft	tab storage (sessionStorage)	draft of the inquiry while the page reloads after a language change	until the tab is closed
invite	tab storage (sessionStorage)	Company invitation code until you sign in	until the tab is closed

Cloudflare may ask the browser for anonymous reports about connection errors (Network Error Logging).

6. Your rights

Access and portability: “Download my data” in Settings → Account (JSON file); the Owner can also download the Company data (“Download company data”, ZIP file).
Erasure: “Delete account” in Settings → Account; the Owner can delete the Company.
Rectification: the Owner corrects Company data in Settings; for other changes (e.g. e-mail address) write to the Operator.
Restriction of processing and objection to processing based on legitimate interest — write to the Operator.
Complaint to the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland) if you believe we process your data unlawfully.

7. Do you have to provide data

An e-mail address and password (or signing in with a provider) are required to create an account. The NIP is required to create a Company profile. Other data is optional.

8. Automated decisions

We do not make decisions based solely on automated processing that have legal effects on you (Article 22 GDPR). The carrier ranking is only a suggestion for the User.

9. Security

Security measures are described in § 5 of the Data processing agreement (Annex 1 to the terms).

10. Changes to this policy

After the Privacy policy changes, you will be asked to accept the new version when you open the app. The version number and effective date are shown at the top of this page.