Privacy
Policy.

Last updated: March 22, 2026  ·  Effective: March 22, 2026

1. Who We Are

CartonFlow is operated by Pevara Systems. When we say "CartonFlow," "we," "us," or "our," we mean Pevara Systems. Questions? [email protected]

2. What We Collect

Account information

When you create an account we collect your name, email address, company name, and password (hashed — we never store it in plaintext).

Shipment and logistics data

Data you enter into the platform: shipments, products, destinations, 3PL contacts, messages, invoices, and documents. This data belongs to you.

Usage data

We collect standard server logs: IP address, browser type, pages visited, and timestamps. This helps us diagnose issues and improve the product.

Payment data

All payment processing is handled by Stripe. CartonFlow never sees or stores your full card number. We store only your Stripe customer ID and subscription status.

Carrier credentials

If you connect FedEx or UPS accounts, we store your API credentials (encrypted at rest) solely to pull tracking data on your behalf.

3. How We Use Your Data

• To operate and provide the CartonFlow platform
• To send transactional emails (shipment alerts, invoices, weekly digests)
• To process billing via Stripe
• To monitor errors and improve reliability (Sentry)
• To comply with legal obligations

We do not use your data for advertising. We do not sell your data to third parties. We do not use your logistics data to train AI models.

4. Data Sharing

We share data only with:

• Your 3PLs and partners — data you explicitly share with them through the platform
• Stripe — for payment processing
• Supabase / AWS — database and infrastructure hosting
• Sentry — error monitoring (no PII in error payloads)
• FedEx / UPS — only to retrieve tracking data using your own credentials

5. Data Retention

We retain your data for as long as your account is active. If you cancel, we retain your data for 90 days before permanent deletion, unless you request immediate deletion.

6. Your Rights

You have the right to access, correct, export, or delete your data at any time. Email [email protected] and we'll respond within 5 business days.

7. Security

All data is encrypted in transit (TLS) and at rest. Passwords are hashed using bcrypt. We use JWT-based authentication with short-lived access tokens and longer-lived refresh tokens stored securely.

8. Cookies

We use session cookies for authentication only. We do not use advertising or tracking cookies. See our Cookie Policy for details.

9. Changes to This Policy

We'll notify you by email if we make material changes to this policy. Continued use of CartonFlow after changes constitutes acceptance.

10. Contact

Pevara Systems · [email protected]