Privacy Notice
Zuletzt aktualisiert 2026-10-27
This notice explains how CARGO1 US LLC ("we") handles personal data, under the EU GDPR and the UK GDPR wherever they apply, and applicable US law. Nucra acts in two different roles, described below.
Two roles: controller and processor
Nucra is a controller for data it decides the purposes of, and a processor for data a customer enters about other people. • As controller — registration data, subscription contracts and invoices, security and logs, communication with the customer, account management, and our own product analytics if used. • As processor — data a customer company enters about its staff, drivers, counterparty contacts, recipients, GPS positions, transport documents and request communications. For the processor role a separate Data Processing Agreement (DPA) applies. This notice covers the controller role.
Controller
The controller is CARGO1 US LLC, Wyoming limited liability company, registered office 30 N Gould St, STE R, Sheridan, WY 82801, USA. For privacy questions or to exercise your rights, contact support@nucra.io.
What we process
Data you submit through our forms (name, company, work e-mail, phone, company ID/VAT for access requests, and any message); technical data needed to serve the site (chosen language, a coarse country signal derived from your IP for language routing, and standard server logs including IP address and browser type kept for security); and, for customers, the account and billing data needed to provide the platform.
Purposes and legal bases
To respond to demo and access requests and take pre-contractual steps at your request (Art. 6(1)(b); consent where applicable, Art. 6(1)(a)); to operate, secure and improve the website and platform (legitimate interest, Art. 6(1)(f)); and to meet legal obligations, including accounting and tax duties (Art. 6(1)(c)). We do not carry out advertising profiling or automated decision-making that produces legal effects concerning you.
Recipients and processors
We share data only with processors acting on our instructions to run the service — in particular cloud hosting/infrastructure and an e-mail delivery provider. They are bound by data-processing agreements. Our current subprocessors are listed on the Subprocessor List. We do not sell personal data or share it for third-party marketing.
AI-assisted features
Some features use a large-language-model provider to READ what you give them — nothing is decided without you: • what is sent — only the item being processed: an uploaded invoice or scan, a pasted request text, a bank statement, an inbound enquiry e-mail, an import file, or your question in the in-app assistant; • what is never sent — passwords, two-factor secrets, API keys, GPS traces, your document archive, or any data belonging to another customer; • the provider processes it to return the extracted fields or the answer, does not use it to train its models, and does not retain it for its own purposes; • the result is a suggestion: extracted fields are shown for you to check and edit, imports are created as drafts, and nothing reaches an accounting export until a person marks it verified; • you can see every AI call your company has made — feature, model and cost — in Settings.
International transfers
Because the operator is in the United States and some providers are elsewhere, personal data of EU/EEA and UK users may be transferred outside the EEA/UK. We rely on adequacy decisions (including the EU–US Data Privacy Framework and its UK Extension where the recipient is certified) or on the EU Standard Contractual Clauses / UK IDTA, with appropriate additional safeguards, and we maintain the corresponding contractual chain with the provider concerned.
Retention
Enquiry and access-request data is kept only as long as needed to follow up and for a reasonable period afterwards, then deleted. Customer and accounting records are kept for the periods required by applicable law (in particular US federal and state tax record-keeping) and then deleted or anonymised. See the Security & Data Retention summary for details.
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection (for processing based on legitimate interest); where processing is based on consent you may withdraw it at any time without affecting prior processing. Write to support@nucra.io. You may also complain to the supervisory authority: the data protection authority of the EU/EEA country where you live or work, or, in the United Kingdom, the Information Commissioner’s Office (ICO, www.ico.org.uk).
Information about data not obtained from you
Where a customer provides us with personal data about its staff, drivers or counterparties (the processor role), the customer is responsible for informing those individuals under Art. 14 GDPR. We assist the customer with such requests as set out in the DPA.
Changes
We may update this notice; the "Last updated" date reflects the current version and material changes will be highlighted.