Pallet Privacy Policy

Effective date: October 27, 2026

1. Who we are and what this policy covers

This Privacy Policy explains how PALLET TECHNOLOGIES INC. ("Pallet," "we," "us") collects, uses, shares and protects information when you use our services. Pallet provides freight rating, pricing and tariff-management software for carriers, shippers and third-party logistics providers (3PLs).

This policy applies to:

• our website at usepallet.com and related pages (the "Website");
• the Pallet web application (the "Application");
• the Pallet API and headless rating services (the "API");
• the Pallet MCP server and any AI-agent connectors that use it, including connectors listed in third-party AI platforms (each a "Connector").

Together these are the "Services." Our Services are built for businesses. Most information we handle is business information, such as shipment details and carrier pricing. Where that information identifies an individual, such as a contact name or work email, we treat it as personal information under this policy.

Where we process data on behalf of a business customer under a written agreement, that agreement controls how we handle that customer's data, and we act as the customer's service provider or processor.

2. Information we collect

We collect only what we need to provide and support the Services.

We do not intentionally collect sensitive personal information, such as health, biometric or government ID data. Please do not include it in shipment notes or other free-text fields.

3. How we use information

We use information to:

• provide the Services, including rating shipments, running batch rates, applying routing rules, generating bills of lading and returning quotes;
• create and manage accounts, authenticate users and API clients, and process payments;
• connect the integrations you choose, such as dimensioners, ELDs and tracking providers;
• provide support and respond to requests;
• secure the Services, detect abuse and prevent fraud;
• maintain and improve the Services, including fixing errors and measuring performance;
• send service notices and, where you have agreed, product updates (you can unsubscribe at any time);
• comply with legal obligations and enforce our agreements.

What we do not do. We do not sell personal information. We do not use one customer's confidential pricing to set or influence another customer's prices.

We may create aggregated or de-identified data that cannot reasonably identify any person, carrier or customer. We use it to understand and improve the Services, and we will not try to re-identify it.

4. MCP server and AI-agent Connectors

Pallet offers an MCP server so AI assistants and agents can use the Services on your behalf. This section applies whenever you connect Pallet to a third-party AI platform, such as Claude, ChatGPT or Meta's Muse, or to your own agents.

How you connect. You authorize a Connector through OAuth or an API key tied to your Pallet account. The Connector can only do what your account and the scopes you grant allow.

What we receive. When an agent calls a Pallet tool, we receive the inputs needed for that tool, such as shipment details to rate, and return the result, such as a quote. We also receive your authentication token and basic request metadata, such as the calling platform, time and tool name. We do not receive your conversation with the AI platform, only the tool inputs that it sends.

How we use it. We use Connector data only to fulfill the request you or your agent made, and to provide, secure, support and improve the Connector. We do not:

• sell Connector data;
• build data profiles unrelated to the Services;
• use Connector data to train AI models.

What the AI platform receives. The platform you use sees the requests it sends and the results we return. Its handling of that data is governed by its own privacy policy, not this one.

Credentials. We never place passwords, API keys, tokens or payment details in tool descriptions, tool responses, URLs or logs.

Revoking access. You can disconnect a Connector at any time, either in the AI platform or by email to support@usepallet.com. When you revoke access, we invalidate its tokens immediately and stop processing new requests from it. Connector data is then retained or deleted as described in Section 8.

5. Carrier pricing data and rate discoverability

Carrier pricing is confidential business information. We handle it as follows.

Ownership. Carriers own their pricing data. A shipper or 3PL that builds a pricing program on a carrier's behalf controls that program in Pallet's software until it is transferred to the carrier. Once transferred, the carrier controls it.

Who can see it. A pricing program is visible only to the account that owns it and to the users, customers or applications that owner authorizes.

Discoverability program. Carriers can choose to make some pricing available for public auto-rating in other Pallet-connected applications. This is opt-in. Participating carriers decide which pricing is shared, for which lanes and freight, and can withdraw at any time. Pallet does not publish a carrier's pricing without the carrier's authorization.

No cross-use. We do not disclose one customer's pricing to another customer, except as that customer has authorized.

6. How we share information

We share information only as described here, and only as much as each purpose requires.

• At your direction. When you send rates or shipments to a carrier, TMS, WMS, ERP, tracking provider or AI platform, we share what that request needs.
• Between parties to a shipment. Shipment details go to the carrier you select, and quotes go back to the shipper or 3PL that requested them.
• Service providers. We use vendors for hosting, data storage, payment processing, email delivery, error monitoring and support. They may use the data only to provide services to us, under written confidentiality and security obligations. A current list may be made available on request.
• Legal reasons. We may disclose information if required by law, court order or a valid government request, or where needed to protect the rights, property or safety of Pallet, our users or others.
• Business transfers. If Pallet is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that deal. This policy will continue to apply to it.

We never give a recipient broader rights to your data than we have ourselves.

7. Cookies and similar technologies

We use cookies and similar technologies on the Website and Application to:

• keep you signed in and remember your settings (essential cookies);
• understand how the Services are used so we can improve them (analytics cookies).

We do not use cookies for third-party advertising. You can block or delete cookies in your browser settings. Essential cookies are required for sign-in, so the Application may not work without them. Where the law requires consent for non-essential cookies, we ask for it first.

The API and MCP server do not use cookies. They authenticate each request with tokens.

8. Data retention and deletion

We keep information only as long as we need it for the purposes in this policy, or as the law requires.

When data is no longer needed, access is revoked, or you ask us to delete it, we delete it or make it inaccessible. Deleted data may remain in encrypted backups for up to 90 days before it is overwritten. We may keep limited records where the law requires it, or to resolve disputes and prevent fraud.

9. Security

We protect information with administrative, technical and physical safeguards suited to its sensitivity. These include:

• encryption in transit (TLS) and encryption of sensitive data at rest;
• logical separation of each customer's data;
• access limited to authorized personnel on a least-privilege basis;
• secure handling and storage of credentials, tokens and secrets;
• monitoring, logging and regular review of our systems.

No system is perfectly secure. If we learn of a security incident affecting your personal information, we will notify you, the platforms we are contractually required to notify, and regulators, as the law and our agreements require.

To report a security concern, contact security@usepallet.com.

10. International transfers

Pallet is based in Canada, and our service providers may process information in Canada, the United States or other countries. Those countries may have different data protection laws than where you live. When we transfer information across borders, we use contractual and other safeguards to protect it as described in this policy. Information held in another country may be accessible to that country's courts and authorities under its laws.

11. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• receive a copy of your information in a portable format;
• object to or restrict certain processing;
• withdraw consent, where we rely on it;
• opt out of marketing emails.

These rights may arise under laws such as Canada's PIPEDA and provincial privacy laws, the EU and UK GDPR, and U.S. state privacy laws, including California's. We will not discriminate against you for exercising them.

To make a request, email info@usepallet.com. We will verify your identity before acting and respond within the time the law requires. If we process your data for a business customer, we may refer your request to that customer.

You can also update account details and manage preferences in your account settings. If you are unsatisfied with our response, you may complain to your local data protection authority.

12. Other terms

Children. The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

Third-party services. The Services connect to systems we do not control, such as AI platforms, TMS providers, ELDs and tracking services. Their own privacy policies govern how they handle your data. We are not responsible for their practices.

Changes to this policy. We may update this policy as our Services or the law change. We will post the new version here with a new effective date. For material changes, we will also notify account holders by email or in the Application before the change takes effect.

Contact us. Questions, requests or complaints about privacy:

This policy should be read together with our Terms of Service at www.usepallet.com/tos.