1. Who this policy covers
This policy covers visitors, account users, business contacts, supplier and logistics contacts, and people whose information is included in a customer's procurement records. Waybill is responsible for information used to operate its own website, accounts, business relationships and service administration. When we process workspace content on a business customer's behalf, we act under that customer's instructions and applicable agreement.
Your organization controls its workspace, membership, permissions and procurement records. Administrators and other authorized members may access shared content. Signing up with a company email domain may associate you with your company's workspace. Contact your organization about its own privacy practices and requests concerning records it controls.
2. Information we collect
Account and contact information: your name, work email, profile image, organization, role, account identifiers, authentication information and communications with us. Google Sign-In provides account information such as your name, email address and profile picture; signing in does not by itself connect your Gmail inbox.
Procurement and workspace information: requests, chats, uploaded files and bills of materials, part specifications, quantities, supplier quotes and correspondence, approvals, orders, invoices, shipping and billing addresses, contact telephone numbers, tax or business registration details, delivery information and inventory records that you or your organization provide or generate.
Connected-service information: account identifiers, access tokens, supplier login details, browser sessions and information obtained through integrations you authorize. Where a feature saves supplier passwords or Gmail refresh tokens, we store those secrets in an encrypted vault. Avoid entering unrelated sensitive information in chats or files.
Payment and usage information: billing contact details, plan and usage records, payment or transaction identifiers, authorization status, and limited card details such as card brand, last four digits and expiry. Payment providers handle the payment credentials submitted through their interfaces. Information visible during an authorized checkout may also be processed by our checkout service providers.
Technical information: IP address, browser and device characteristics, approximate location derived from IP address, pages visited, referrer, feature interactions, timestamps, diagnostic logs and security events. We also receive relevant business, quote, order and shipment information from your organization, suppliers, service providers and public sources.
3. How we use information
We use information to authenticate users; create and administer workspaces; process requests and documents; find and compare suppliers; facilitate authorized supplier communications, account creation, checkout and payment; track orders; and maintain procurement and inventory records. Features are available only where enabled for your account or agreed with you.
We also use information to provide support and service notices, calculate usage and fees, diagnose problems, improve service functionality and reliability, prevent fraud and abuse, enforce agreements, and comply with legal requirements. We may contact business contacts about Waybill; you can opt out of marketing messages while continuing to receive necessary account and transaction notices.
Where applicable law requires a legal basis, we rely on performance of a contract, legitimate interests such as operating and securing our business, compliance with legal obligations, or your consent where required. You may withdraw consent for optional processing; this does not affect processing already carried out lawfully.
4. AI and automated workflows
Waybill uses AI and browser automation to interpret requests, search for products, compare information and carry out enabled workflows. Relevant inputs, conversation context, documents, tool results, webpage content and workflow information may be processed by AI and automation providers, including Anthropic and Browser Use, depending on the feature. Procurement search providers receive the queries and context needed to source your request.
Remote browser sessions used for automation are recorded, including information visible on pages and during a manual takeover. Recordings are available to the requester and workspace administrators and may be used for workflow history, troubleshooting and support. Avoid displaying unrelated private information in those sessions.
AI processing is part of delivering the service. We do not use customer content to train general-purpose AI models or authorize that use by our service providers. This does not mean processing is ephemeral: service records, diagnostic logs and provider records may be retained for the purposes described in this policy. Automated outputs can be inaccurate; review specifications, suppliers and transaction details before relying on them.
5. Google and optional Gmail access
Connecting Gmail is optional and requires separate Google authorization. The integration requests read-only Gmail access. During an active supplier workflow you initiate, it searches recent messages associated with the supplier to find account-verification emails, codes or links needed to continue that workflow. The permission technically allows reading email; our use is limited to the disclosed workflow. This integration does not request permission to send mail from your Gmail account.
We process relevant message identifiers, senders, subjects and message text. The current verification flow skips attachments. We store connection details and an encrypted refresh token. Relevant email subjects, message identifiers, extracted codes or verification links may be included in workflow state or audit records. Codes or links needed to complete the task may be passed to our browser automation provider. Limited information extracted from a relevant message may appear in workflow records visible to authorized workspace members. Your entire inbox is not made available to the workspace through this feature.
Waybill's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace API User Data and Developer Policy. Google user data, including data derived from it, is used only to provide or improve the user-facing features you authorize. It is not sold, used for advertising, used to assess creditworthiness, or used to develop, improve or train generalized AI or machine-learning models.
We transfer Google user data only as permitted by those policies: with your consent to provide or improve the authorized feature, for security, to meet applicable law, or for a business transfer after your explicit prior consent. Human access is limited to your affirmative agreement to specific data access, necessary security or legal purposes, or permitted aggregated internal operations. These restrictions override any broader sharing language in this policy.
You can disconnect Gmail in Waybill or revoke access in your Google Account permissions. Disconnecting removes the connection and its stored refresh token from Waybill and stops future access through that connection. Previously created procurement and workflow records are subject to the retention and deletion provisions below; revoking access alone does not erase those records. To request deletion of Google-derived information, email hello@waybill.to.
8. Retention and deletion
We retain information for as long as needed to deliver the service, maintain business and transaction records, meet legal or accounting obligations, resolve disputes, prevent abuse and enforce agreements. Retention depends on the type of information, your organization's instructions, outstanding transactions, legal requirements and operational needs. We delete or de-identify information when it is no longer needed for those purposes.
You or your workspace administrator can request account or workspace deletion by emailing hello@waybill.to. Some features also offer deletion or disconnection controls. Removing an address, connection or member does not necessarily erase historical order records. Limited billing, fraud-prevention and legal records, and backup copies pending their normal expiry, may remain where necessary. External providers may retain information they independently need under their policies or applicable law.
Removing a card reference from Waybill does not itself revoke a payment provider's permissions. Manage or revoke those permissions with the relevant provider, such as AgentCard. We can help identify the relevant connection when you contact us.
9. Security and international processing
We use technical and organizational measures intended to protect information, including access controls, encrypted connections and encrypted storage for integration secrets. No system or transmission is completely secure. Keep your account secure, limit workspace access appropriately and contact us promptly if you suspect unauthorized use.
Waybill and its service providers may process information in countries other than where you live. Privacy laws differ between countries. Where applicable law requires safeguards for international transfers, we use the required contractual or other lawful transfer arrangements. Contact us for information about the arrangements relevant to your data.
10. Your choices and privacy rights
Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your personal information, restrict or object to certain processing, withdraw consent, and complain to a data-protection authority. We will handle requests within the time required by applicable law and will not discriminate against you for exercising a protected right.
Email hello@waybill.to with your request and the account or organization involved. We may verify your identity and authority before acting. If we process the information for your organization, we may refer the request to its administrator or assist it in responding. Rights may be subject to lawful exceptions, including records we must retain and information concerning other people.
You can also update available profile settings, ask your administrator to correct workspace records, disconnect optional integrations and opt out of marketing through the message's unsubscribe method or by contacting us.
11. Children
Waybill is a business service intended for adults aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.
12. Changes to this policy
We may update this policy as our services and practices change. We will post the updated policy and revise the date above. For material changes, we will provide an appropriate notice, such as an in-product notice or email, and obtain consent where required before applying a new use of information.
13. Contact us
For privacy questions, complaints or requests, contact Waybill, Inc. at hello@waybill.to. Please use the subject Privacy request and include enough information to identify the relevant account; do not send passwords or full payment-card details.