Legal · Cargalo

Privacy Policy

Crossisland LLC (DBA Cargalo) · Effective July 31, 2026 · Version 1.0

Applies to: cargalo.us · cargalo.work

This Privacy Policy explains how Crossisland LLC (DBA Cargalo) collects, uses, stores, and protects information from visitors to cargalo.us and registered users of cargalo.work. By accessing either property, you acknowledge this policy.

1. WHO WE ARE

Crossisland LLC, a Florida limited liability company doing business as Cargalo (“Cargalo,” “we,” “us,” or “our”), is the data controller responsible for the personal information described in this Privacy Policy.

2. SCOPE — WHAT THIS POLICY COVERS

This Privacy Policy applies to all information collected through:

›cargalo.us — our public marketing website, including the contact form, WhatsApp link, and any analytics or tracking technologies deployed on the site;

›cargalo.work — our private carrier operations portal, accessible only to registered users (carriers, fleet owners, dispatchers, and administrators); and

›any communications you initiate with us via email, WhatsApp, or telephone in connection with either property.

This policy does not apply to third-party websites, applications, or services linked from our properties, including load boards (DAT, Truckstop), factoring companies, or broker platforms. We are not responsible for the privacy practices of those third parties.

3. INFORMATION WE COLLECT

3.1 Information collected on cargalo.us (marketing site)

When you visit cargalo.us, we may collect the following categories of information:

3.2 Information collected on cargalo.work (portal)

When you register and use cargalo.work, we collect significantly more information due to the nature of the dispatch service relationship:

4. HOW WE USE YOUR INFORMATION

4.1 Legal bases for processing (applicable to all users)

We process your personal information on the following legal bases:

›Contract performance — to provide the dispatch services you have engaged us for and to operate cargalo.work for registered users.

›Legitimate interests — to operate, improve, and secure our platforms; to respond to inquiries; and to analyze usage patterns.

›Consent — for cookies and tracking technologies on cargalo.us where consent is required (see Section 6).

›Legal obligation — to comply with applicable federal and state laws, including tax reporting, FMCSA regulatory requirements, and data breach notification obligations.

4.2 Specific purposes

5. HOW WE SHARE YOUR INFORMATION

Cargalo does not sell your personal information. We do not share personal information with third parties for their own marketing purposes. We share information only in the following circumstances:

5.1 Service providers (Sub-processors)

We share information with trusted third-party vendors who process data on our behalf, under contractual obligations to protect your information:

5.2 FMCSA and brokers

In providing dispatch services, we share your carrier credentials (MC Number, USDOT, insurance certificates, carrier packet) with freight brokers, shippers, and load boards on your behalf and at your direction. This sharing is integral to the service and authorized by your Dispatcher-Carrier Service Agreement and Limited Power of Attorney.

5.3 Legal requirements

We may disclose your information if required to do so by law, regulation, court order, or valid legal process, including subpoenas or government investigations. Where permitted by law, we will notify you of such disclosure requirements before complying.

5.4 Business transfers

If Cargalo undergoes a merger, acquisition, asset sale, or corporate restructuring, your information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our platforms before your information becomes subject to a different privacy policy.

5.5 With your consent

We may share your information with third parties for any other purpose with your explicit prior consent.

6. COOKIES AND TRACKING TECHNOLOGIES

6.1 What we use

6.2 Meta Pixel — specific disclosure

cargalo.us uses the Meta Pixel, a tracking technology provided by Meta Platforms, Inc. When you visit cargalo.us, the Meta Pixel may collect your IP address, browser type, pages visited, and actions taken on the site (such as clicking the WhatsApp button or submitting the contact form). This information is sent to Meta and may be used to:

›Measure the effectiveness of Cargalo's advertising on Facebook and Instagram;

›Show Cargalo ads to people who have visited cargalo.us (retargeting); and

›Build lookalike audiences of people similar to our site visitors.

Meta's use of this data is governed by Meta's Privacy Policy (facebook.com/privacy/policy). You can opt out of Meta's use of your data for advertising purposes at facebook.com/ads/preferences or by adjusting your browser privacy settings.

6.3 Cookie consent — cargalo.us

When you first visit cargalo.us, a cookie consent banner will appear. You may:

›Accept all cookies — including the Meta Pixel and any analytics tools;

›Decline non-essential cookies — the site remains fully accessible; only strictly necessary cookies will be set; or

›Manage preferences — select which categories of cookies you accept.

Your preference is stored and respected on subsequent visits. You may change your cookie preferences at any time by clicking the 'Cookie Settings' link in the footer of cargalo.us.

6.4 Cookies on cargalo.work (portal)

The portal uses only strictly necessary cookies required for authentication and session management. These cookies cannot be disabled without preventing you from logging into the portal. No third-party advertising or analytics cookies are set on cargalo.work without separate disclosure.

7. ARTIFICIAL INTELLIGENCE PROCESSING

Certain features of cargalo.work use artificial intelligence technologies, including large language models and machine learning algorithms, to assist with operational tasks. Specifically, AI may process:

›Documents you upload (BOL, POD, receipts, rate confirmations) — for automatic classification, filing, and data extraction;

›Expense receipts submitted via WhatsApp — for categorization and integration into your dashboard; and

›Load and route data — for compatibility analysis and performance insights.

AI processing is performed by third-party AI infrastructure providers (identified in Section 5.1). Your documents and data transmitted to AI providers are used solely to provide the feature to you. We maintain Data Processing Agreements with all AI providers confirming that your data is not used to train third-party models.

AI-generated outputs (classifications, alerts, suggestions) are clearly identified as AI-generated within the portal. All material business decisions remain the responsibility of human dispatchers. See Section 6.2 of the Terms of Service for additional AI limitations.

8. DATA RETENTION

At the end of the applicable retention period, we securely delete or anonymize your personal information unless a longer retention period is required by law or necessary to resolve an active dispute.

9. DATA SECURITY

We implement commercially reasonable administrative, technical, and physical security measures to protect your information, including:

›Encrypted data transmission (HTTPS/TLS) on both cargalo.us and cargalo.work;

›Encrypted data storage in Supabase (AES-256 at rest);

›Row-Level Security (RLS) in Supabase — each user can only access their own data;

›Role-based access controls — carriers, fleet owners, dispatchers, and administrators each see only the data their role permits;

›Password hashing using bcrypt/argon2 — passwords are never stored in plain text;

›Multi-factor authentication (2FA) availability for all accounts;

›Automated backups with verified restoration procedures; and

›Periodic security audits conducted by independent security professionals.

No security system is impenetrable. In the event of a data breach affecting your personal information, we will notify you in accordance with applicable law — see Section 10 for breach notification procedures.

10. DATA BREACH NOTIFICATION

In the event we discover or are notified of a security incident that affects your personal information, Cargalo will:

›Promptly investigate the scope and nature of the incident;

›Notify affected individuals by email at the address on file, within the timeframe required by applicable law:

– Florida (FIPA, F.S. §501.171): within 30 days of determination of breach

– California (Cal. Civ. Code §1798.82): within a reasonable time (we target 30 days)

– Texas (TBIA): within 60 days of breach determination

›Include in the notice: a description of the breach, the categories of data affected, steps we are taking, and steps you can take to protect yourself; and

›Notify relevant state attorneys general where required by law.

11. YOUR PRIVACY RIGHTS

11.1 Rights available to all users (United States)

Regardless of your state of residence, you have the right to:

›Access — request a copy of the personal information we hold about you;

›Correction — request that we correct inaccurate or incomplete information;

›Deletion — request that we delete your personal information, subject to legal retention requirements; and

›Portability — request that we provide your data in a portable, machine-readable format.

To exercise any of these rights, contact us at privacy@cargalo.com. We will respond within 45 days. We may ask you to verify your identity before processing your request.

11.2 California residents — additional rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), Cal. Civ. Code §1798.100 et seq.:

›Right to Know — the specific categories of personal information collected, the sources, the business purpose, and the categories of third parties with whom it is shared;

›Right to Opt-Out of Sale or Sharing — Cargalo does not sell your personal information. Cargalo does not share your personal information for cross-context behavioral advertising. If this changes, we will notify you and provide an opt-out mechanism;

›Right to Limit Use of Sensitive Personal Information — you may direct us to limit our use of sensitive personal information (such as financial data) to what is necessary to provide the service; and

›Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA right.

To exercise your California rights, contact us at privacy@cargalo.com or visit the 'Privacy Rights' section of cargalo.work. We will respond within 45 days, with a possible 45-day extension upon notice.

11.3 Other state residents

Residents of Virginia (VCDPA), Colorado (CPA), Texas (TDPSA), and other states with privacy laws have similar rights to access, correct, delete, and port their data, and to opt out of certain processing. We honor these rights for all U.S. residents regardless of state. Contact privacy@cargalo.com to exercise your rights.

12. CHILDREN'S PRIVACY

Cargalo's services are intended exclusively for commercial use by adults operating in the freight transportation industry. We do not knowingly collect personal information from individuals under the age of 18. If we discover that we have inadvertently collected information from a person under 18, we will delete it promptly. If you believe we have collected information from a minor, please contact us at privacy@cargalo.com.

13. INTERNATIONAL DATA TRANSFERS

Cargalo is based in the United States and processes all data within the United States. If you access our services from outside the United States, your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your country. By using our services, you consent to this transfer.

If Cargalo engages sub-processors that process data outside the United States (for example, AI providers with data centers in other jurisdictions), we ensure appropriate safeguards are in place, including contractual data processing agreements.

14. THIRD-PARTY LINKS

Our platforms may contain links to third-party websites, load boards, broker portals, and other external services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or technology. When we make material changes, we will:

›Update the "Effective Date" at the top of this document;

›Notify registered cargalo.work users by email at the address on file; and

›Display a prominent notice on cargalo.us for at least 30 days following the change.

Your continued use of our services after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree to the updated policy, you must discontinue use of the services and close your account.

16. CONTACT & PRIVACY REQUESTS

For all privacy-related inquiries, requests to exercise your rights, or concerns about this Privacy Policy, please contact:

Crossisland LLC (DBA Cargalo)

Privacy Officer

Email: privacy@cargalo.com

Legal: legal@cargalo.com

Phone: (305) 330-6139

Website: www.cargalo.us

We will acknowledge receipt of your request within 5 business days and respond fully within 45 days as required by applicable law.

— END OF PRIVACY POLICY —

Crossisland LLC DBA Cargalo | Effective July 31, 2026 | Version 1.0