Privacy Policy

1. Who We Are

Dispatchly is run by Foutje, trading as Dispatchly, a sole proprietorship (eenmanszaak) of Sem Ashby, registered with the Netherlands Chamber of Commerce (KvK) under number 89649540 and established in Balgoij, the Netherlands. We are the controller of the personal data described here, except where we process data inside the Dispatchly service on a customer's behalf, which our data processing agreement covers.

2. Information We Collect

We collect information you provide directly, such as your name, email address, and company details when you create an account. We also collect usage data to improve our service, including carrier integration metadata and claim filing activity.

On our website, we collect what you enter in our forms: contact and demo requests, the carrier refund audit, whitepaper requests, meeting bookings, waitlists and the newsletter. That is typically your name, email address, company and anything else you type. If you allow analytics, we also record which pages you visit, your IP address and browser, and use Google Analytics; our cookie policy describes exactly what and how to withdraw.

3. Carrier API Keys (BYOK)

Dispatchly operates on a Bring Your Own Key model. Carrier credentials are stored encrypted, scoped to the minimum permissions needed for SLA monitoring and claim filing, and revocable by you at any time.

4. How We Use Your Information

We use your information to provide and improve the Dispatchly service, process carrier SLA claims on your behalf, send service notifications, and communicate product updates. We do not sell your data to third parties.

The legal basis depends on the purpose:

• Contract. Providing the service and billing you for it.
• Steps you ask for, or our legitimate interest. Answering contact, demo, audit and whitepaper requests, and holding meetings you book.
• Consent. The newsletter, website analytics and marketing cookies. You can withdraw it at any time: unsubscribe from any newsletter, or change your choice on the cookie policy page.
• Legitimate interest. Keeping accounts and the service secure, including the security audit records below.
• Legal obligation. Keeping billing records as tax law requires.

5. Who Receives Your Data

We use these service providers, each only for the purpose listed:

• Cloudflare hosts our website and stores website form submissions and visit records. It also derives the network owner and approximate location from your IP address for those records.
• Hetzner hosts the servers and database of the Dispatchly service, in Germany.
• Brevo sends our service emails and the newsletter.
• Postmark receives support email and turns it into tickets.
• Google provides our email and calendar (including meetings you book), keeps a spreadsheet copy of website form submissions, and provides Google Analytics if you allow analytics.
• LinkedIn provides the LinkedIn Insight Tag if you allow marketing cookies, which tells us whether our LinkedIn ads lead to visits and booked calls. LinkedIn also uses that data under its own privacy policy.
• Stripe processes payments and billing.
• Carriers and Sendcloud receive tracking and claim data when you instruct us to work with them, using your own credentials.

Some of these providers are based in, or may process data in, the United States. Where that happens, the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. Data Retention

How long we keep data depends on what it is:

• Parcels, tracking history, tickets and claims are kept for as long as your organization's account exists, unless we agree a shorter period with you. A parcel you delete disappears from your dashboard straight away, but the record is kept until the account is deleted.
• Raw integration requests. The requests we receive from shipping platforms, from your own systems and by inbound support email can include your customers' names, delivery addresses and message content. We store them encrypted for up to 90 days so we can troubleshoot integrations, then delete them automatically.
• Data exports you request are deleted 7 days after they are created.
• Security audit records, which include the IP address and browser used for an action, are kept for 540 days (about 18 months), including after an organization is deleted.
• Deleting your organization. An owner can delete the organization from the account. Deletion takes effect 30 days later, and it can be cancelled until then. The organization and its data, including parcels, tickets, carrier connections and integration requests, are then permanently deleted.
• Your personal login (name and email address) is not deleted automatically when an organization is deleted, because one login can belong to several organizations. We delete it when you ask us to.
• Website visit records, kept only if you allow analytics, are kept until you ask us to delete them. Google Analytics keeps event data for 14 months.
• Contact, demo and audit requests and newsletter sign-ups made on our website are kept until you ask us to delete them. If you unsubscribe from the newsletter, we keep your email address marked as unsubscribed so we do not email you again.

You may ask us to delete your data at any time by contacting us at privacy@dispatch.ly.

7. Your Rights

You have the right to access, correct, or delete your personal data. You may also request a portable copy of your data, ask us to restrict how we use it, and object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time, without affecting what we did before. To exercise these rights, contact us at privacy@dispatch.ly.

If you are unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.

8. Contact

For privacy-related inquiries, contact us at privacy@dispatch.ly.