Last updated 2026-09-25

Privacy Policy

This Privacy Policy explains what data Keelway ("Keelway," "we," "us") collects from users of keelway.com (the "Site") and the Keelway carrier-email triage application (the "Service"), how we use that data, who we share it with, and what rights you have over it.

Keelway is operated by Keelway, Inc., a Delaware C-corporation with a principal place of business in Atlanta, GA, USA. Questions about this policy should go to hello@keelway.com.

1. What we collect

1a. From visitors to keelway.com

Standard request data — IP address, user agent, referrer, and pages visited, captured by our hosting provider (Vercel) and our web analytics tools (Google Tag Manager / Google Analytics, Microsoft Clarity).
Contact-form submissions — name, email address, company, role, and the message you submit through the form on keelway.com/contact. We use Resend to deliver these to our team inbox.
How you reached a form — when you accept analytics, we keep your first landing page and time, the current visit’s campaign tags and referring website, and a limited history of public pages and navigation links you select. When you submit a form or request a Lane workspace link, we attach that context and any available pseudonymous analytics session identifiers to the request for our team to review. This history excludes form-field contents, chat text, private workspace pages, and authentication links. We do not send your name, email, or message to Google Analytics as part of this attribution feature. Without analytics consent, we retain only limited context supplied with your request; a missing referral is treated as unknown, not evidence of a particular traffic source.

1b. From customers using the Service

Account data — your name, work email, company name, role, and the TMS your brokerage runs.
Routed carrier mail — Keelway does not connect to your Gmail, Outlook, or any other mailbox, and does not ask for a Google OAuth grant. Your brokerage is issued a Keelway-hosted reply address, which you publish as the contact on your load postings. Keelway receives only the mail delivered to that address. Your own inbox is never accessed.
Carrier reply content — the text and attachments of inbound carrier emails we triage on your behalf, including extracted rate, MC/DOT, equipment, origin, destination, and contact metadata.
FMCSA carrier data — public FMCSA QCMobile records pulled per carrier to compute the trust score. Keelway does not currently send carrier data to, or pull it from, third-party carrier-identity providers. If that changes we will update this policy and ask for your authorization first.
TMS data — when you connect a TMS (Tai, McLeod, Aljex, Revenova, Turvo, Rose Rocket), Keelway reads load metadata and writes accepted carriers + agreed rates back into the load record. We do not read billing, shipper, or settlement data unless you explicitly enable those features.
Usage data — actions you take in the Keelway dashboard, including which carrier you accepted / countered / declined per load, which is used to calibrate ranking weights for your brokerage.

Website conversations with Lane

When you message Lane on the website, we save your messages, Lane’s replies (including interrupted replies), timestamps, and the page where the conversation started. Keelway’s authorized team can review these conversations to answer product questions, provide support, understand interest in the platform, and improve the experience. Messages are processed by Anthropic to generate replies and stored in Supabase. Please do not include passwords, credentials, or private load details.

A secure, essential browser cookie lets you reopen your conversation on the same browser for up to 30 days. The cookie is separate from your Keelway account. Starting a new chat does not delete earlier conversations from Keelway’s records. Website chat does not access your private workspace or automatically transfer its transcript into that workspace.

If you choose “Email me the link,” we record the address you confirm, your request and its time, and the email provider’s send status. Resend sends one requested link to the Keelway login page. This does not verify ownership of the address, sign you in, or enroll you in marketing emails. We keep transcript text and email addresses out of our chat analytics events, and mask the conversation interface from session recordings.

2. How we use it

To provide the Service — extract rates, score trust, rank replies, write back to your TMS, and surface ranked lists in your Keelway dashboard.
To improve ranking accuracy — your historical accept / counter / decline decisions are used to tune the ranking weights for your brokerage. We do not use one customer's data to train models served to other customers.
To detect fraud — email-domain checks, FMCSA authority drift, double-brokering signals, and chameleon-carrier flags. Flagged signals are surfaced to you, not to other customers.
To communicate with you — service notifications (deploy, downtime, security), feature updates, and (only if you opt in) marketing emails.
To meet legal obligations — comply with applicable law, respond to lawful requests, enforce our Terms.

3. No mailbox access

Keelway does not use Google API services to read your mail. There is no Gmail integration in the product, no OAuth consent screen, and no Gmail API scopes requested or held. Nothing to grant means nothing to revoke.

Mail reaches Keelway one way only: it is delivered to the Keelway-hosted reply address issued to your brokerage, which you choose to publish on your load postings. Replies Keelway sends go back out from that same address, threaded so the carrier sees a normal conversation. To stop the flow, stop posting the address, or ask us to retire it — either ends it immediately.

4. Subprocessors

Keelway uses the following third-party processors. Each is bound by data-processing terms and is used only as necessary to operate the Service.

Vercel — application hosting and edge request handling.
Supabase — managed Postgres database and object storage.
Anthropic — language-model inference for email parsing, trust-signal extraction, and Lane chat replies. Carrier email content is sent for inference and is not used by Anthropic to train their models per their commercial terms.
Resend — inbound carrier mail routed to your Keelway reply address, plus outbound transactional and contact-form emails.
FMCSA (public QCMobile API) — public carrier authority and safety data.
Google Analytics — site analytics on keelway.com.
Microsoft Clarity — site behavior analytics on keelway.com.
Leadsy — business visitor-intent analytics, loaded only after analytics and marketing consent.

A current subprocessor list is maintained on request — email hello@keelway.com.

5. Data retention

Carrier reply data — retained while your account is active; purgeable on request within 30 days of a written deletion request. Deleted on account closure unless you ask us to retain it.
Account + usage data — retained while your account is active. Deleted within 90 days of account closure, except where we are required to retain records to meet legal obligations.
Contact-form submissions — retained for up to 24 months in our team inbox.
Backups — retained for up to 30 days beyond active deletion to support disaster recovery.

Website chat histories and requested-email records remain in our conversation records for product inquiries, support, and follow-up. Browser access expires after 30 days; this does not automatically erase the stored history. To request access or deletion, email hello@keelway.com with the approximate conversation date and any address you provided. We may request information to verify that the conversation is yours.

Submitted attribution is kept with the related lead or requested-email record. Clearing browser storage or later declining analytics stops new tracking; it does not delete a request you already submitted. You can request access or deletion using the contact details above.

6. Security

Data is encrypted in transit (TLS) and at rest. Access to customer data inside Keelway is restricted to a small number of authorized engineers and only for support, debugging, and security purposes. We log all access. We will notify affected customers of any confirmed data breach affecting their data without undue delay.

7. Your rights

Depending on where you live, you may have rights to access, correct, port, or delete your personal data, and to object to or restrict certain uses of it. You can exercise any of these by emailing hello@keelway.com. We will respond within 30 days.

California residents have rights under the CCPA / CPRA; European users have rights under the GDPR; UK users have rights under the UK GDPR. Keelway does not sell personal information.

8. Cookies

The Site uses essential cookies for authentication and a small number of analytics cookies and browser storage after you accept analytics. Our first-visit attribution expires after 90 days; the current visit’s limited navigation history uses session storage and starts a new session after 30 minutes of inactivity. Declining prevents this persistent attribution history and analytics identifiers from being attached to your request. Source-page context and information you deliberately submit can still be saved with the request. You can disable cookies in your browser; disabling essential cookies prevents secure sign-in and saved website-chat continuity.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from anyone under 16.

10. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the most recent change. Material changes will be communicated to active customers by email at least 30 days before they take effect.

11. Contact

Email hello@keelway.com or write to Keelway, Inc., Atlanta, GA, USA. For DPA / data processing addendum requests, mention "DPA" in the subject line.