This Privacy and Cookie Policy ("Policy") explains how Ambry collects, uses, discloses, retains and safeguards personal information in connection with its business-to-business logistics technology marketplace, websites, web application and enabled related services (the "Platform"). This Policy is a privacy notice, not a contract, a blanket consent to optional processing, or a waiver of statutory privacy rights. Capitalized Platform terms have the meanings given in the Platform Terms where relevant.An individual User may create a personal account through an enabled Google or other third-party sign-in method or direct email registration before creating or joining an Organization. Such a personal account permits only limited authentication, security and Organization setup functions; it does not provide marketplace, Organization data, Service, Request, Order, messaging or payment access without an eligible Organization association and the applicable permissions and verification. The applicable access rules appear in Platform Terms Sections 3.1 and 3.5, User Account Terms Sections 2 and 7, and the End User License Agreement Sections 1 and 7.Personal information may also be contained in Organization verification records, Services, Requests, Orders, transportation documents, communications and payment-related records, including information about representatives, drivers, signatories, employees, beneficial owners and pickup or delivery contacts. Where Ambry processes personal information strictly on an Organization’s behalf under a separately executed Data Processing Agreement (DPA), that agreement and lawful instructions govern its covered processing. Each party’s legal privacy role depends on its actual activities and applicable law, not merely contractual labels.

Ambry’s Privacy Officer is responsible for overseeing the protection of personal information held by Ambry and handling privacy requests. Contact privacy@ambry.io or write to Ambry Inc., Attention: Privacy Officer, at the address above.

3.1 Personal User account and sign-in. A valid email address and an enabled authentication method are required for initial personal registration. Direct email sign-in may involve password or email-verification records; third-party sign-in, including Google when enabled, may involve an email address, provider identifiers, authentication tokens and any profile attributes actually made available by that provider and used for sign-in. Ambry does not require a personal name, home address, date of birth, personal phone number, government ID, driver’s licence, business registration or insurance certificate solely to open the preliminary personal account. We may collect personal settings, account recovery and security information, login records and evidence of affirmative acceptance of the Platform Terms, User Account Terms and EULA, including document versions or hashes, account identifiers, timestamps and acceptance actions. Acknowledging this Policy does not constitute consent to optional marketing or non-essential tracking.
3.2 Organization and verification. When an Organization registers or is reviewed, we may process its legal name, business address, registration and tax identifiers, transportation operating-authority numbers (such as USDOT, MC, NSC or CVOR where applicable), insurance certificates, permitted contact information, authorized-user roles and permissions, and documents reasonably needed to assess business eligibility, authority or insurance. Documents may incidentally contain personal information about representatives, beneficial owners, drivers or signatories. Insurance information may include coverage type, insurer, policy dates, limits, currency, exclusions and supporting records. These checks are administrative risk screening, not a guarantee that a specific policy or shipment is covered. Stripe may separately collect identity, ownership, tax and banking information for its own connected-account onboarding under its own notices.
3.3 Marketplace, shipment and communication records. For authorized Organizations, we may process Services, Requests, selected booking details, confirmed Orders, rates and charges, route and equipment information, pickup and delivery addresses, shipment descriptions, operational messages, attachments, bills of lading, Proof of Pickup, Proof of Delivery, signatures, photographs and timestamps. These records may identify drivers, warehouse staff, dispatchers, consignee contacts and other individuals. A Request alone is not an Order; the Customer must affirmatively confirm the booking and the selected Provider must affirmatively accept it. None of these records is required merely to create an unassociated personal User account.
3.4 Payments and Stripe. For enabled payment flows, Ambry uses Stripe Connect Express and receives information needed to administer charges, refunds, transfers, disputes and reconciliation, such as transaction identifiers, payment-method type, masked details where available, payment status, connected-account eligibility and transfer status. Ambry does not ask for full card numbers or Provider bank login credentials in the personal account registration process, and it does not configure a Provider’s Stripe-connected bank account or bank-payout schedule. Data supplied directly to Stripe is governed by Stripe’s applicable notices and agreements. The Platform Terms describe Ambry’s payment-administration role.
3.5 Technical, usage and security records. Depending on the features deployed, we may process IP addresses, approximate IP-derived location, device and browser information, session and authentication identifiers, access-control and Organization permission events, timestamps, email-verification and login records, diagnostic reports, fraud indicators, error logs, and electronic acceptance evidence. These records support account security, incident investigation, troubleshooting, system integrity, lawful audit and compliance.
3.6 External and public sources. Where relevant and lawful, we may receive information from corporate and transportation registries (including U.S. and Canadian registries), sanctions and compliance lists, insurance or authority-verification sources, identity providers and Stripe. We use such information only for legitimate Platform and legal purposes.
3.7 Location and mapping. The described Platform does not continuously track Users’ or drivers’ device GPS locations. Shipment pickup and delivery addresses, address or map searches, document metadata, photographs, and approximate IP-derived location may nevertheless contain location-related information. Where an enabled map or address-lookup feature uses Google Maps or another mapping provider, the relevant address or query, and technical information such as IP address, may be transmitted to that provider to deliver the requested function, subject to its applicable notices. Any materially different live-location or tracking feature will require updated disclosures and any legally required consent before deployment.

We use information as reasonably necessary to create and secure personal accounts; record affirmative acceptance of account agreements; manage eligible Organization associations and permissions; verify business identity, authority and insurance eligibility; prevent fraud, account misuse, unauthorized double brokering, sanctions violations and other unlawful activity; publish Services and process authorized Requests, bookings and confirmed Orders; facilitate relevant communications, payments, refunds and transfers; handle support, payment disputes and security incidents; meet tax, accounting, regulatory and recordkeeping obligations; establish or defend legal claims; and maintain, secure, troubleshoot and improve the Platform.Depending on the jurisdiction and processing activity, the lawful basis may be performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests where permitted and appropriately balanced, or consent where required. We do not treat acceptance of the Platform Terms, User Account Terms or EULA as blanket consent to unrelated personal-data processing. We do not use personal information for materially incompatible new purposes without legally required notice or consent.Ambry may produce and commercialize appropriately aggregated or de-identified logistics statistics and market insights as described in Platform Terms Section 10.4, but will apply safeguards appropriate to prevent reasonable identification of individuals, specific Organizations or Orders, or disclosure of non-public rates, negotiated terms, shipment details or Confidential Information. Such use remains subject to privacy, confidentiality and competition laws and any applicable executed DPA. We do not sell identifiable personal information as a market-intelligence product.

This Policy provides notice of our practices. Merely displaying or acknowledging it does not constitute contractual acceptance or universal consent. Where law requires consent, we seek it from the appropriate individual in the required form; where another lawful basis is available, we may rely on that basis. Optional marketing consent and legally required non-essential cookie consent are separate from acceptance of account agreements. Individuals may withdraw consent where legally available, without affecting processing independently required or permitted by law.An Organization or User that submits personal information about drivers, employees, representatives, consignee contacts or other people is responsible for providing any legally required notices and obtaining any necessary authority or consent for that submission. A User’s own registration does not constitute consent on behalf of those individuals. Ambry remains responsible for its own legal privacy obligations.

Where verification or screening is performed, Ambry may review information supplied by an Organization and reasonably available supporting records under its applicable operational procedures. Any such review, validation or displayed status is an administrative risk-screening measure only; it does not certify an Organization’s authority, insurance coverage, legal compliance or ability to perform a Service.

7.1 We disclose information only as reasonably necessary for the purposes described above, to appropriate recipients such as:

·      Authorized Users of the relevant Organization and, where needed for an authorized Request or confirmed
      Order, the selected Customer, Provider and their authorized personnel, subject to role-based access and     
       applicable restrictions.
·      Stripe and its applicable affiliates for enabled payment processing, connected-account status, refunds,
        transfers, payment disputes and fraud screening.
·      Service providers for AWS-hosted infrastructure, enabled authentication, email delivery, customer
       support, security, verification, analytics where enabled, and mapping (including Google Maps where
        used), subject to appropriate contractual and technical safeguards.
·      Professional advisers, auditors, insurers and other recipients with a legitimate need and appropriate
        confidentiality obligations.
·      Regulators, law enforcement, courts or other authorities where legally required or otherwise lawfully
        necessary to protect rights, safety or Platform security.
·      A prospective buyer, investor or successor in a financing, merger, reorganization or sale of business assets,
        subject to appropriate confidentiality and lawful transfer requirements.

7.2 We do not sell personal information or share it for cross-context behavioural advertising. We do not authorize counterparties to harvest, sell or use Platform-derived non-public contacts for unsolicited marketing, bulk extraction or purposes unrelated to the relevant business interaction. Lawful independent relationships and independently obtained information remain subject to applicable law and Platform Terms Sections 6.3, 11 and 12.
7.3 Organization administrators control which of their Users are authorized to access Organization data. When an individual is removed from an Organization, their access to that Organization’s records must end through the available access controls; their personal account may continue for limited setup purposes or for another separately authorized Organization. This does not necessarily delete historical records, messages, Order evidence or information lawfully retained for compliance or disputes. Ambry is responsible for its own applicable security and access-control duties; Organizations are responsible for timely permission management as described in the User Account Terms.

Ambry uses third-party infrastructure, including AWS hosting, and may process personal information in the United States, Canada or other countries where Ambry or its service providers lawfully operate. We do not identify a particular AWS hosting region in this Policy. A cross-border transfer may expose information to lawful access by authorities in the receiving jurisdiction. Where required, we conduct applicable assessments and implement reasonable contractual, technical and organizational safeguards before disclosing or transferring information outside the relevant jurisdiction. Any separately executed DPA applies only within its agreed scope. Contact privacy@ambry.io for information about applicable processing locations and safeguards, subject to security and legal restrictions.

9.1 Essential cookies. The main public website currently sets no cookies. The authenticated Platform uses “ambry_session” (Firebase session authentication; HttpOnly, Secure and SameSite protections; configurable lifetime up to fourteen (14) days; deleted on logout) and “ambry_csrf” (double-submit CSRF protection; retained for the session). Blocking them may prevent login.
9.2 Session technologies and authentication. The Platform uses sessionStorage for temporary interface state, reference caches (including metadata and taxes), and page-reload handling; entries last until the browser tab closes and are cleared on logout. Firebase authentication tokens are kept in IndexedDB until logout. Neither is used for advertising or behavioural profiling.
9.3 Payments and third-party functions. At checkout, Stripe may use “__stripe_mid” (approximately one (1) year) and “__stripe_sid” (approximately thirty (30) minutes) to prevent payment fraud. Google sign-in and address autocomplete may use cookies on Google-controlled domains under Google’s notices, not as first-party Ambry cookies.
9.4 Error monitoring, analytics and optional tracking. The authenticated Platform does not use Google Analytics, Google Tag Manager, Facebook/Meta Pixel, Hotjar, advertising cookies or behavioural trackers. Grafana Faro monitors frontend errors, not user behaviour; it uses no cookies, keeps a monitoring session identifier (“com.grafana.faro.session”) in sessionStorage until the tab closes, and receives no User IDs. Separate landing pages may use analytics; any non-essential tracking there is subject to applicable notice and consent or refusal requirements. Accepting the Terms is not consent to optional tracking.
9.5 Cookie choices and updates. Users can manage cookies through browser settings and any available consent controls. Blocking essential cookies may affect login and payment security. For current names, providers, purposes and retention periods, contact privacy@ambry.io. Ambry updates disclosures and controls when deployed technologies change materially.

We keep personal information for no longer than reasonably necessary for the purposes described above, subject to applicable tax, accounting, transport, security, litigation-preservation and other legal requirements. The following periods are indicative operational targets rather than a guarantee of automatic deletion on a particular day:
·  Personal User accounts, acceptance evidence and Organization verification records: generally while the relevant account or Organization relationship remains active, and ordinarily up to three (3) years after closure when reasonably needed for security, contractual evidence or disputes, subject to longer legally required retention.
·   Requests, Orders, payment, tax and related transaction records: ordinarily up to seven (7) years after the end of the relevant fiscal year where needed for accounting, tax, compliance or dispute purposes, subject to applicable law.
·   Routine technical and security logs: ordinarily up to twelve (12) months, unless a longer period is reasonably needed for an investigation, legal hold or other lawful purpose. Removing a User from an Organization does not automatically delete the User’s personal account, historical Order records or another Organization’s records. Where lawful and appropriate, we delete, securely destroy or anonymize information after the applicable retention period. Data subject to a valid legal hold or mandatory retention obligation may be preserved for longer. Applicable shorter or longer statutory periods prevail.

Ambry uses administrative, technical and organizational measures appropriate to the sensitivity of information and the Platform’s risk profile, including access restrictions, authentication controls and security logging as deployed. No system or transmission is guaranteed to be perfectly secure. We assess suspected incidents, take reasonable containment and remediation measures, maintain required records and notify affected individuals, Organizations or regulators when legally required. Organization incident-cooperation duties are described in Platform Terms Section 12.5. Report suspected privacy incidents to privacy@ambry.io or support@ambry.io; account compromise should also be reported promptly as described in User Account Terms Section 4.2.

12.1 Subject to the law applicable to you and the information concerned, you may have rights to obtain information about processing, access and correct personal information, withdraw consent where relevant, request deletion or cessation of certain uses, object to certain processing, or obtain a copy in an available structured technological format where a statutory portability right applies. Some rights are subject to identity verification, legal exceptions, confidentiality of others’ information and mandatory retention.
12.2 Send requests to privacy@ambry.io. We may request information reasonably necessary to verify your identity and authority before disclosing personal information. We will respond within thirty (30) days where that period applies, or within the period required by the applicable law, subject to lawful extensions and exceptions. Where we process information solely on an Organization’s instructions, we may coordinate the request with that Organization as legally appropriate without restricting an individual’s direct statutory rights.
12.3 If Ambry later introduces a process involving decisions based exclusively on automated processing, it will provide any notice, explanation, opportunity to submit observations or other rights required by applicable Québec law. Québec residents may also have applicable rights concerning access, correction, data portability and withdrawal of consent. Residents of other Canadian provinces or U.S. states may have additional applicable rights, including appeal or opt-out rights where the relevant statute applies. We will not unlawfully discriminate against individuals for exercising protected rights.
12.4 You may raise concerns with Ambry’s Privacy Officer and, where applicable, submit a complaint to the competent privacy or data protection authority in your jurisdiction, in accordance with applicable law.

The Platform is intended for business use by Organizations and authorized adult Users. An individual must have reached the age of majority where they reside to create a User account under the User Account Terms. We do not knowingly solicit personal account registrations from minors. Information about a minor may nevertheless appear incidentally in a lawful business record; any such information remains subject to applicable privacy protections.

We may revise this Policy to reflect changes in law, processing activities, third-party services or Platform features. We will provide notice of material changes before they take effect where required by applicable law, and obtain separate consent for new processing or non-essential tracking where legally required. The effective date and last-updated date appear above. Updating this notice does not, by itself, amend the Platform Terms or replace any required affirmative acceptance of a contractual change.

Privacy questions, access or correction requests, withdrawal of consent, cookie questions and incident reports may be directed to privacy@ambry.io.
Postal correspondence: Ambry Inc., Attention: Privacy Officer, 251 Little Falls Drive, Wilmington, DE 19808, United States. General support: support@ambry.io.