Privacy Policy

Effective October 16, 2026 · [company legal name]

Who we are

[company legal name] ("we") runs YourGuard. For the data customers send us to be checked, we act on the customer's behalf (as a service provider / processor); for account and billing data we are responsible ourselves. Contact: [contact email], [company address].

What we collect

• Account: from Microsoft sign-in — name, work email, and your organization's and your Microsoft IDs; your company name, its own email domains and carrier companies (name, MC number) as you enter them.
• What you send to be checked: emails (sender, headers, text, links), rate confirmations and other attachments, and what is read from them — broker, load and reference numbers, stops, rates, payment details — together with the check's result and the feedback your people give ("confirmed by phone", "fraud").
• Telegram, if you connect it: the chat's ID and title, and the Telegram name of whoever presses a button.
• Billing: handled by Stripe. We keep the Stripe customer and subscription references and the number of trucks; we never see or store card numbers.
• Security and operations: IP addresses and request logs, kept short (rotated, a few days to weeks), to keep the Service safe and working.
• One cookie, to keep you signed in to the account page (14 days). No advertising or analytics cookies, no tracking.

How we use it

• To run the checks and show you the results, in the web page, Outlook, Telegram or your integration.
• To compare a load with your own earlier loads (payment details, broker domains) — within your account only.
• For the network signal: pickup date, facility addresses and broker MC of loads across customers are compared to spot the same load offered by different brokers. No customer sees another's documents, rates, name or contacts.
• To bill you, support you, secure the Service, and meet legal obligations.

We do not sell personal information, we do not use it for advertising, and we do not use your documents to train AI models.

Who else receives data (subprocessors)

Each provider gets only what its part of the check needs:

• DigitalOcean (USA) — hosting of the servers, database and backups.
• Microsoft — sign-in. Stripe — payments. Telegram — verdict messages to the chats you connect.
• Our email provider hosts the forwarding mailbox (guard+…@): a forwarded email is deleted from it as soon as it is taken in for checking; one that cannot be matched to a customer is deleted after 30 days.
• Google Gemini — only for a scanned or photographed document with no text in it: the page images, to transcribe them, under Google's paid API terms (not used to train Google's models).
• Google Web Risk — web addresses found in emails and documents, to check them against Google's lists of dangerous sites.
• MalwareBazaar (abuse.ch) — only the SHA-256 fingerprint of each attachment, never the file.
• FMCSA and data.transportation.gov — the broker's MC, USDOT, name, email domain or phone, to look up public registration records.
• Domain registration records (RDAP) — the domain names of senders and links, to see how recently they were registered.

Our servers and backups are in the United States. Some of the providers above (for example Microsoft, Google and Telegram) may process the data they receive in other countries, under their own terms and safeguards. We may disclose data if the law requires it, and would tell you unless prohibited.

How long we keep it

• Rate confirmation files (PDFs, photos): deleted 90 days after the check. What was read from them and the result stay with your account, because later checks compare against them.
• Your account's data: kept while you subscribe; deleted entirely 90 days after the subscription is cancelled, or sooner if you ask.
• Backups: nightly copies are kept 14 days on our servers and up to 30 days in off-site storage, then expire.

Security

Data is encrypted in transit (HTTPS). Every request made on a customer's behalf is limited by the database itself (row-level security) to that customer's data, in addition to the application's own checks. Attachments are opened only in an isolated environment with no network access, and are never executed. Access is limited to the people who run the Service.

Your choices and rights

Your administrator can see and manage your account, keys, connected chats and billing. To get a copy of your data, correct it, or have it deleted, write to [contact email]; we answer within 30 days. Depending on where you live (for example, California), you may have further rights under local law, which we honor. For data a customer sent us about you, we will pass your request to that customer.

Children

The Service is for businesses and is not directed to children.

Changes

We will post changes here with a new effective date, and tell customers by email or in the Service before material changes take effect.