Google API Compliance

FreightSurf is an AI-powered SaaS platform built for freight brokers. Users voluntarily connect their Gmail account to FreightSurf using Google OAuth 2.0 so that FreightSurf can identify carrier communications, extract freight information, verify carriers, and help brokers respond faster.

This page describes, in specific and technical terms, which Google OAuth scopes FreightSurf requests, what Google user data those scopes provide access to, how that data is processed and protected, and how FreightSurf's practices align with the Google API Services User Data Policy, including the Limited Use requirements.

FreightSurf helps freight brokers organize carrier responses, extract structured freight information from carrier emails, verify carrier identity, generate summaries, and streamline day-to-day freight operations.

FreightSurf uses a multi-stage filtering pipeline to process incoming Gmail messages. Every incoming message in a connected inbox is evaluated by this pipeline, but only a subset of messages are ever processed beyond the initial classification stage.

• Stage 1 — Classification: every incoming message is evaluated to determine whether it relates to freight operations (for example, a carrier responding to a load posting).
• Stage 2 — Filtering: messages determined to be unrelated to freight operations are excluded from all further, downstream processing, including AI processing. They are not summarized, extracted, or analyzed beyond this classification step.
• Stage 3 — Extraction: messages identified as freight-related continue through the pipeline, where structured freight information is extracted from the message content.

Structured Data Extracted From Freight-Related Emails

For messages identified as freight-related, FreightSurf extracts structured fields such as:

• Carrier name
• MC number
• DOT number (where available)
• Equipment type
• Origin and destination
• Lane
• Rate
• Carrier contact information (phone, email)
• Message timestamps

FreightSurf requests the gmail.send scope solely so that users can send replies to carriers directly from within FreightSurf, without needing to switch to Gmail.

• FreightSurf never sends emails automatically or on a schedule.
• Every outbound email requires an explicit, affirmative action by the user — composing or approving the message and choosing to send it.
• FreightSurf does not modify a message after the user has approved it for sending.
• Users remain responsible for the content of all communications sent from their account, whether drafted manually or with AI assistance.

Under the OAuth scopes described above, FreightSurf may access the following categories of Google user data:

FreightSurf follows the principle of least privilege in how it requests and processes Google user data.

• Only the minimum Google OAuth scopes required to provide the Service are requested — gmail.readonly and gmail.send. No broader Gmail or Google Workspace access is requested.
• Only freight-related emails continue past the classification stage of the processing pipeline.
• Emails determined to be unrelated to freight operations are excluded from further processing.
• Unrelated emails are never sent to, or processed by, any AI system.
• Google user data is never collected or retained for any purpose unrelated to providing FreightSurf's requested functionality.

FreightSurf uses AI to provide specific, disclosed features of the Service. AI is not used as a general-purpose analysis tool over a user's inbox.

• Freight classification — determining whether an inbound message is a freight-related communication.
• Information extraction — parsing freight-related message content into structured fields (carrier, MC number, lane, rate, etc.).
• Summarization — producing concise summaries of carrier communications.
• Suggested replies — drafting reply content for the user to review, edit, and choose whether to send.

In accordance with that policy, Google user data obtained through the Gmail API is never:

• Sold to any party.
• Licensed to any party.
• Transferred to advertisers.
• Transferred to data brokers.
• Used for targeted advertising.
• Used for unrelated profiling.
• Used for general AI model training.

FreightSurf applies the following security controls to Google user data and other account data. This section describes controls that are actually implemented, not aspirational goals.

• OAuth tokens are encrypted at rest and stored separately from other account data.
• All data transmitted between FreightSurf, your browser, and Google's APIs is encrypted in transit (TLS).
• Data stored at rest, including extracted freight data and OAuth tokens, is encrypted.
• Access to Google user data is authenticated and restricted to the systems and personnel that require it to operate the Service (least privilege).
• FreightSurf is hosted on established cloud infrastructure providers with their own security and compliance programs.
• Production access and system activity are monitored for security events.
• Users retain control over their own Google account access at all times (see Section 10).

Users are in control of their connection to Google at every stage:

• Connect Gmail to FreightSurf voluntarily, via Google's OAuth consent screen.
• Disconnect Gmail from FreightSurf at any time, from within FreightSurf account settings or from Google Account permissions.
• Revoke FreightSurf's OAuth access at any time from Google Account settings.
• Delete their FreightSurf account entirely.
• Request deletion of any Google-derived data stored by FreightSurf.

When a user disconnects Google or revokes access, FreightSurf revokes and deletes the associated OAuth tokens and stops making any further Gmail API calls for that account. Full details on retention timelines are in the Privacy Policy.

FreightSurf relies on a small number of categories of third-party providers to operate the Service. Each provider receives only the data necessary to perform its specific function.

A complete, named list of subprocessors is maintained in the Privacy Policy.

• Does not replace Gmail.
• Does not send cold emails.
• Does not perform email marketing.
• Does not warm inboxes.
• Does not sell user data.
• Does not profile users for advertising.
• Does not use Google Workspace data to train AI models.
• Does not transfer Google user data to advertisers or data brokers.

If you are a Google OAuth reviewer, an enterprise security team, or a user with questions about how FreightSurf handles Google user data, contact us at privacy@freightsurf.com. We aim to respond to compliance and security inquiries within 5 business days.