Privacy Policy

1. Introduction and Scope

Borderless Distribution Network, LLC, a Delaware limited liability company ("Company", "we", "us", "Jistix"), operates the Jistix platform at jistix.io. This Privacy Policy describes how we collect, use, disclose, and protect information about you when you use our Service.

This Privacy Policy applies to all users of the Jistix platform, including registered users, trial users, and visitors to our website. It is incorporated into and forms part of our Terms of Service.

By using the Jistix platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

• Full name
• Business email address
• Company name (optional)
• Operating country
• Password (stored as a secure hash — we never store plaintext passwords)

2.2 Shipment and Business Data

• Origin and destination information (ports, addresses)
• Cargo details (type, weight, dimensions, HS codes)
• Freight rates and carrier selections
• Booking references and tracking numbers
• Invoice data (parties, amounts, charge codes, payment records)

2.3 Documents

Documents you upload to the platform, including but not limited to:

• Bills of lading, air waybills, and other transport documents
• Commercial invoices, packing lists, and certificates of origin
• SABER/FASAH compliance certificates
• Customs declarations

Documents are stored in Firebase Storage and may be processed by our AI system for classification and data extraction.

2.4 Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not store, process, or have access to your full credit card numbers, CVV codes, or bank account details. We receive from Stripe only transaction confirmations, subscription status, and the last four digits of your payment method for display purposes.

2.5 Email Content (When Email Integration Is Enabled)

If you choose to enable email integration, incoming freight-related emails are processed to detect and extract shipment data (quote requests, booking confirmations, tracking updates). Email content is processed by our AI system, and relevant data is stored as shipment records. Raw email content is retained for 90 days and then permanently deleted.

2.6 WhatsApp Messages (When WhatsApp Integration Is Enabled)

If you choose to enable WhatsApp integration, messages sent to our business WhatsApp number are processed similarly to email. Message content is processed for freight-related data extraction and retained for 90 days.

2.7 Usage Data

• IP address and approximate geolocation
• Browser type, version, and operating system
• Pages visited, features used, and actions taken
• Session duration and referral source
• Error reports and performance data

2.8 Cookies

We use cookies and similar technologies as described in our Cookie Policy.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Jistix platform
• Create and manage your account and subscription
• Process and manage freight quotes, bookings, and shipment tracking
• AI-powered document classification and data extraction
• AI-powered email parsing for freight RFQ detection (when enabled by you)
• Generate ZATCA-compliant invoices and compliance documentation
• Process payments through Stripe
• Send transactional emails (account verification, booking confirmations, payment receipts, status updates)
• Send platform notifications about new features and service updates (you may opt out)
• Comply with legal obligations (ZATCA, customs regulations, tax reporting)
• Detect and prevent fraud, abuse, and security incidents
• Analyze platform usage to improve features and user experience

Important commitments:

• We do NOT use your data to train AI models
• We do NOT sell your personal data to third parties
• We do NOT share email content with any third party except as described in this policy
• We do NOT use your data for advertising purposes

4. Legal Basis for Processing (GDPR)

For users in jurisdictions with data protection laws (including the EU/EEA, UK, Saudi Arabia, and UAE):

• Consent: Email integration, WhatsApp integration, marketing communications. You can withdraw consent at any time from Settings.
• Contract performance: Processing necessary to provide the Jistix platform services as described in our Terms of Service.
• Legitimate interest: Platform security, fraud prevention, service improvement, analytics. We balance our interests against your privacy rights.
• Legal obligation: Compliance with applicable laws including ZATCA regulations, customs reporting, tax obligations, and anti-money laundering requirements.

5. Data Sharing and Third Parties

We share your data only with the following categories of third parties, each under appropriate contractual safeguards:

We may also share your data with:

• Professional advisors — attorneys, accountants, and insurers under confidentiality obligations
• Law enforcement or government authorities — when required by applicable law, court order, or to protect our legal rights
• Successor entities — in connection with a merger, acquisition, or sale of assets, with notice to you

6. International Data Transfers

Borderless Distribution Network, LLC is incorporated in Delaware, USA. Our primary data storage is on Firebase in the me-central2 (Dammam, Saudi Arabia) region. Your data may also be processed in the United States and other countries where our sub-processors operate.

EU/EEA Users: Transfers to the United States are conducted under the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses (SCCs) approved by the European Commission.

Saudi Arabia: We comply with the Personal Data Protection Law (PDPL) and its implementing regulations regarding cross-border data transfers.

UAE: We comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

For details on safeguards for international transfers, please see our Data Processing Agreement.

7. Data Retention

We retain your data for the following periods:

8. Your Rights

Depending on your jurisdiction, under GDPR, Saudi PDPL, UAE Federal Decree-Law No. 45, CCPA/CPRA, and other applicable laws, you may have the following rights:

• Right of access: Obtain a copy of the personal data we hold about you
• Right of rectification: Correct inaccurate or incomplete personal data
• Right of erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements
• Right to data portability: Receive your data in a structured, commonly used, machine-readable format
• Right to restrict processing: Limit how we process your data in certain circumstances
• Right to object: Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: Where processing is based on consent, withdraw at any time without affecting prior processing
• Right to lodge a complaint: File a complaint with your local data protection authority

To exercise any of these rights, contact: privacy@jistix.io

We will respond within 30 days. We may require identity verification before fulfilling requests. We will not discriminate against you for exercising your rights.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, request deletion, opt out of "sales" (we do not sell personal data), and not be discriminated against for exercising your rights.

9. Email Integration — Specific Disclosures

This section provides disclosures required for Google's OAuth verification and compliance with the Google API Services User Data Policy.

9.1 Scope of Access

When you enable email integration, Jistix requests permission to read incoming emails for the sole purpose of detecting and extracting freight-related quote requests, booking confirmations, and shipment updates.

9.2 How Email Data Is Used

• Incoming emails are scanned for freight-related content (RFQs, bookings, tracking updates)
• Relevant data is extracted and stored as shipment records in your Jistix account
• Non-freight emails are ignored and not stored
• Email content is processed by our AI system (Anthropic Claude) for extraction

9.3 Commitments Regarding Google User Data

• Jistix's use of Google user data is limited to reading incoming emails for the purpose of detecting and extracting freight quote requests
• Jistix does NOT use Google user data for advertising
• Jistix does NOT transfer Google user data to third parties except as necessary to provide the freight quoting service (Anthropic AI for extraction)
• Jistix does NOT allow humans to read Google user data unless: (a) you have given explicit consent, (b) it is necessary for security purposes (investigating abuse or security incidents), (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized

9.4 Revocation and Deletion

• You can revoke email access at any time from Settings → Integrations
• Upon revocation, all cached email content is deleted within 24 hours
• Extracted shipment data that has been incorporated into your records is retained per our standard data retention policy

9.5 Google API Services User Data Policy Compliance

Jistix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Data Security

We implement appropriate technical and organizational security measures including:

• Encryption in transit: TLS 1.2+ enforced on all connections, HSTS headers
• Encryption at rest: AES-256 encryption via Google Cloud default encryption (Firebase)
• Authentication: Firebase Authentication with secure session management
• Tenant isolation: Firebase Security Rules enforcing per-organization data boundaries
• API security: Server-side routes with HMAC-SHA256 request signing, rate limiting, input validation
• Access controls: Role-based access within organizations, principle of least privilege
• Source protection: No source maps in production, API keys isolated to server-side
• Security assessments: Regular security reviews and vulnerability scanning

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using industry-standard practices. For more details, see our Security page.

11. Cookies

Essential cookies: Required for authentication, session management, and CSRF protection. Cannot be disabled.

Functional cookies: Locale preference and theme preference. Help us provide a better experience.

Analytics cookies: Used to understand how the platform is used and where users encounter difficulties. You can decline these via the cookie settings panel.

Third-party cookies: Stripe may set cookies for payment processing. No advertising or tracking cookies.

For full details, see our Cookie Policy.

12. Children's Privacy

The Service is a B2B platform not directed at or intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us at privacy@jistix.io and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. The "Last updated" date at the top of this page indicates when the Policy was last revised. Continued use of the Service after changes constitutes acceptance.

14. Contact Information