Privacy Policy

1. Introduction

Panvaya Logistics ("Panvaya", "we", "our", or "us") respects your privacy and is committed to protecting personal data and customer content. This policy explains what we collect, why we process it, where it is processed, the limited circumstances in which it is shared, and the choices available to you when you use our website, applications, APIs, and logistics visibility services.

2. Information We Collect

Depending on how you use Panvaya, we may collect the following categories of information:

• Account and identity data, such as your name, username, organization, role, and authentication information.
• Contact and billing data, such as your email address, telephone number, billing contact, subscription, invoice, and transaction information. Payment card details are handled by our payment provider and are not stored by Panvaya.
• Customer content, such as container numbers, bills of lading, booking references, air waybill numbers, vessel identifiers, shipment tracking results, uploaded documents, notes, and tags.
• Technical and usage data, such as IP address, browser and device details, timestamps, pages viewed, service events, and diagnostic or security logs.
• Communications, including support requests, sales inquiries, feedback, and records of correspondence with us.

3. How and Why We Use Information

We process information only for legitimate business purposes connected with providing Panvaya, including where processing is necessary to perform our contract with you, comply with law, pursue legitimate interests, or act with your consent where required.

• Provide shipment tracking, logistics visibility, schedules, alerts, reports, document storage, billing, and customer support.
• Create and administer accounts, authenticate users, enforce organization-level access, and prevent fraud or misuse.
• Maintain service reliability, troubleshoot problems, monitor usage limits, improve requested features, and protect Panvaya and its customers.
• Send transactional messages and, where permitted, product or marketing communications that you can opt out of.
• Meet legal, accounting, tax, regulatory, and contractual obligations.

4. Our Customer Data Commitment

Customer content remains the customer's data. Panvaya does not sell or rent customer content, use it for third-party advertising, or use private customer content to train artificial intelligence models. We process customer content only to provide, support, secure, and improve the services requested by the customer, follow the customer's instructions, and meet applicable legal obligations. We do not access customer content except where needed for those purposes and restrict access to authorized personnel with a business need to know.

5. Hosting and Service Providers

Panvaya's primary application records and uploaded customer documents are stored using Amazon Web Services (AWS) infrastructure. We use carefully selected service providers only where necessary to operate the service. Because shipment tracking requires information from external sources, relevant shipment identifiers may be transmitted securely to carriers, airlines, vessel-data services, or tracking-data providers to retrieve the results requested by you.

• AWS provides cloud hosting, managed database, object storage, queueing, backup, and email-delivery infrastructure.
• Cloudflare helps deliver and protect web traffic at the network edge.
• Payments and subscriptions are processed by secure, reputable third-party payment gateways. Gateway availability and supported payment methods may vary by customer country, and payment card details are not stored by Panvaya.
• Google services may be used when you choose Google sign-in and for website analytics delivered through Google Tag Manager.
• Logistics carriers and specialist tracking providers receive only the identifiers and request details reasonably necessary to return tracking information.

6. Data Security

We use administrative, technical, and organizational safeguards designed to protect information against accidental or unlawful loss, alteration, disclosure, or access. No internet service can guarantee absolute security, but our controls are reviewed and improved as the platform evolves.

• TLS encryption protects data transmitted between supported clients, Panvaya, and our service endpoints.
• Network access to Panvaya's public production endpoints is encrypted, with network-edge controls designed to filter and protect incoming traffic.
• Production data is hosted in AWS-managed database and object-storage services with access controls and environment separation.
• Authentication, authorization, and organization-level access controls limit access to customer accounts and content.
• Uploaded documents are delivered through short-lived, signed download links rather than public storage URLs.
• Operational access is limited to authorized personnel and is granted only for service administration and support needs.
• Automated backups, monitoring, and operational logging support resilience, investigation, and recovery.

7. Compliance and Assurance

Panvaya is hosted on AWS infrastructure for which AWS maintains independent compliance reports, including SOC reports for in-scope AWS services. AWS's certifications and reports cover AWS controls; they do not by themselves constitute a SOC 2 attestation of Panvaya. Computer System Validation (CSV) is based on a customer's intended use and applicable regulated requirements rather than a universal product certificate. We can work with enterprise customers on security questionnaires, validation requirements, data-processing terms, and the supporting materials that are available for the agreed service scope.

8. Sharing and Disclosure

We do not disclose personal data or customer content except as described in this policy: to service providers acting on our behalf; to other authorized members of your organization; when you direct or authorize us to do so; to protect users, Panvaya, or the public; in connection with a corporate transaction subject to appropriate protections; or when required by applicable law or valid legal process. Service providers are permitted to process information only for the contracted purpose and are expected to apply appropriate safeguards.

9. Retention and Deletion

We retain information only for as long as reasonably necessary to provide the service, maintain security and backups, resolve disputes, enforce agreements, and satisfy legal, tax, accounting, or regulatory requirements. Retention periods vary by data type and customer configuration. Customers can delete supported content within the service or request account and personal-data deletion. Deleted information may remain in restricted backups until those backups expire through the normal retention cycle, unless longer retention is required by law.

10. Cookies and Analytics

Panvaya uses essential browser storage and similar technologies for authentication, security, and core functionality. Google Tag Manager may also load analytics or measurement technologies that help us understand website and feature usage; these providers may receive technical data such as IP address, device or browser information, page URL, and event timestamps. You can manage or block cookies through your browser settings, although disabling essential storage may prevent parts of the service from working.

11. International Processing

Our service providers and logistics data sources may process limited information outside your country, subject to their terms and applicable data-protection requirements. Enterprise customers with specific residency or transfer requirements should contact us so those requirements and any necessary contractual safeguards can be reviewed as part of the service agreement.

12. Your Privacy Rights

Depending on your location, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal data; object to certain processing; withdraw consent; or lodge a complaint with a data-protection authority. We may need to verify your identity and authority before completing a request. If your account is managed by an organization, that organization may be the appropriate first contact for requests relating to customer content.

13. Children

Panvaya is a business service and is not directed to children. We do not knowingly collect personal data from children through the service. If you believe a child has provided personal data to us, please contact us so we can take appropriate action.

14. Changes to This Policy

We may update this policy to reflect changes to our services, providers, or legal obligations. We will publish the revised policy on this page and update the date below. If a change materially affects how we use customer data, we will provide additional notice where required.

15. Contact Us

For privacy questions, rights requests, enterprise security reviews, or data-processing terms, email [email protected] or use our Contact Support page.