Privacy Policy — Aulintri

Section 01

Overview

Aulintri LLC ("Aulintri," "we," "us," or "our") operates Aulintri, a logistics intelligence SaaS platform, and AI SDR by Aulintri, an outbound sales product. Aulintri LLC is a subsidiary of Maventi Group, LLC. This Privacy Policy applies to aulintri.com, the Aulintri platform, and AI SDR.

By accessing or using any Aulintri service, you agree to the collection and use of your information as described in this policy. If you do not agree, you must stop using our services and contact us to deactivate your account.

Note on customs data: Customs data in the platform — including importer of record information, HTS classifications, and declared values — may be subject to CBP record-keeping requirements under 19 CFR Part 163. Those obligations belong to the importer and its customs broker; Aulintri processes this data on their behalf and handles deletion of it on the customer's instruction (see Sections 4 and 9).

Section 02

Our Role

How this policy applies depends on whose data it is:

Data about our customersFor account, contact, billing, and platform usage information about the organizations that subscribe to Aulintri and their users, Aulintri LLC is the data controller.
Data our customers put in the platformFor Customer Data — shipment, customs, document, and financial records that a customer and its users submit to their Workspace, including information about that customer's own clients — the customer is the controller and Aulintri LLC processes the data on the customer's behalf and under its instructions. If you are a client of one of our customers, that business's privacy policy governs how it uses your information; please contact them first.
Google user dataData received through a mailbox connected to AI SDR is governed by Section 5.

Licensed customs brokers and freight forwarders that use Aulintri are independent customers of Aulintri. They provide their regulated services to their own clients under their own terms and privacy policies.

Section 03

Data We Collect

Account and Contact Information

When your organization subscribes to Aulintri or you are invited as a user, we collect: name, email address, company name, job title, phone number, billing address, and your role type (importer, customs broker, freight forwarder, or 3PL). This information is used to create and manage your account and deliver the Services.

Shipment and Freight Data

When customers use the platform to manage freight, it processes shipment-specific data on their behalf, including: origin and destination details, container numbers, vessel and voyage information, cargo descriptions, weight and dimensions, Incoterms, and carrier booking confirmations. This data is tied to specific shipment records in the customer's Workspace and is exchanged with carriers and terminals only as the customer's use of booking and tracking features requires.

Platform Usage Data

We collect information about how you interact with the Aulintri platform: pages visited, features used, time spent, search queries, error events, and device and browser information including IP address. This data is used to improve platform performance and detect issues.

Payment and Financial Information

We collect the billing information needed to invoice our customers for platform subscriptions and usage. Aulintri does not store payment card numbers. Invoice, payment, and duty records that customers create in the platform for their own clients are Customer Data, processed on the customer's behalf.

Connected Email Mailbox Data

If you connect a Gmail or Google Workspace mailbox to AI SDR by Aulintri, we receive an OAuth credential for that mailbox and, from it, the reply and delivery data needed to send your outbound sequences and thread inbound replies. This category carries commitments that differ from the rest of this policy and is covered separately and in full in Section 5 — Google User Data & Gmail Access.

Documents You Upload

The Aulintri platform uses AI to extract data from documents you upload, including commercial invoices, bills of lading, packing lists, certificates of origin, and arrival notices. Uploaded documents are stored in encrypted cloud storage (AWS S3) and used to pre-populate shipment and customs entry records. Document content is processed by our AI document extraction pipeline and is not used to train external AI models.

Section 04

Customs & Trade Data — Special Handling

Customs work involves data categories that carry heightened sensitivity and specific legal obligations. When customs brokers and importers use the platform to prepare and manage customs filings, it processes the following on their behalf:

Importer of Record (IOR) InformationLegal business name, EIN/taxpayer ID, CBP importer number, continuous bond information, and power of attorney documentation.
Entry Summary DataHTS classification codes, declared values, country of origin, duty calculations, and all data required for CBP Form 7501.
Government-Issued IdentifiersWhere CBP requires identity verification for the importer of record, the platform may hold driver's license, passport, or other government-issued identification numbers. This data is treated as sensitive personal information and is encrypted in transit and at rest.
ISF 10+2 DataSeller, buyer, importer of record, consignee, manufacturer, ship-to-party, country of origin, and HTS data prepared for pre-arrival ISF filings.
PGA Partner DataWhere shipments require Prior Notice to the FDA, USDA APHIS certification, or EPA compliance documentation, the platform holds the data required by each partner government agency.
Drawback and Refund ClaimsFor duty drawback filings or refund claims, the platform holds transaction records, manufacturing affidavits, and export evidence required by CBP.

Important: Customs entry records are subject to retention requirements under 19 CFR Part 163, generally five years from the date of entry. Those obligations belong to the importer and its broker. Because deleting customs records may conflict with them, we act on deletion requests for customs data on the instruction of the customer that controls the Workspace.

Section 05

Google User Data & Gmail Access

This section governs data we receive from Google APIs. It applies to AI SDR by Aulintri (ai-sdr.aulintri.com), the outbound sales product operated by Aulintri LLC, which lets a user connect their own Gmail or Google Workspace mailbox so that outbound email is sent from that mailbox and replies are threaded back into the product. Connecting a mailbox is optional, is always initiated by the user, and can be revoked by the user at any time.

Where this section and any other provision of this Privacy Policy conflict with respect to data obtained from Google APIs, this section controls.

Limited Use disclosure: Aulintri's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes We Request, and Why

We request the minimum scopes required for the product to function. Google presents these to you on its own consent screen before any access is granted:

Sign-inopenid — standard sign-in identifier. Confirms which Google account is being connected. Non-sensitive scope.
Email addresshttps://www.googleapis.com/auth/userinfo.email — reads the email address of the connecting account so we can verify it matches the mailbox you entered in AI SDR, and so the mailbox is scoped to the correct organization. Non-sensitive scope.
Send mailhttps://www.googleapis.com/auth/gmail.send — sends outbound sales email from your mailbox, using your own sending identity, so replies come back to you and your deliverability reputation stays with you. A send only occurs from a sequence or message you or a colleague in your organization authored, scheduled, or approved in AI SDR. Restricted scope.
Read mailhttps://www.googleapis.com/auth/gmail.readonly — detects replies and non-delivery reports so an inbound reply can be attributed to the correct conversation and routed to the right person on your team. Read-only: we cannot and do not modify, label, archive, or delete anything in your mailbox. Restricted scope.

We do not request gmail.modify, gmail.compose, gmail.settings, gmail.labels, or any Google Drive, Calendar, Contacts, or Chat scope. If a future feature requires an additional scope, you will be asked to re-consent before it is used.

What We Read, and What We Keep

The two are deliberately different. After you connect a mailbox, AI SDR subscribes to Gmail change notifications for that mailbox and, when notified, retrieves the newly arrived messages in order to evaluate them:

DiscardedFor each newly arrived message we examine the sender, subject, and plain-text body only long enough to determine (a) whether it is a reply to a conversation AI SDR started, and (b) whether it is a bounce or non-delivery report. A message that matches neither is discarded and never written to our database.
StoredOnly messages belonging to a conversation AI SDR initiated — matched by Gmail thread ID or by a recipient address already in your campaign — are stored. For those we retain the plain-text body with quoted reply history stripped, the sender address, the subject, the timestamp, and the Gmail and RFC-822 message identifiers needed to keep the thread intact.
Never storedWe do not download, store, or scan attachments. We do not store message bodies from unrelated threads, and we do not index, catalogue, or search your mailbox at large.
CredentialsWe store the OAuth refresh token issued by Google for the connected mailbox. It is never exposed to the browser and is used only to mint short-lived access tokens at send and read time. We never ask for, receive, or store your Google password.

How Google User Data Is Stored and Secured

Google user data is held in the same environment as the rest of your platform data, under the controls described in the Security section of this policy: transmitted only over TLS 1.2 or higher; stored in Amazon RDS (PostgreSQL) in a United States region with AES-256 encryption at rest managed through AWS KMS; access limited by role-based access control; and isolated per organization so one tenant's connected mailbox data is not reachable by another.

Retention of Google User Data

OAuth tokensDeleted immediately when you disconnect the mailbox, when you revoke access from your Google account, or when the token is revoked by Google or your Workspace administrator.
Reply contentRetained for the life of the campaign record, and deleted within thirty (30) days of a deletion request or of your account being closed.
Delivery signalsRetained in aggregate (counts and reputation metrics) for up to twelve (12) months for sending-health purposes. These aggregates contain no message content.
Operational logsNinety (90) days. These record that a send or read occurred; they do not contain message bodies.

Google user data is not subject to the customs record-keeping obligations described elsewhere in this policy. Nothing in the five-year CBP retention requirement applies to it, and a deletion request for Gmail-derived data will be honored in full.

Sharing of Google User Data

We do not sell Google user data, and we do not transfer it to any third party for that party's own purposes. It is shared only as follows:

AWSHosting, database, and storage for the application itself. United States regions. AWS acts as our processor under its Data Processing Addendum and has no independent right to the data.
Anthropic (Claude API)The plain-text body of a reply on a conversation you are working in is sent to the Claude API to classify reply intent and to draft a suggested response. This is done to deliver the feature you asked for, under an agreement that prohibits use of the content for model training.
Legal processWhere we are compelled by valid subpoena, court order, or other lawful process. We will notify you before complying to the extent the law permits.

We do not share Google user data with advertising networks, data brokers, information resellers, analytics platforms, or any credit, insurance, employment, or lending decision system. We do not use it for any form of advertising or ad targeting.

AI and Machine Learning — Our Commitments

We do not use Google user data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models, whether our own or a third party's. Gmail content is processed by a language model only in service of the specific, user-facing feature that requested it — classifying the intent of a reply in a conversation, and drafting a suggested response for that conversation — and it is not retained by that provider for training. We do not build cross-customer models, profiles, or datasets from Google user data.

Human Access to Google User Data

Aulintri personnel do not read the content of your Gmail messages except in these narrow cases: with your explicit permission, to investigate a support issue you have reported; where necessary to detect, prevent, or address a security incident, abuse, or fraud; or where required by law. Any such access is limited to the minimum data needed, is performed by named personnel under role-based controls, and is recorded in our audit log.

Revoking Access and Deleting Your Google Data

You can withdraw access at any time, by any of these routes:

In AI SDRSettings → Integrations → Disconnect on the mailbox. This revokes our grant with Google, cancels the Gmail change subscription, and deletes the stored tokens immediately. No further sends or reads are possible.
At GoogleRemove "AI SDR by Aulintri" at myaccount.google.com/permissions. Access stops as soon as Google processes the revocation.
By requestEmail info@aulintri.com asking us to disconnect the mailbox and delete all Gmail-derived data. We will confirm and complete deletion within thirty (30) days.

Revoking access stops all future access immediately. Message content already stored against a conversation is removed on request as described above, or on account closure under the retention periods in this section.

If you are a Google Workspace administrator: you can review, restrict, or revoke this application organization-wide from the Google Admin console under Security → API controls → App access control. Individual user consents in your domain are visible and reversible there.

Section 06

How We Use Your Data

We use the data we collect for the following purposes:

Service DeliveryProcessing freight quotes, booking carriers, filing customs entries through CBP ACE, generating invoices, and managing shipment lifecycle from origin to delivery.
AI-Powered FeaturesPowering document extraction (pre-populating entry fields from uploaded invoices and B/Ls), HTS classification suggestions, duty calculation, and exception detection. AI features are powered by the Claude API (Anthropic). Document content sent to the API is governed by Anthropic's data use policies and is not used for model training by default under our enterprise agreement.
Compliance ObligationsFiling ISF, entry summaries, PGA notifications, AES export filings, and other regulatory submissions with CBP and partner government agencies as required by law and as authorized by your power of attorney.
Platform ImprovementAnalyzing usage patterns to improve Aulintri's features, fix errors, and optimize performance. This analysis uses aggregated, de-identified data.
CommunicationsSending transactional emails (shipment milestones, CBP hold alerts, invoice delivery), operational notifications (system downtime, policy updates), and — if you opt in — product updates and platform news.
Billing and Financial ReconciliationGenerating customer invoices, reconciling carrier invoices, processing duty payments, and syncing with connected accounting systems (e.g., Zoho Books).

We do not sell your personal data to third parties. We do not use your data to serve advertising on third-party platforms.

Section 07

Data Sharing

We share data only in the following circumstances:

Carriers and Terminal Operators

When a customer uses booking and tracking features, the platform exchanges the necessary shipment identifiers — such as container numbers and booking references — with ocean carriers (for example Maersk, CMA CGM, MSC, and Hapag-Lloyd) and terminal operators through their published interfaces, at the customer's instruction.

Government Agencies

Aulintri LLC does not file with CBP or other government agencies on anyone's behalf. Customs filings prepared in the platform are submitted by the customer or its licensed customs broker, under that party's own authority. See Section 8 for how we respond to government requests.

Technology Subprocessors

We use the following key subprocessors to deliver the Aulintri platform:

Amazon Web Services (AWS)Cloud infrastructure, data storage (RDS, S3), email (SES), and compute. US-based data centers. AWS DPA applies.
Anthropic (Claude API)AI document extraction and classification. Data sent to the API is subject to Anthropic's enterprise data use policy. Not used for model training.
Google LLCWhere you connect your own Gmail or Google Workspace mailbox to AI SDR, outbound mail is sent through, and replies are read from, that mailbox via the Gmail API. Google is your own mail provider in that relationship rather than a subprocessor acting for us. See Section 5.
Zoho BooksAccounting and invoicing integration for connected customers. Data synced includes invoice records and payment status.

Business Transfers

If Aulintri LLC is acquired, merges with, or transfers its assets to another entity, your data may be transferred as part of that transaction. We will notify affected users prior to any such transfer and the acquiring entity will be bound by the terms of this Privacy Policy or provide equivalent protections.

Section 08

Government Requests

Aulintri LLC is a software provider, not a customs broker, and does not transmit importer data to U.S. Customs and Border Protection or partner government agencies on anyone's behalf. Customers and their licensed customs brokers make those filings under their own powers of attorney and licenses.

We do not give government agencies access to a customer's Workspace, uploaded documents, or shipment records unless we are compelled to by a lawful subpoena, court order, or other legal process. In that case we will notify the affected customer before complying, to the extent the law permits, so that it can seek to limit the request.

Section 09

Data Retention

We keep data only as long as we need it to provide the Services or as the law requires:

Customer DataShipment records, customs records, documents, and financial records in a customer's Workspace are kept for as long as that customer's subscription is active, so the customer can meet its own record-keeping obligations (for customs records, generally five years under 19 CFR Part 163). The customer decides when they are deleted.
Account and Contact DataKept while the account is active, and deleted or de-identified with the rest of the account when it closes (see below).
Platform and Security LogsApplication, network, and firewall logs are kept for ninety (90) days. Audit records of security-relevant actions are kept with the account they belong to.
BackupsDatabase backups expire automatically after thirty (30) days, so deleted data leaves our backups within 30 days of deletion.
Our Billing RecordsRecords of what we invoiced our customers and what they paid are kept for seven (7) years to satisfy tax and accounting requirements.

When a subscription ends, the customer can request an export of its data for thirty (30) days. We then delete or de-identify the Workspace's data within ninety (90) days of the end of the subscription, unless the customer asks us in writing to keep specific records longer or the law requires us to. Deletions follow a documented, reviewed procedure and are recorded.

Section 10

Security

We implement administrative, technical, and physical security measures appropriate to the sensitivity of the data we handle, including customs entry data, government-issued identifiers, and financial information.

Encryption in TransitAll data transmitted between your browser and Aulintri is encrypted using TLS 1.2 or higher, and connections between our application, database, and cache are encrypted as well.
Encryption at RestOur database, cache, document storage, and backups are encrypted at rest using AES-256.
Access ControlsRole-based access control (RBAC) limits data access within the platform. Multi-tenant architecture enforces row-level data isolation so one organization cannot access another's records.
InfrastructureHosted on AWS in the United States (us-east-1). Production runs in its own private network, separate from development, behind a web application firewall. See aulintri.com/security for details.
SOC 2 ComplianceWe operate a documented security program and are working toward a SOC 2 report, with our controls tracked continuously in Vanta.

No system is completely secure. If you discover a security vulnerability in the Aulintri platform, please report it immediately to info@aulintri.com. We will acknowledge all reports within 48 hours.

Section 11

Cookies & Tracking

We use cookies and similar technologies to operate the Aulintri platform. We do not use advertising cookies or sell cookie data to third parties.

Essential CookiesRequired for platform operation — authentication sessions, CSRF protection, and route navigation. Cannot be disabled without breaking platform functionality.
Analytics CookiesUsed to understand how the platform is used — page views, feature usage, error rates. Data is aggregated and used to improve the platform. Powered by privacy-respecting analytics. No cross-site tracking.
Preference CookiesStore your UI preferences such as table sort order and notification settings. Session-based and cleared on logout.

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging into the platform.

Section 12

Your Rights

Depending on your location, you may have the following rights with respect to your personal data:

AccessRequest a copy of the personal data we hold about you and how it is being used.
CorrectionRequest correction of inaccurate or incomplete data. Note: corrections to customs entry data that has already been filed with CBP may require a Post-Entry Amendment through regulatory channels.
DeletionRequest deletion of your personal data, subject to Section 9. If your data is held in a customer's Workspace (for example, as a client of a customs broker that uses Aulintri), we will pass your request to that customer, who decides about records it may be legally required to keep.
PortabilityRequest an export of your account information in a machine-readable format. On request, we provide a customer with an export of its Workspace data, including shipment and entry records, in a machine-readable format.
ObjectionObject to specific uses of your data, including withdrawal of consent for marketing communications at any time.

To exercise any of these rights, submit a request to info@aulintri.com. We will respond within 30 days. We may require identity verification before processing sensitive requests.

Texas residents: Texas law provides residents with rights to access, correct, delete, and obtain a portable copy of personal data. These rights are subject to exceptions including data processed pursuant to legal obligations (such as customs record-keeping requirements). Contact us at the address below to exercise your rights under the Texas Data Privacy and Security Act.

Section 13

Children

The Aulintri platform is a business-to-business service intended for use by companies and professionals engaged in international trade and logistics. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided personal information, we will delete that data promptly. If you believe a minor's data has been submitted to our platform, contact us at info@aulintri.com.

Section 14

Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data practices. We will update the "Last Updated" date at the top of this page with each revision.

For material changes — those that significantly affect how we collect or use data — we will notify active account holders by email at least 14 days before the changes take effect. Continued use of the Aulintri platform after the effective date of a revised policy constitutes acceptance of the updated terms.

We encourage you to review this policy periodically. Prior versions are available upon request.

Section 15

Contact Us

For questions about this Privacy Policy, data requests, or security concerns, contact us through any of the following:

Aulintri LLC — Privacy

Email: info@aulintri.com

Platform: info@aulintri.com

Security Reports: info@aulintri.com

Jurisdiction: Collin County / Dallas County, Texas, United States

Governing Law: Laws of the State of Texas