Privacy Notice

DockBOL does not use third-party analytics, advertising, or cross-site tracking tools, and we do not sell personal information. Fonts and assets are self-hosted, so simply visiting the site does not send your device information to third-party CDNs. We collect only what the Service needs to run.

Information you provide to us:

• Contact and account data — name, email address, and login credentials (handled by our authentication provider). Purpose: account creation, authentication, and access to cloud workspace features. Legal basis: contract performance.
• Workspace data — the bills of lading, templates, address-book entries, carriers, branding assets (such as your logo), and team/invitation records you choose to save to your cloud workspace, including the business contact details of shippers, consignees, and carriers you enter. Purpose: providing the cloud features you selected. Legal basis: contract performance.
• Communications data — anything you send us by email or through support channels. Purpose: responding to your request. Legal basis: consent and legitimate interests.
• Payment data — collected and controlled by Paddle, our Merchant of Record, for subscription sales, billing, tax compliance, and invoicing. DockBOL does not store full card numbers; we receive only subscription status and transaction references from Paddle.

Automatic data collection:

• Operational and security data — device identifiers and IP address, processed transiently by our hosting and authentication infrastructure in request and error logs. Purpose: security, abuse prevention, and service operation. Legal basis: legitimate interests. We do not run analytics or behavioral tracking on this data.

Guest (local-first) data:

In guest mode (no account), the current draft, local address book, presets, and interface preferences are stored in your browser’s local storage on your device. We do not upload guest shipment data. You can export a JSON backup or clear local data from Settings → Local data. Guest data is uploaded only if you sign in and explicitly choose to import it into your cloud workspace.

We use only essential cookies and browser storage: your sign-in session (kept in browser storage so you stay logged in) and small interface preferences such as sidebar state. We do not use analytics or marketing cookies, so no consent banner is needed for our own storage. During checkout, Paddle may set its own cookies to process payment and prevent fraud — these are governed by Paddle’s Privacy Policy. Disabling essential storage in your browser will prevent you from signing in.

We use personal information only for the following purposes, or as otherwise described at the time of collection:

• Service delivery and operations — to provide the Service, establish and maintain your account and workspace, enable security features, and communicate with you about the Service (announcements, updates, security alerts, and support and administrative messages).
• Support — to respond to your requests, questions, and feedback.
• Compliance and protection — to comply with applicable laws, lawful requests, and legal process; to protect our, your, or others’ rights, privacy, safety, or property; to enforce the terms that govern the Service; and to prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, or illegal activity.
• Aggregated or de-identified data — we may create aggregated, de-identified, or anonymized data from personal information and use or share it for lawful business purposes, such as improving the Service. We will not attempt to reidentify any such data.

We do not use your personal information for interest-based advertising, and we do not use your documents or workspace content to train AI models.

• Guest (local) data — stays in your browser until you clear it; we never receive a copy.
• Cloud workspace data — kept while your account is active. When you delete your account (self-serve from the account menu, or by emailing us), your cloud data is erased — owned workspaces, saved BOLs, templates, and address-book records are deleted with it.
• Workspace activity records — kept while the workspace exists, for security and audit purposes, and deleted when the workspace is deleted.
• Platform backups and logs — rotate on our hosting provider’s schedule; deleted data ages out of backups automatically.

In all cases we retain personal information only as long as needed to fulfill the purposes described above, including satisfying legal, accounting, or reporting requirements and establishing or defending legal claims. When we no longer require it, we delete, anonymize, or isolate it from further processing.

We share personal information only with the categories of recipients below:

• Service providers and subprocessors — our cloud platform (hosting, database, authentication, and file storage), each under a data-processing agreement.
• Paddle (Merchant of Record) — for the sale of the product, subscription management, payment processing, tax compliance, and invoicing. Paddle controls the payment data it collects and handles it under Paddle’s Privacy Policy.
• Professional advisers — legal and accounting, where needed and under confidentiality.
• Authorities — law enforcement, government authorities, and private parties, where we believe in good faith it is necessary for the compliance and protection purposes described above.
• Business transferees — we may disclose personal information in the context of an actual or prospective merger, acquisition, financing, or sale of all or part of our business or assets, and in any insolvency, bankruptcy, or receivership in which personal information is transferred as a business asset.

We do not sell your personal information, share it for cross-context behavioral advertising, or disclose it to data brokers.

• Access or update your information — you may review and update account information by logging into your account.
• Delete your account and data — you can delete your account and all cloud data yourself at any time from the account menu (“Delete account”), or by emailing us. Guest data in your browser can be cleared from Settings → Local data.
• Communications — we send only service-related and transactional email. If we ever send marketing email, you may opt out using the unsubscribe instructions in the message; you will continue to receive service-related email.
• Declining to provide information — we need certain information to provide account features; if you do not provide information we identify as required, those features may be unavailable. The guest generator works without any account.
• Linked third-party platforms — if you sign in through a third-party platform (such as Google), you may be able to limit the information we receive from it using that platform’s settings. Revoking access does not affect information already received.
• Do Not Track — some browsers send “Do Not Track” signals. Because we do not run third-party tracking, these signals require no action, and we do not otherwise respond to them.

The Service may contain links to websites and online services operated by third parties (such as Paddle’s checkout). These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control and are not responsible for the actions of third-party websites or services, and we encourage you to read their privacy policies.

We apply technical and organizational safeguards designed to protect the personal information we collect, including encryption in transit and at rest, access controls, and isolation between organizations through row-level security. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.

We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country. Where data is transferred out of the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

The Service is not intended for use by anyone under 18 years of age, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child without the consent required by law, we will delete it as required by applicable law.

This section applies to residents of U.S. states whose comprehensive privacy laws grant the rights described below (collectively, the “State Privacy Laws”). Not all rights are afforded by every state, and we may decline a request where permitted by law. For purposes of this section, “Personal Information” and “Sensitive Personal Information” have the meanings given in the applicable State Privacy Laws.

Your privacy rights:

• Information and access — you can request the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with which we share it.
• Correction — you can ask us to correct inaccurate Personal Information.
• Deletion — you can ask us to delete the Personal Information we have collected from you. You can also delete your account and cloud data yourself from the account menu.
• Portability — you can request a copy of your Personal Information in a portable format. Guest data can be exported as JSON at any time from Settings → Local data.
• Appeal — you can appeal our denial of any request validly submitted by replying to our decision email.

Opt-outs:

• Targeted advertising — we do not process your Personal Information for targeted advertising purposes.
• Sale or sharing — we do not sell your Personal Information, and we do not share it for cross-context behavioral advertising, as those terms are defined by State Privacy Laws. Because we do not engage in these practices, no opt-out is required; we nonetheless treat a Global Privacy Control (GPC) signal as a valid opt-out request where applicable law requires it.
• Profiling — we do not use your Personal Information for profiling or automated decision-making that produces legal or similarly significant effects.
• Sensitive Personal Information — we do not intentionally collect or process Sensitive Personal Information, and we do not process it to infer characteristics about you.

Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws.

Exercising your rights. You may submit requests to exercise any of these rights by emailing [email protected]. We may need to verify your identity (and residency) before processing a request, and we may be unable to process requests we cannot verify. Under some State Privacy Laws you may use an authorized agent; we may require proof of the agent’s authority and verification of your identity before acting on an agent’s request.

Our practices. The statements in this Notice describe our practices currently and during the 12 months preceding the “Last reviewed” date above. We collect the categories of Personal Information described in “Personal information we collect” from you directly and from automatic operational logs, use them for the purposes described in “How we use your personal information”, and disclose them for business purposes only to the categories of recipients described in “How we share your personal information”. We have not sold or shared Personal Information for monetary or other valuable consideration. We do not attempt to reidentify de-identified information, except to test whether our de-identification processes comply with applicable law.

California “Shine the Light” law. Under California Civil Code Section 1798.83, California residents may request the names of third parties to which we disclosed certain personal information for their own direct marketing purposes during the preceding calendar year. We do not make such disclosures; to submit a request anyway, email [email protected] with the subject “Shine the Light Request”, your name, mailing address, and a certification that you are a California resident.

Nevada. Nevada residents have the right to opt out of the sale of certain personal information for monetary consideration. We do not currently engage in such sales; to register an opt-out against any potential future sale, email [email protected].

We reserve the right to modify this Privacy Notice at any time. If we make material changes, we will notify you by updating the date of this Notice and posting it on the Service or by other appropriate means. Modifications are effective upon posting (or as otherwise indicated at the time of posting), and your use of the Service after the effective date indicates your acknowledgment of the modified Notice.

If you have questions about our practices, or would like to exercise any privacy-related right available to you, email [email protected]. See also our Terms of Use, Refund Policy, and Disclaimer.

This notice describes our practices — it is not a marketing promise or a warranty.