Privacy Policy

1. Who we are

ISL Freight (islfreight.com) is an online freight marketplace operated by NEW IT BIZ / NITB GROUP, Bangladesh. In this policy "ISL", "we" and "us" mean ISL Freight and its operator.

Contact: contact@islfreight.com.

This policy covers our website, customer and vendor accounts, the request-for-quote (RFQ) form, the contact form and the ISL API used by partner ecommerce stores.

2. Information we collect

Information you give us:

• Account: name, email address, password (stored only as a one-way salted hash — we never store your actual password) and account type (customer or vendor).
• Customer profile: contact name, phone number, email, company name and address. These are required before you send an RFQ.
• RFQs and shipments: service type, pickup and delivery locations, goods description, HS code, weight, carton dimensions and quantity, CBM and notes; and later the quotes, bookings and tracking updates linked to them.
• Vendors / logistics partners (if applicable): company name, registration or licence details, business address, service categories, a reference to KYC documents, review status and notes, rate cards, quotes, plan payment requests, payment references and credit records.
• Contact form: name, email and message.
• Shipments a partner ecommerce store sends through our API: pickup and delivery addresses, parcel weight and size, recipient name and phone, cash-on-delivery amount and the store’s reference.

Sign in with Google (optional):

• If you choose "Continue with Google", we request only the openid, email and profile scopes. From Google we receive your name, email address, whether the email is verified, and your Google account ID.
• We never see or receive your Google password. We have no access to your Gmail, Drive, contacts or any other Google data.
• We store only the name, email and Google account ID so we can recognise your ISL account. Google’s tokens are used once during sign-in and are not stored.

Information collected automatically:

• Cookies: isl_session (keeps you signed in; HttpOnly; 7 days or until you sign out) and isl_gstate (a security check during Google sign-in; 10 minutes). These are essential cookies.
• Browser storage: your language choice (localStorage), and an unfinished RFQ draft and where to return after sign-in (sessionStorage — cleared when you close the tab). Site files may be cached in your browser for an offline page.
• We do not use advertising or third-party analytics cookies.
• Logs and security: IP addresses are used in short-lived rate-limit counters to prevent abuse; our hosting provider keeps server and error logs; we keep an audit log of key account actions (such as sign-up, Google linking and admin actions); and we keep a record of emails sent (recipient, subject, content and delivery status).

3. How we use information

• To create your account, verify your email, sign you in and keep your account secure.
• To receive your RFQ, route it to relevant vetted logistics partners, and manage quotes, bookings and tracking.
• To send service emails: verification and password-reset links, RFQ confirmations, new-quote and booking notifications, and new-RFQ alerts to our team.
• To review vendor KYC and manage vendor plans and credits.
• To give partner ecommerce stores estimates and dispatch their shipments to partners.
• To answer your questions, prevent abuse and fraud, and meet legal obligations.

We do not sell your personal data. We do not send marketing emails without your consent.

4. Who we share information with

• Logistics partners / vendors: approved partners your RFQ is routed to can see the company name and shipment details so they can quote. They do not see your name, phone, email or address until you accept that vendor’s quote or booking. Partners may use this only for that shipment.
• Service providers: Railway (website and database hosting), Resend (email delivery) and Google (only if you use Google sign-in). They receive only what they need to provide their service to us.
• Partner ecommerce stores: a store can see the status of shipments booked through it.
• Tracking links: anyone with a booking’s tracking link can see its shipment updates. Keep the link private.
• Legal reasons: when required by Bangladeshi law, a court or a lawful government request, or to protect the rights and safety of our users, partners or ISL.
• Business transfer: in a merger or sale, with the same protections as this policy.

5. Storage outside Bangladesh

We use cloud hosting and email delivery services. Your data may be stored and processed on servers operated by our cloud hosting provider and our email delivery provider, which may be located outside Bangladesh. By using the service you agree to this transfer.

6. How long we keep information

• Account and profile: while your account is active, or until you ask us to delete it.
• RFQ, quote, booking, payment and credit records: for business and legal record-keeping, 5 years.
• Sign-in sessions end after 7 days or when you sign out; email verification links expire after 30 minutes; rate-limit counters are cleared after a short time.
• Email records, audit logs and server logs: 1 year.

When you ask us to delete your data we delete or anonymise it, except what we must keep by law or need for an ongoing shipment or dispute.

7. Security

We use HTTPS, hashed passwords, HttpOnly session cookies, CSRF protection, rate limiting, role-based access and manual KYC review of vendors. No online system is completely secure. Keep your password private and tell us if you notice anything suspicious.

8. Your rights and choices

• Access: ask for a copy of the information we hold about you.
• Correction: edit your company profile in your dashboard, or write to us.
• Deletion: to delete your account and data, email contact@islfreight.com from your account’s email address. (There is no self-service delete button yet.)
• Remove Google access: you can remove ISL Freight’s access at any time at myaccount.google.com/permissions.
• Objection: you can object to a particular use of your data.

Send requests to contact@islfreight.com. After verifying your identity we will reply within 30 days.

9. Children

ISL Freight is a business shipping service and is not for anyone under 18. We do not knowingly collect children’s data and will delete it if we learn of it.

10. Google API Services User Data Policy

ISL Freight’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Information from Google (name, email, Google account ID) is used only to sign you in and run your ISL account.
• We do not sell this information, use it for advertising, or use it to train AI or machine-learning models.
• We do not transfer it to others except as needed to provide this service, to comply with law, or for security.
• No person reads this information except with your consent, for security investigations or where the law requires.

11. Changes to this policy

We may update this policy. When we do, the "Last updated" date on this page will change; for important changes we will tell you by email or a notice on the site.

12. Governing law

This policy is governed by the applicable laws of Bangladesh.

13. Contact us

Any privacy question or request: contact@islfreight.com.