Privacy Policy

Who we are

Freighters IT Consulting is an IT consulting business based in Colorado, United States, serving clients in the United States and Portugal. We are the controller of the personal data described in this policy. You can reach us about anything in this policy at robert@freighters.com or +1 (303) 909-5832.

What we collect

We only collect what we need to answer you, deliver our services and run our business:

• Contact form: your name, email, phone, company, company size, the service you're interested in, your message, and whether you asked for a free assessment or our newsletter.
• Free website audit request: the website address you want reviewed, your email or phone, your name (optional), and the campaign the link came from (for example a business card QR code).
• Client portal and projects: your name, email, company and phone; your sign-in sessions; proposals you accept (including the name, email, IP address and browser you accepted from, as a record of the agreement); questionnaire and onboarding answers about your business; and files you upload, such as logos and brand assets.
• Billing: invoice details and payment status. Card and bank details are entered directly with our payment processors and never reach our servers.
• Technical data: IP addresses for security and abuse prevention (for example rate-limiting forms), and — only if you allow analytics cookies — anonymous usage statistics from Google Analytics.

How we use it

• To reply to enquiries and prepare the assessments, audits and proposals you ask for.
• To deliver, bill and support the services you buy from us, including running your client portal.
• To send the monthly newsletter, only if you opted in. Every newsletter has an unsubscribe link.
• To keep the site and portal secure, prevent spam and abuse, and keep records we're legally required to keep.
• To understand which pages are useful and improve the site, using aggregated analytics.

We do not sell or rent personal data, and we do not use it for advertising or automated decisions that have legal or similarly significant effects on you.

Legal bases (EEA and UK visitors)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (delivering services you've engaged us for, or steps you asked for before engaging us, such as a proposal); legitimate interests (replying to enquiries, securing our systems, running our business); consent (newsletter and analytics cookies — you can withdraw it at any time); and legal obligation (tax and accounting records).

Who we share it with

We use a small number of trusted service providers who process data on our behalf and only for the purposes above:

• Vercel — website and portal hosting, and file storage.
• Neon — our database.
• Formspree — receives and forwards contact form submissions.
• Resend and Microsoft 365 — sending and receiving email.
• Square and Stripe — invoicing and payment processing.
• Cloudflare Turnstile — bot protection on some forms.
• Anthropic — AI assistance we use to prepare audits, proposals and project briefs from the information you provide. Data sent through Anthropic's commercial API is not used to train its models.
• Google — Google Analytics (only with your consent) and PageSpeed Insights, which receives the public website address you ask us to audit.

We may also disclose data if required by law, to protect our rights or the safety of others, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

International transfers

Our providers are mostly based in the United States. If you are in the EEA or UK, your data is transferred to the US under the EU–US Data Privacy Framework where the provider is certified, or under the European Commission's Standard Contractual Clauses.

How long we keep it

Enquiries and audit requests that don't lead to work are kept for up to 24 months, then deleted. Client records, signed proposals and invoices are kept for the length of our relationship and then for as long as tax and accounting law requires (generally up to 7 years). Portal sign-in links expire after 15 minutes and sessions after 30 days. Newsletter data is kept until you unsubscribe.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent at any time. Residents of US states with privacy laws (such as California and Colorado) have similar rights, including the right to know what we collect and to request deletion. We do not sell or share personal data for targeted advertising.

To make a request, email robert@freighters.com. We'll reply within 30 days and won't treat you differently for using your rights. If you are in the EEA, you can also complain to your local data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD).

Security

We protect data with encryption in transit (HTTPS), hashed sign-in tokens and passwords, access limited to the people who need it, and providers with strong security records. No system is perfectly secure, but we'll tell you promptly if a breach affects your data.

Children

Our services are for businesses. We don't knowingly collect data from anyone under 16.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. If a change materially affects how we use data you've already given us, we'll tell clients directly.