01 Accountability and contact
For questions about your information, contact CargoPool Inc.’s person responsible for the protection of personal information using the contact details below. You may request an explanation of a practice, exercise a right or make a complaint.
02 Information collected
Account and identity: email, name and contact details you provide, language preference, account identifier, verification status and authentication information. Passwords are stored as hashes, not in plain text.
Orders and correspondence: product descriptions and links, dimensions, weight, quantity, value, submitted documents, billing or handover addresses, quotations, invoices, payment references and status, and communications needed for follow-up.
Security and technical use: IP address, login attempt dates and outcomes, sign-in method, browser information and sessions. An approximate country may be inferred from an IP address; this is not GPS location and may be inaccurate.
If you choose an external sign-in provider, we receive information it shares under the permissions granted, such as your identifier, name and email. We do not receive that provider’s password.
03 Purposes and necessity
We use information to verify your email, create and secure your account, handle requests, prepare quotations, coordinate purchases and shipments, manage billing, communicate with you, prevent abuse and comply with legal obligations.
Collection is limited to information necessary for these purposes. Without essential information, we may be unable to create an account or perform a service. Optional information must be identified as optional.
Do not send sensitive information or identity documents unless requested for a specific reason. If you provide information about another person, ensure you are authorized to do so.
04 Service providers and other recipients
Authorized personnel access information according to their responsibilities. Depending on the service, necessary information may be shared with goods suppliers, consolidation partners, carriers, warehouses, brokers and customs authorities.
Technical providers also support hosting, maintenance, email delivery, authentication, abuse prevention and payment processing when used. Disclosure must be limited to what their involvement requires and governed by applicable requirements.
The website uses Google reCAPTCHA on protected flows. It may transmit technical information to Google, including IP address and browser or interaction signals, to assess abuse risk. Google, Apple or Facebook sign-in is initiated when you choose that service. Their own policies also govern their processing.
05 Assisted analysis and decisions
Product-link analysis may use an artificial intelligence tool such as OpenAI or Anthropic and a page-retrieval service such as ScrapingBee, depending on service configuration. The link and information needed to analyse the product may be sent to these providers. Avoid including unnecessary personal information in links or descriptions.
Automated analysis may be incomplete or inaccurate. Estimates and technical results are not final order confirmations. You may request an explanation or report an error for a staff member to review.
Where a decision about you is based exclusively on automated processing, the information and opportunities for intervention required by law must be provided.
06 Processing outside Quebec
International supply chains and some technical providers may require disclosure or processing outside Quebec, including countries where suppliers, logistics partners and provider infrastructure are located. Their laws may differ from Quebec law.
These disclosures must be governed by applicable legal requirements, including required privacy impact assessments and contractual measures. You may request details about recipients and processing locations relevant to your file.
07 Retention and safeguards
Retention periods vary by purpose: account management, order performance, accounting records, security, claims and legal obligations. Expiration of a code or session does not necessarily mean every technical record has already been deleted.
Information must not be retained longer than necessary for authorized purposes and applicable obligations. Closing an account may leave records that must be retained by law or to establish, exercise or defend a right. Deletion or anonymization arrangements must also account for backups.
Access controls and credential protection contribute to service security. No transmission or storage method is entirely risk-free. If a confidentiality incident presents a risk of serious injury, notifications to affected individuals and the Commission d’accès à l’information are made as required by law.
08 Your rights and choices
You may request access to and correction of your information and other measures provided by law, including receiving certain information in a structured, commonly used technological format where the portability right applies.
You may withdraw consent for processing based on that consent, subject to applicable legal or contractual restrictions. We explain possible consequences for the service. Withdrawal does not make earlier processing unlawful or require deletion of records that must be retained.
Send a written request to the responsible person. Proportionate identity verification may be needed. Access and correction requests are answered within the legal time limit, generally no later than 30 days after receipt. If a request cannot be granted, the reasons and applicable remedies are explained.
You may also contact Quebec’s Commission d’accès à l’information to learn about your rights or exercise available remedies.
09 Cookies, communications and updates
The Cookie Policy explains cookies and local storage and how to manage them. Language or appearance preferences do not constitute consent to commercial messages.
Verification emails and notices necessary to handle an order are service communications. Promotional communications must follow applicable consent and unsubscribe requirements.
The update date appears at the top of this page. A new purpose requiring fresh consent is not authorized solely by publishing a revised policy.
10 Optional audience measurement — Google Analytics
With your permission, CargoPool uses Google Analytics 4 to measure page visits, traffic sources, approximate location and selected successful actions (registration, submission and Stripe payment confirmation in the browser). Declining does not limit website features. Admin pages are excluded.
Use Privacy choices to accept, decline or withdraw consent. cp_analytics_consent remembers your choice for six months. Google Analytics does not load before acceptance. Once accepted, _ga and _ga_* cookies have a configured six-month lifetime. cp_analytics_signup expires after five minutes and distinguishes new registrations from logins.
cp_analytics_payments stores up to 200 payment fingerprints locally to limit duplicates; it is cleared on withdrawal or when browser storage is cleared. Selected events exclude names, emails, contact details, product descriptions and authentication tokens. Page URL queries and fragments are excluded; only permitted campaign labels are transmitted.
Google receives technical data, including the IP address when connecting to its services, and processes information under its policies. Processing may occur outside Quebec and Canada. Withdrawal blocks future measurement and removes Analytics cookies accessible to this site; it does not automatically delete data already received by Google.
11 Aggregate website statistics
CargoPool counts page views in daily totals by page category and source category (Google, social networks, internal navigation, direct or unknown). This counter uses no cookie or visitor identifier; the application counters contain no IP address, full URL, city or individual journey. Counters cover up to 90 days, with older rows purged at the next collection.
Registration totals are calculated separately from existing customer accounts, without linking them to page-view sources. Servers and network equipment necessarily process technical data to deliver pages; their operational and security logs are separate from these counters. Optional Google Analytics remains subject to its separate consent choice.
12 Optional web assistant
When you open chat and send a message, its contents and a limited conversation history are sent to the OpenAI API to prepare a response. If you are signed in as a customer, relevant information from your requests, quotes, invoices and shipments may also be sent. The assistant does not receive your passwords, sign-in codes or payment card details. Avoid entering sensitive information in chat.
History is available for 24 hours from conversation creation, then deleted from the active database on the next chat initialization or request. A temporary cp_web_chat cookie binds the conversation to the browser and sign-in session; it expires after 24 hours. Technical hashes used to limit abuse are purged after two days on subsequent use. Backups may follow a separate cycle.
OpenAI requests disable response storage for later retrieval (store=false). This does not guarantee that the provider retains no technical data; the processing and retention policies applicable to the OpenAI API still apply. The assistant can make mistakes and cannot pay, order or modify records. Contact the team at allo@cargopool.ca.
Useful links
Contact us
CargoPool Inc.
Person responsible for the protection of personal information
Levis, QC
G6V 3R6
allo@cargopool.ca
+1 (438) 500-4797
Please include your file reference when relevant. Never send your password or verification code.