Terms of service

01What this document is

These terms are intended to govern the supply of the CargoSharks software to a customer — a freight forwarder — and its use by that customer’s staff, and by the customers and agents that customer invites into it.

They are meant to be read with two others: the privacy policy, which describes what is held and by whom, and the data-processing addendum, which governs personal data. Where they conflict, the order form prevails, then the agreement, then the addendum on anything concerning personal data, then these terms.

02Who you are contracting with

The contracting entity is CargoSharks Freight Technologies. Its registered particulars, and the entity contracting in each market, are stated in the agreement.

“CargoSharks” below means that entity. “You” means the organisation named on the order form, not an individual who signs in.

03What is supplied

CargoSharks is supplied as one deployment per customer. That is not a packaging choice on top of a shared system — it is the architecture. There is no tenant identifier anywhere in the schema, because there is no second tenant in the database to distinguish you from.

1. Your own database. Your data is in your own PostgreSQL database, in your own instance, in a region agreed with you and recorded in the order form. Not a shared table with a customer column in it.
2. Separation inside the deployment is enforced by the database. Branch separation is written as row-level security policies rather than as filters in application code. A request for a branch you do not hold returns not found, because the row is not in the answer at all. The application connects as a role with no ability to bypass those policies.
3. Your brand, and nowhere ours. No colour, logo or company name is written into the product. The operator is a setting. Documents your customers receive carry your entity’s name and your branch’s own numbering series.
4. Both languages. The interface, the documents, the portal and the public tracking page are in Arabic and English, with right-to-left in the layout rather than applied to it.
5. An audit trail you cannot switch off. Every change to a business record is written to an audit log by database triggers. That is a property of the deployment, not a feature with a toggle. Its limits are described in the privacy policy, section 08.
6. Nothing is deleted. The application’s database account holds no delete permission on any table. Records are superseded, closed or deactivated. Read section 09 of the privacy policy before agreeing to anything about retention or erasure, because this constrains both.

A deployment can be operated by us on your behalf or run in your own cloud account, and the agreement records which. That choice decides who holds the cloud account and who carries the infrastructure obligations in section 08 — in a customer-operated deployment those are yours.

04The pilot

The pilot is a fixed-scope, fixed-fee engagement: your rate card, your customer and agent lists, fifteen to twenty-five of your own completed job files, your logo, and ninety minutes with whoever runs your operation — built into a working deployment in fifteen working days from the day your data arrives, rather than from signature.

1. It is built on your deployment, in your region, under your brand. Nothing built during the pilot is thrown away if you proceed.
2. The fee is fixed and, if you proceed, is credited against the full implementation. The fee, what it covers and the period over which it is credited are on the order form. If you do not proceed, the deployment stays up for thirty days so that you can take a full export.
3. What is outside the fixed scope, and what it costs if you want it, belongs on the order form rather than here. Rate-card cleaning, additional legal entities and historical migration beyond the agreed job files are the usual exclusions, and each is priced on the order form.

05Your data is yours

1. Everything you put into the deployment, and everything the product derives from it, is yours. CargoSharks claims no ownership of it and no licence to it beyond what is necessary to run the service for you and to support it when you ask.
2. Your data is not used to train anything. No model is trained, fine-tuned or evaluated on your records by us. Where you switch the model surface on, requests go to the provider you configured, on your key — and that provider’s own terms then apply to those requests, which is a matter between you and them. See section 10 and privacy, section 07.
3. An export in an open format is available on request, at no charge, for as long as the agreement runs and for thirty days afterwards.
4. One honest qualification on the previous clause: a single self-service action that produces a complete export is specified and not built. Today an export is assembled for you on request. A financial-journal export and the cutover import templates are in the product and are self-service.
5. The schema is documented. If you leave, there is nothing to disentangle, because nothing was entangled — your database was never shared with anyone else’s.

06How you may use it

You may use the deployment to run your own forwarding business, including inviting your customers and your agents into the portals built for them. You may not:

• resell or sublicense access to organisations that are not your customers or your agents, or operate the deployment as a service for a third party;
• attempt to reach data outside the branches and role you hold, or to bypass the database policies that enforce that;
• connect a mailbox you are not entitled to read, or configure an integration with credentials that are not yours to use;
• put data into the system that you have no right to process — the model surface in particular sends what you feed it to a third-party provider;
• use the software to break the law of the place you are operating in, including sanctions and export controls that apply to freight.

We will ask you to put a breach of this section right within thirty days. Where a breach is unlawful, or puts other people’s data at risk, we may suspend the affected access immediately and ask afterwards.

07Accounts, branches and permissions

1. You appoint your own administrators. They create accounts, assign branches and roles, connect mailboxes and integrations, and grant or revoke our support access. We do not do any of that on your behalf without a grant from you.
2. Accounts belong to named people. Sessions last twelve hours and are checked against the database on every request, so deactivating an account takes effect immediately rather than whenever a token expires.
3. Accounts are deactivated, never deleted — see section 03.6. A deactivated account cannot sign in and remains attributable in the audit trail, which is the point.
4. You are responsible for who you give access to, and for the credentials your people hold. The product does what it can to help: passwords are at least twelve characters, five failed sign-ins lock an account for fifteen minutes, sign-in attempts are rate limited per address, and two-factor authentication is required for the Administrator and Finance roles — an account that holds one of them cannot reach any screen until it has enrolled.

08Availability and support

Nothing in this section is decided. It is listed in full because a reviewer will look for it, and an empty section is more honest than an invented one.

The uptime commitment, how it is measured, the maintenance window, support hours, and the response targets by severity are set out in the agreement. Announced maintenance is scheduled outside the Sunday-to-Thursday working week across every country a deployment serves.

What can be said today: backup tooling exists and is used, restores are drilled into a scratch database and verified by row count and schema rather than by the restore command’s exit status, and the specification asks for daily backups kept fourteen days, weekly off-site copies kept thirty, and quarterly restore drills evidenced in writing. Retention, off-site copying and encryption of those dumps are properties of the storage they are written to, and are not implemented by the tooling itself. The recovery-point and recovery-time objectives we commit to for your deployment are stated in the agreement.

09Our access to your deployment

We have none until you grant it. The mechanism is described in full in privacy, section 11; the commitments that follow from it are:

1. Support access is created by your administrator, scoped to branches they choose, against a reason the database will not accept as empty.
2. Read access is structurally read-only. Write access requires a deliberate, typed escalation and is limited to updating existing records — a support session cannot create users or change your permission matrix.
3. Every grant expires on its own within eight hours at the most, two by default. A support principal cannot extend or renew its own access.
4. A banner names the engineer, the scope, the reason and the expiry on every internal screen while a grant is open, and you can revoke it in one click.
5. Every session opened under a grant is logged, insert-only, and the access count is visible to you against every grant ever issued — without asking us.
6. Separately from support access, the role that owns the database schema can alter any table, including the audit log. It is not used at runtime and is not held by support; migrations are applied by continuous integration from tagged commits. In a customer-hosted deployment you hold that credential, and we use it only with your agreement and only to apply a migration from a tagged commit.

10Services you provision yourself

Every external service the product can talk to is off by default and is turned on by you, with your credentials, from your own settings screen. The software has no vendor account to fall back on.

1. Carrier tracking runs on your own carrier API credentials. It is built for Maersk, Hapag-Lloyd and CMA CGM over the DCSA standard, and it does not run until you hold those credentials. Registering once on all customers’ behalf is not something the carriers permit, and we do not do it.
2. Mail — the outbound relay and the inbound mailboxes — is yours. We bundle no provider.
3. Object storage is S3-compatible and is yours to point at.
4. The model surface is off unless you supply a key. When it is on, requests go through OpenRouter, and a supplier-invoice reading sends the whole document. Read privacy, section 15 before enabling it if you have data-residency obligations.
5. We are not responsible for those services’ availability, their terms or their pricing. Where one is unavailable, the feature that depends on it degrades and says so rather than failing silently.

11What the product does not do

Stated here as a term rather than left to the sales conversation, so that nothing below can be a surprise in week three.

• It does not file customs declarations. Kuwait clearance runs through a concession-held system that is not an interface a forwarder can buy. The product tracks declarations and estimates duty from a tariff table; it files nothing, and that is a decision rather than a gap.
• It does not transmit e-invoices. Invoice data carries tax treatment and rate per line, and the hand-off to an accredited provider is built as a plug. No provider has been appointed and the mandated document format is not generated. The UAE timetable in the specification is a provider appointment due 30 October 2026 and go-live on 1 January 2027 for the largest filers; the Saudi ZATCA path carries no date.
• It does not issue master carrier documents. A master bill is the carrier’s document on the carrier’s stock. House documents are generated.
• There is no warehouse module, no purchase-order management and no native mobile application. Proof of delivery works from a phone browser.
• The agent portal answers rate requests and no more in this release. Milestone posting, document upload and performance views are not built.
• WhatsApp is not connected. The webhook verifies signatures and nothing consumes it. Nothing is sent and nothing is read.
• Accounting is an export, not a connector. A journal your accountant can import, guarded against exporting a period twice.
• Scheduled reports are not built. The job is registered; there is no handler and no schedule.

The current state of each of these, with dates where dates exist, is on the scope section of the home page, which is read from the specification’s own build-status table. Where that page and this section ever disagree, the specification is right and both should be corrected.

12Fees

The implementation fee, the subscription and what it is priced on, the currency, the invoicing frequency and the payment terms are on the order form. Any tax is added unless the order form says otherwise.

One commitment can be made now because it is a product decision rather than a pricing one: the subscription is not priced per shipment. Volume pricing charges a forwarder more for growing, which is the opposite of what a system of record should do to them.

13Confidentiality

Each side keeps the other’s confidential information in confidence, uses it only to perform the agreement, and does not disclose it except to people who need it and are under the same obligation. This does not cover information that is public through no fault of the receiver, was already held without an obligation, or must be disclosed by law. The obligation survives the agreement. A separate non-disclosure agreement, where one is signed, takes precedence.

Your rate cards and your customer list are the most commercially sensitive things in the deployment, and they are yours.

Naming you as a reference customer requires your written permission, and is not implied by anything in this agreement.

14Intellectual property and escrow

1. The software, and everything in it that is not your data, remains ours. You get a licence to use it for the term, for your own business.
2. Your data, your brand and your documents remain yours — see section 05.
3. Source escrow is available on request. That is offered because the question “what if you go out of business” is a real one for a small supplier and is better answered than avoided: your deployment is your own database in your own instance, the schema is documented, and the export is available at any time. The agent, the release conditions and who bears the cost are agreed with you when you ask for it.

15Warranties, and their limits

What can be warranted honestly today is narrow, and it is better to say so.

1. We warrant that the software will perform materially as described in the documentation supplied with it, and that the description of the product in sections 03, 05, 09, 10 and 11 above is accurate as at the date of this document. If it does not, tell us and we will fix it — that is the remedy; beyond that warranty and anything that cannot be excluded by law, the software is supplied as it is.
2. No certification is warranted. There is no SOC 2 report, no ISO 27001 certificate, no penetration test and no independent security audit. The security properties described are checked against a live database by the project’s own tests. That is verification by us; it is not attestation by anyone else.
3. The product does not give tax, customs or legal advice. A duty estimate is an estimate from a tariff table, kept beside the assessed figure precisely so the two can be seen to differ.

16Liability

The limit of liability, and what it is measured against, are stated in the agreement. Neither side is liable for indirect or consequential loss, or for loss of profit, revenue or goodwill. Nothing in the agreement limits a liability that cannot be limited by law.

17Term, termination and exit

The initial term, how it renews and the notice each side must give are on the order form. Either side may end the agreement for a material breach the other has not put right within thirty days of being told about it.

What follows from the build, whatever the commercial terms turn out to be:

1. An export in an open format is available on request while the agreement runs and for a period afterwards — see section 05.
2. Your data is yours. The deployment is your own database, in your own instance, and it can run on your own infrastructure. We do not own your data, and where you host it yourself we hold no copy of it — so deletion at the end is yours to make, not ours to withhold.
3. The deployment stays up for thirty days after termination so that you can take a full export. After that, on your written instruction, what remains — the database, the object store and the backups taken from them — is destroyed, by you where you host it and by us where we host it for you.

18Changes to these terms

We may change these terms on thirty days’ written notice. If a change is materially adverse to you, you may end the agreement without penalty before it takes effect. The commercial terms on a signed order form do not change except by agreement.

19Governing law

The governing law and the forum for any dispute are stated in the agreement, and are settled with each customer according to where they are established and where their deployment is hosted.

This is not a formality here. The product is sold across Kuwait, the UAE, Qatar and Saudi Arabia, hosted in a region the customer picks, and possibly hosted in the EU. Those are four or five legal systems and the choice interacts with the data-protection question in privacy, section 02.

20Contact

Notices, questions and anything that needs a person: [email protected].

Formal notice may be given by email to the address each side names in the agreement, and takes effect on the next working day. The registered address of the contracting entity is stated in the agreement.