Privacy Notice
Version 2026-09-01 · Effective
1. Who is responsible for your data
This Privacy Notice explains how Cantarell OS ("Cantarell", "we") collects, uses, protects and transfers your personal data when you use our websites, mobile applications, terminal and IoT integrations and any other services that link to this notice (the "Services"), in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and, where applicable, United States privacy law, including the California Consumer Privacy Act (CCPA).
2. The personal data we process
We collect data that identifies, or can identify, you or your business, directly from you, from your organization, or through your use of the Services:
- Identity and contact data: name, title, company, government identifiers (for example RFC, CRE permit number, DOT or MC number), email address, physical address and phone number.
- Financial data: bank account details, domestic and cross-border payment history, billing address and credit metrics used for wholesale distribution.
- Operational and telematics data: GPS location of fleet units, Hours of Service (HOS) logs, tank sensor readings (temperature, pressure and volume) and routes.
- Regulatory compliance data: declarations, pedimentos, USMCA certificates and permits filed with agencies such as SAT, CRE, ASEA, EPA and CBP.
- Technical data: IP address, browser type, operating system, platform usage sequences and authentication tokens.
Financial data is processed with your express consent, which you give by accepting this notice. We do not request sensitive personal data.
3. Why we process your data
Primary purposes, necessary to provide the Services:
- Providing, operating and maintaining the Cantarell OS platform, including cross-border fuel logistics tracking and terminal management.
- Processing multi-currency transactions and issuing digital customs and tax documentation.
- Supporting your compliance with regulatory authorities in Mexico and the United States.
- Providing customer support and resolving technical issues.
- Verifying your identity, preventing fraud and protecting account security.
Secondary purposes, which are not necessary for the service and require your consent:
- Analyzing platform usage to develop new route-optimization and trading-intelligence features.
- Sending you promotional communications, market updates and feature announcements.
You can refuse the secondary purposes or revoke your consent at any time from Settings > Privacy & data > Consents in the platform, or by writing to privacy@cantarell-os.com. Refusing does not affect the services you contracted.
4. Data transfers
Because the platform is binational, your data may be transferred between Mexico and the United States when this is necessary to carry out operations such as digital pedimentos or cross-border freight matching. We do not sell your personal data.
5. Your rights (ARCO and CCPA)
You have the right to know what data we hold and how we use it (Access), to have it corrected when it is inaccurate or incomplete (Rectification), to have it deleted when it is no longer needed, subject to legal tax and customs retention obligations (Cancellation), and to object to its use for specific purposes (Opposition).
How to exercise them: if you have an account, go to Settings > Privacy & data in the platform. There you can download a copy of your data, request a correction or delete your account, and follow the status and deadline of each request. You can also write to privacy@cantarell-os.com; we will then send a verification code to the email on file to confirm your identity before handling the request.
We respond within at most 20 calendar days from receipt of your request, which is inside the legal period of 20 business days (45 calendar days for requests under the CCPA). The deadline of each request is shown under Settings > Privacy & data.
6. Revoking consent and limiting use
You can revoke the consent you gave us and limit the use or disclosure of your data from Settings > Privacy & data > Consents or by writing to privacy@cantarell-os.com. Revocation is not retroactive and does not apply where the law requires us to keep processing the data.
8. Security measures
We apply administrative, technical and physical safeguards to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing, including encryption in transit, encryption at rest and role-based access control.
9. Changes to this notice
Any change to this notice will be published on this page with a new version number and its effective date. When you register, the platform records the version of the notice you accepted.
10. Contact
For questions about this notice or about how your data is processed, write to privacy@cantarell-os.com.