Privacy Policy

Pallego is online logistics management software for freight forwarders. It is operated by REMO GROUP L.L.C-FZ, licence [Trade licence number] issued by [licensing authority], registered at [Registered office address], United Arab Emirates (“Pallego”, “we”, “us”).

This policy explains how we handle personal data about the people who visit our website, sign up, and use Pallego, and about the contacts of the companies that subscribe. We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the “PDPL”) and, where they apply to you, other data protection laws.

The records a company keeps in its Pallego workspace (its customers, contacts, enquiries, jobs, documents and invoices) belong to that company. For those records the company is the controller and Pallego only processes them on its behalf, as set out in our Terms of Service. If your details are in a company’s workspace and you have a question about them, please contact that company first; we will help it answer you.

• Account details: your name, work email address, and phone number if you give one; your role and permissions in your company’s workspace.
• Sign-in details: the one-time codes we email you (they expire after 10 minutes), your password if you set one (we store only a one-way scrambled form of it, never the password itself), and, if you choose Google, your Google account identifier, name and email address. We do not get your Google password or access to your Gmail.
• Company details: the company name, country, city, address, phone, website and tax registration number you enter.
• Billing details: your plan, the number of users, invoices and payment status. Card details are entered on Stripe’s payment page and kept by Stripe; we never see or store full card numbers.
• Usage and security information: when you sign in, a record of changes made in the workspace (an audit log), how much of the AI allowance each person uses, and technical information such as your IP address, browser and device in our servers’ logs.
• How you use our website: the pages you view and the buttons and links you click on our website and during sign-up, the site or campaign link you came from, and whether you use a phone, tablet or computer, under a random identifier stored in your browser. Once you sign up, this is linked to your account. We do not record what you type into forms.
• What you send us: emails and support requests.

We use personal data only for these purposes, on the grounds the PDPL allows:

• To provide Pallego (performing our agreement with you or your company): creating your account, signing you in, running the workspace and its features, and sending the emails the service needs, such as sign-in codes, invitations and billing notices.
• To keep Pallego secure (our legitimate interest, and the law): one active session per person, detecting misuse, investigating problems and keeping audit logs.
• Billing and records (our agreement and legal obligations): charging for the subscription and keeping invoices and accounting records as UAE law requires.
• Support and improvement (our legitimate interest): answering your questions and understanding, mostly from totals, which features are used so we can improve them.
• Improving the website and sign-up (our legitimate interest): seeing where visitors leave sign-up, which pages and buttons work, and comparing two versions of a page (A/B tests). This stays with us; we do not use it for advertising or share it with advertisers.
• News and offers (your consent): only if you ask to receive them. You can stop them at any time with the link in each email or by writing to us.

We do not sell personal data, and we do not use it for advertising.

When you ask the AI assistant something or let the AI read a document, your question, the records needed to answer it, or the document is sent to our AI provider, Anthropic, to produce the answer. Anthropic’s terms for this service do not allow it to use that content to train its models. We record how much of the AI allowance each person uses, so the company can see it.

The AI makes suggestions; people decide. Nothing the AI reads from a document is added to a job until a person has checked and applied it, and no decision with legal or similarly significant effects on you is made by automated means alone.

We use these service providers (sub-processors) to run Pallego. Each may only use personal data to provide its service to us:

• Supabase: database (London, United Kingdom)
• Railway: application servers
• Vercel: website
• Cloudflare: domain names, and storage and delivery of uploaded documents
• Stripe: card payments and invoices
• Resend: sign-in codes, invitations and service emails
• Anthropic: AI assistant and AI document reading
• Google: sign in with Google (only if you choose it), and Pallego's own email (contact@pallego.app)
• Twilio: sign-in codes by text message (only if you choose it)

Inside a company’s workspace, the people of that company can see the records they have access to, including who made changes. Pallego staff only open a workspace to provide support, and every change they make there is logged.

We may also disclose personal data when the law, a court or a government authority requires it, or to protect the rights and safety of our users and of Pallego. If Pallego’s business is sold or reorganised, personal data may pass to the new owner, who must keep protecting it in line with this policy.

Our database is hosted in London, United Kingdom, and some of our service providers process data in other countries, including the European Union and the United States. When personal data leaves the UAE, we make sure it is protected as the PDPL requires, by working with providers that offer an adequate level of protection and through contracts with appropriate safeguards.

• Account and company details: while the account or the subscription is active.
• When a subscription ends, the workspace stays available read-only for 90 days so it can be exported; after that we delete it, except what the law requires us to keep and copies in backups, which are overwritten in the normal course.
• Invoices and accounting records: as long as UAE law requires, at least five years.
• Sign-in codes: 10 minutes. Server logs and audit logs: as long as needed for security and support, normally no longer than 12 months, unless needed to investigate an incident.
• Website usage records: about 13 months.

Data travels encrypted (HTTPS) and is stored with providers that encrypt it at rest. Passwords are stored only in a one-way scrambled form. Each company’s data is kept separate from every other company’s, people only see what their permissions allow, each person has one active session at a time, and changes are logged. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

Under the PDPL you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct personal data that is wrong or incomplete;
• delete personal data we no longer need or have no right to keep;
• restrict or stop processing, or object to it, including to news and offers;
• send your personal data to you or to another provider in a common format;
• withdraw a consent you gave, without affecting what happened before.

You can update your name, password and sign-in methods yourself under My account. For anything else, write to contact@pallego.app. We answer within 30 days and may ask you to confirm who you are. If you are not satisfied with our answer, you can complain to the UAE Data Office.

We do not use advertising or tracking cookies. Pallego keeps a few items in your browser’s storage: your sign-in, the company you are supporting (Pallego staff only), an offer code from a link you opened, display preferences, and a random identifier with the current visit for our own website statistics (see “What we collect”); you can clear them by clearing your browser’s site data. Our pages load fonts from Google Fonts, and the “Continue with Google” button loads Google’s sign-in, so Google may receive your IP address when those load.

Pallego is a business service and is not meant for anyone under 18. We do not knowingly collect personal data about children.

We may update this policy as Pallego and the law change. We will show the date of the latest version at the top, and tell account holders by email before a significant change takes effect.

Questions or requests about personal data: contact@pallego.app, or write to REMO GROUP L.L.C-FZ, [Registered office address], United Arab Emirates.