Privacy Policy

1. Introduction

This Privacy Policy describes how FlexChain Holdings LLC ("FlexChain", "we", "us", or "our") collects, uses, processes, and discloses information obtained about our customers ("Customer", "you", or "your") through your use of FlexChain's website, platform, systems, and related software, tools, and features (collectively, the "Services"). This Privacy Policy also applies to visitors to flexchain.holdings, to individuals who contact us or request a demonstration, and to business contacts with whom FlexChain corresponds, whether or not they are Customers.

"Personally Identifiable Information" ("PII") means data that may be used, alone or in combination, to identify, contact, or locate you, end users, customers, or other individuals who engage with the Services. This Privacy Policy does not extend to third-party vendors, third-party carriers, or third-party applications or software integrated with the Services ("Third-Party Services"), or to their products, services, or applications.

This Privacy Policy is incorporated by reference into, and forms part of, FlexChain's Master Terms of Service (the "Agreement"). If there is any conflict between this Privacy Policy and the Agreement regarding the collection, use, storage, transfer, or disclosure of Customer Data or other personal information, the Agreement governs. Where a Customer has executed a Data Processing Addendum with FlexChain, that addendum governs the processing of personal information contained in Customer Data and controls over this Privacy Policy and the Agreement to the extent of any conflict.

By using or accessing any of the Services, you acknowledge the terms of this Privacy Policy and consent to the collection, use, and disclosure of your information as described below. If you do not agree to this Privacy Policy, please do not use or access the Services.

2. Platform and Services

FlexChain's proprietary logistics optimization platform analyzes Customers' shipping data, recommends consolidation, routing, carrier, service, and packing options, and can execute approved shipments through integrated third-party carriers and a freight brokerage partner. It is built on a multi-tenant architecture (the "Platform") and is supported by the sub-processors described in Section 5. The Platform's optimization recommendations are intended to assist Customers with their shipping decisions and execution. Through the Platform, we receive, process, and store information provided to us, including information received or recorded when users engage with the Services, use the Platform, or interact with third-party vendors or service providers.

3. Data Collection

When a Customer provides business data to FlexChain, whether by uploading it to the Platform or by sharing it in connection with an advisory, sourcing, or representation engagement, that data may include shipping, order, product, supplier, cost, and financial information, as well as personal information relating to the Customer's own customers, employees, or suppliers, including names, delivery addresses, telephone numbers, and email addresses.

With respect to that data, the Customer remains the party responsible for determining the purposes and means of processing (the "Controller"), and FlexChain processes the data solely on the Customer's documented instructions to provide the agreed Services. We do not use recipient personal information for marketing purposes or sell it, and we do not disclose it except to sub-processors as necessary to provide the Services. Individuals with questions about personal information processed on behalf of a FlexChain Customer should direct their inquiries to that Customer.

As part of your use of the Services, we collect and process the following categories of PII and other personal information ("Collected Data"):

• Account information: name, email address, phone number, company, role, billing address, and login identifiers. Passwords are held by our authentication provider, Auth0, and are not stored by FlexChain. If you sign in through a third-party identity provider, we receive your name, email address, and a provider identifier from that provider.
• Shipment information: sender and recipient names, addresses, and contact details; package and pallet weights, dimensions, and contents descriptions; declared values; order, shipment, and tracking reference numbers; and carrier tracking events, including delivery confirmations.
• Routing information: origin and destination addresses and postal codes, postal-code-level coordinates, hub locations, equipment types, and planned load sequences. FlexChain does not collect real-time location, geofence, vehicle, or driver data.
• Transactional data: billing contact, billing address, transaction history, and credit balances. Payment card details are collected and held by our payment processor, Stripe; FlexChain does not store full card numbers.
• Usage data: device and browser information, IP address, pages and features used, and diagnostic data.
• Website and contact information: information you submit through our website forms (name, email address, company, phone number, role, shipping volume, and message) and information about how you interact with our website and emails.
• Information from other sources: business contact information (name, title, company, business email address, and business phone number) obtained from publicly available sources and third-party business-data providers, which we use for business-to-business outreach.

For the purposes of this Privacy Policy, Collected Data constitutes "Customer Data" as defined in the Agreement. FlexChain's rights to retain, use, and process Collected Data, including in de-identified or aggregated form as described in Section 9, are governed by the Customer Data license in Section 6.V of the Agreement.

4. Purpose of Data Collection

We collect PII and other personal data to:

• Enable users to create and administer FlexChain accounts and to access and use the Platform and Services.
• Provide customer service and technical support.
• Personalize and improve user experiences.
• Analyze shipping data and recommend consolidation, routing, carrier, service, and packing options.
• Execute shipments the Customer approves, including parcel rate shopping, label generation, address validation, shipment tracking, and freight tendering through our freight brokerage partner.
• Improve, maintain, and enhance the Platform and Services, including through analytics, troubleshooting, system upgrades, and the development of machine learning models, artificial intelligence, and derivative products, which may use Collected Data in de-identified or aggregated form as described in Section 9.
• Conduct business-to-business marketing and outreach, subject to your right to opt out.
• Respond to inquiries, address complaints, and administer claims and dispute resolution processes.
• Comply with applicable legal, regulatory, and internal recordkeeping and retention obligations.
• Detect, investigate, prevent, and remediate fraud, security incidents, violations of carrier terms or other agreements, unlawful activity, and conduct that may harm our Customers, the Platform, our affiliates, or third parties.

5. Disclosure of Information

To provide our Services, we may disclose personal data to the following categories of recipients:

• Affiliates and subsidiaries: we may share Collected Data with our affiliates and subsidiaries for purposes consistent with this Privacy Policy. All such affiliates and subsidiaries are required to handle Collected Data in accordance with this Privacy Policy and applicable law.
• Third-party vendors and service providers: we may disclose Collected Data to third-party vendors, consultants, and service providers that perform services on our behalf, including hosting, security, analytics, payment processing, communications, and customer support, solely as necessary to provide, operate, and improve the Services and to support our business operations, and subject to appropriate contractual confidentiality and data protection obligations.
• Consolidation network: as described in Section 16 of the Agreement, other Customers participating in a co-loaded shipment plan may see the lane, hub, equipment, and volume attributes of that plan, but never a Customer's identity, products, consignees, or pricing. Customers may opt out per brand in the Platform.
• Enforcement: we may disclose Collected Data as necessary to enforce or apply the Agreement, this Privacy Policy, or other agreements; to protect the rights, property, or safety of FlexChain, our Customers, or others; and to respond to lawful requests or legal process.
• Corporate transactions: we may disclose Collected Data in connection with, or during negotiations of, any proposed or actual corporate transaction, including a merger, acquisition, financing, reorganization, dissolution, bankruptcy, transfer, divestiture, or sale of all or a portion of our business or assets, including to prospective or actual purchasers, successors, or other relevant counterparties and their advisors, subject to customary confidentiality protections.

We use third-party providers to host, secure, and deliver the Platform, including Microsoft Azure, Auth0, Stripe, EasyPost, SendGrid, Sentry, PostHog, Mapbox, and our freight brokerage partner. The current list, what each processes, and where, is published on our sub-processors page. Customer Data is stored and processed in the United States, except that carriers transporting a shipment process label data in the destination country. We update the sub-processor list at least thirty (30) days before a new sub-processor begins processing Customer Data. Each sub-processor is selected for its industry-standard security practices and certifications and is bound by contractual confidentiality and data-protection obligations. For our website and business operations we also use service providers such as HubSpot (customer relationship management and website analytics), Google, and Meta, as described in Section 11.

6. Your Rights

Depending on where you live, you may have the following rights with respect to PII, Collected Data, or other personal data provided to FlexChain in connection with the Services.

• Access and information: you may request information about FlexChain's processing of your personal data, including the categories of personal information we collect, the sources from which we collect it, the business or commercial purposes for which we collect and use it, and the categories of third parties with whom we disclose it, and you may request a copy of the personal data we hold about you.
• Correction: you may request that we correct inaccurate personal information we maintain about you, subject to applicable exceptions. We will use commercially reasonable efforts to correct information that is factually inaccurate, after verifying your identity and considering the nature of the information and the purposes for which it is processed.
• Deletion: you may request deletion of your personal information, subject to applicable exceptions. Approved deletion requests are completed within 30 days.
• Opt out of sale or sharing: FlexChain does not sell personal information. See Section 7 and Section 11 for how to opt out of advertising analytics on our website.
• Marketing communications: you may opt out of marketing communications from us at any time by using the unsubscribe link in the footer of each such email, or by emailing [email protected]. We may continue to send essential non-marketing communications relating to your account, security, or transactions.

Residents of other jurisdictions may have additional rights under applicable law. To exercise any of these rights, contact us as described in Section 14.

7. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, "CCPA/CPRA"), gives you specific rights with respect to your personal information. You may have the right to know what personal information we hold about you, to request a copy, to correct it, to delete it, and to opt out of the sale or sharing of personal information. FlexChain does not sell personal information. Our marketing website uses Google Analytics, Google Tag Manager, the Meta Pixel, and HubSpot for analytics and advertising purposes; you can opt out through your browser settings, the Google Analytics opt-out add-on, and Meta's ad preferences, as described in Section 11. To exercise these rights, email [email protected] from the address associated with your account, or call (302) 209-1011. We will verify your identity and respond within 45 days, extendable once as permitted by law. We will not discriminate against you for exercising these rights. You may designate an authorized agent to make a request on your behalf.

In the prior twelve (12) months, FlexChain has collected the following categories of personal information as defined under the CCPA/CPRA:

• Identifiers: name, email address, username, Internet Protocol (IP) address, postal address, telephone number, and other digital identifiers.
• Account information: login identifiers, billing addresses, and account security data.
• Commercial information: transaction history, billing details, and shipment records.
• Professional information: job title and company.
• Geolocation data: business addresses and postal-code-level coordinates used for shipment planning. FlexChain does not collect precise geolocation of individuals or other sensitive personal information.
• Internet or other electronic network activity information: device information, browser type and language, operating system details, and diagnostic or usage data.

8. Data Location and Transfers

FlexChain stores and hosts Customer Data in Microsoft Azure data centers located in the United States and does not transfer Customer Data for storage outside the United States. FlexChain personnel and contractors, and our sub-processors, may access Customer Data from other locations solely to provide, support, secure, and operate the Services, subject to the safeguards described in Section 10. Any additional restriction a Customer requires must be agreed in writing.

9. Data Retention

FlexChain retains personal information, PII, and Collected Data for no longer than is reasonably necessary to fulfill the purposes described in Section 4 for which it was collected, unless a longer retention period is required or permitted by applicable law, regulation, or judicial or governmental order, which may extend beyond the end of our relationship with you. On a Customer's written request, FlexChain will promptly destroy such personal information, PII, and Collected Data, consistent with Section 6.IV of the Agreement, except to the extent retention is required or permitted by applicable law, regulation, or judicial or governmental order. If you request deletion of your information, certain personal data may be retained to the extent necessary to comply with legal obligations, resolve disputes, enforce our agreements, or address technical limitations.

Aggregation and de-identification are core components of our data minimization approach. To the extent permitted by applicable law, PII, Collected Data, and other personal data processed for purposes such as improving the Services, analytics, research, and AI model development are processed only in aggregated and/or de-identified form.

Account and billing records are retained for as long as your account is active and afterward as required for tax and audit purposes. Data provided before an engagement begins is handled under the terms of the applicable non-disclosure agreement.

10. Security

We take the security of your PII, personal information, and Collected Data seriously and maintain technical, administrative, and physical safeguards designed to prevent unauthorized access, use, disclosure, alteration, loss, or destruction. These measures include the following.

10.1 Encryption. All data transmitted between your device and the Platform is protected using Transport Layer Security (TLS) 1.2 or higher. Data at rest is encrypted using Azure SQL Transparent Data Encryption and Azure Storage encryption (AES-256).

10.2 Access controls. The Platform has three application roles (brand administrator, client administrator, platform administrator) with least-privilege permissions. Customer administrators control their own users and can revoke access at any time. FlexChain access to a Customer account is limited to authorized personnel and is visibly flagged in the interface while active. Authentication is delegated to Auth0; multi-factor authentication is supported for all users and we encourage you to enable it. As a standard practice, FlexChain enables multi-factor authentication on its own administrative accounts where the provider supports it. FlexChain personnel and contractors with access to Customer Data are bound by confidentiality obligations, are granted least-privilege access, and have access removed on departure. Sub-processors are engaged as described in Section 5.

10.3 Infrastructure and tenant isolation. The Platform is hosted on Microsoft Azure in United States regions. Microsoft maintains its own independent security certifications for Azure data centers, and FlexChain relies on Azure's physical, network, and platform security controls. The Platform is multi-tenant; isolation is enforced by authenticating every request and resolving its tenant scope server-side, by setting a tenant context on every database connection, and by Azure SQL row-level security policies that filter every read and write to that scope. Cross-tenant visibility exists only for the consolidation network attributes described in Section 5.

10.4 Operational measures. Secrets such as API keys and connection strings are stored in environment configuration and never in source code. Changes to the Platform and its database are made through reviewed migration scripts and an automated build pipeline with lint, type-check, and build gates. Azure automated backups with point-in-time restore are enabled. Application errors are captured by Sentry and infrastructure logs by Azure Monitor. We collect and retain only the personal information reasonably necessary for the purposes described in Section 4.

10.5 Incident response. FlexChain maintains incident response procedures to contain, assess, and remediate unauthorized access to or disclosure of personal information. If we become aware of a security breach affecting personal information we process for a Customer, we will notify the affected Customer without undue delay and within 72 hours of confirming the breach, and will provide the information needed for the Customer to meet its own notification obligations. Where FlexChain is itself required by law to notify individuals or regulators, it will do so within the timeframes prescribed by law. If you believe your account or personal information has been compromised, contact [email protected].

10.6 Limitations. While we implement the safeguards described above, no method of transmission over the Internet, and no security controls or procedures applicable to Internet-based communications or electronic storage, can be guaranteed to be completely secure. FlexChain cannot and does not warrant the absolute security of your PII or other personal information. Our obligations under this Section are limited to the implementation and maintenance of the security measures expressly described in this Privacy Policy, and nothing in this Privacy Policy is a guarantee or warranty of absolute security.

11. Cookies and Analytics

Essential cookies. The Platform (app.flexchain.holdings) uses cookies to keep you signed in and to record when FlexChain support personnel are accessing an account. Your display preferences are stored in your browser. These are required to provide the Services and cannot be disabled.

Website analytics and advertising. Our website (flexchain.holdings) uses Google Tag Manager, Google Analytics, the Meta Pixel, and HubSpot to measure traffic, advertising performance, and website engagement, and to associate website activity with a business contact who has submitted a form to us. These tools set cookies and may share your IP address and browsing activity with Google, Meta, and HubSpot. You can opt out through your browser settings, the Google Analytics opt-out add-on, and Meta's ad preferences.

Platform analytics. The Platform uses PostHog for product analytics and Sentry for error monitoring; these do not serve advertising.

12. Minors

The Services are offered solely for business use by Customers and their authorized users and are not intended for, directed to, or designed for use by any individual under eighteen (18) years of age. Customers will not permit any person under eighteen (18) to access or use the Services. FlexChain does not knowingly collect personal information directly from minors through the Services. If we become aware that we have collected personal information directly from a minor, we will take commercially reasonable steps to delete it.

13. Updates

We may revise this Privacy Policy from time to time to reflect changes in applicable legal, commercial, or regulatory requirements. Notice of revisions, including their effective date, will be provided in accordance with applicable law. The effective date of the current version appears at the top of this Privacy Policy.

14. Contact

Privacy inquiries: [email protected]. Postal: FlexChain Holdings LLC, 3 Germay Drive, Unit 4 #1423, Wilmington, DE 19804.