Privacy Policy
Last updated: 11 October 2026
This Privacy Policy explains how Lading collects, uses and protects personal data when you visit lading.app, sign up for or use the Lading platform, or interact with Lading on social media.
1. Who we are
Lading is a software service operated by:
- Operator: Richard A., self-employed professional (autónomo)
- Tax ID (NIF): Z3567916T
- Address: Calle Beatriz Galindo 6, San Sebastian de los Reyes, 28702. Madird
- Contact: [email protected]
Because the operator is established in Spain, this policy is governed by the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD), wherever our users are located.
2. Two different roles
Lading handles personal data in two capacities, and the rules differ for each:
a) As a controller — for data about our own customers and visitors: the people who sign up, manage an account, pay for a plan, contact us, visit our website or interact with our social media pages. This policy describes that processing.
b) As a processor — for the data our customers (courier and freight-forwarding companies, "Customers") store in the platform about their clients, consignees, shipments and staff. For that data, the Customer is the controller and decides what is collected and why; Lading processes it only on the Customer's instructions under the data processing terms in our Terms of Service. If you are a client of a courier company that uses Lading, please contact that company to exercise your rights; we will assist them as required.
3. What data we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Name, business email, phone, company name, country, password (stored hashed) | Creating and operating your account, providing the service, support | Performance of a contract (6.1.b) |
| Billing details, plan, invoices, payment status | Charging for the service, issuing invoices, tax and accounting obligations | Contract (6.1.b) and legal obligation (6.1.c) |
| Usage and activity logs, IP address, device and browser data | Security, fraud prevention, troubleshooting, the in-app activity log | Legitimate interest in running a secure service (6.1.f) |
| AI feature usage (actions performed, credit consumption) | Metering and billing the AI features, enforcing spending ceilings | Contract (6.1.b) |
| Messages you send us (email, contact form, WhatsApp, social media) | Answering you and following up on your request | Pre-contractual steps / contract (6.1.b) or legitimate interest (6.1.f) |
| Public profile data, comments and messages on our social media pages | Managing our pages, replying to comments and messages, measuring reach | Legitimate interest (6.1.f) |
| Email address for product news | Sending product updates and offers | Consent (6.1.a), or legitimate interest for existing customers about similar services, with an opt-out in every message |
We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you.
4. Artificial intelligence features
Some features of Lading ("Lading AI") send the content needed for a specific task — for example, a document to be read or a question asked in the customer portal — to an AI model provider, which returns a result to the platform.
- Your data is never used to train shared models, by us or by our AI provider, Anthropic, whose commercial terms prohibit training its models on the content we send. Anthropic keeps that content only for a limited period, to detect misuse of its service, and then deletes it.
- Each AI feature can be switched off per staff role, and the customer-facing portal assistant is off by default.
- AI output is a suggestion: a person approves it before it is committed to a record, except in the portal assistant, which hands off to staff when a question is out of scope.
5. Who we share data with
We share personal data only with service providers that process it on our behalf under contracts that meet GDPR article 28, and only to the extent needed:
| Provider | Service | Location |
|---|---|---|
| Vultr Holdings LLC | Server hosting | United States |
| Cloudflare, Inc. | DNS, network security, TLS, content delivery, file storage (R2) | Global network / United States |
| Postmark (ActiveCampaign, LLC) | Sending and receiving email: account messages and the notifications Customers send their clients | United States |
| Anthropic, PBC | Lading AI features (only when used) | United States |
Payments for Lading plans and AI credit are handled by our online reseller, Lemon Squeezy, LLC (United States), which sells them as merchant of record: it runs the checkout, takes the payment, charges any sales tax and issues the invoice. It processes your payment details as an independent controller under its own privacy policy; we never see your full card number.
Services you connect yourself. If you connect your own Stripe, PayPal, Twilio, WhatsApp Business or AI vendor account to Lading, data flows to that provider under your agreement with them, on your instructions.
We may also disclose data when required by law or by a valid request from a public authority.
6. International transfers
Some of our providers are located in, or may access data from, countries outside the European Economic Area, mainly the United States. When that happens we rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with any additional safeguards required.
7. How long we keep data
- Account and platform data: while your account is active. After you cancel, we keep it for 30 days so you can request an export, then delete it from the live system. Backups roll over and are fully purged within 14 days after that.
- Invoices and billing records: for the period required by Spanish commercial and tax law (up to six years).
- Security logs: up to 12 months.
- Marketing communications: until you unsubscribe or withdraw consent.
- Messages and support requests: for as long as needed to handle the request and up to 2 years afterwards, unless they form part of a contract.
8. Security
Each Customer's platform data is stored in its own separate database. Connections are encrypted in transit (TLS), passwords are stored hashed, access is controlled by roles and recorded in an activity log, and backups are stored off the main server. No system is perfectly secure; if a personal data breach affects you, we will notify you and the competent authority as the law requires.
9. Your rights
You can ask us to access, correct, delete, restrict or port your personal data, object to processing based on legitimate interest, and withdraw consent at any time (without affecting earlier processing). Write to [email protected]; we will answer within one month. We may ask you to verify your identity.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the data protection authority where you live.
10. Social media pages and the Meta app
Lading runs pages on Facebook, Instagram and LinkedIn. When you visit or interact with them, the platform (Meta or LinkedIn) also processes your data under its own privacy policy. For page statistics ("Insights"), Lading and Meta Platforms Ireland Ltd. act as joint controllers under the Page Insights Controller Addendum, with Meta taking primary responsibility.
Lading uses its own Meta app ("Lading Publisher") only to publish to, read statistics for, and manage comments and messages on Lading's own Facebook page and Instagram account. It does not access the accounts or data of other users. Instructions to request deletion of any data we hold from these interactions are on our Data Deletion page.
11. Cookies
The website and platform use only strictly necessary cookies (session, security and preference cookies) that do not require consent. We do not use analytics or advertising cookies; if that changes, we will update this section and ask for your consent before any of them are set.
12. Children
Lading is a business service and is not directed to anyone under 16. We do not knowingly collect their data.
13. Changes to this policy
We may update this policy to reflect changes in the service or the law. We will post the new version here with a new date and, for material changes, notify account holders by email before they take effect.
14. Contact
Questions about this policy or your data: [email protected]