Privacy policy
Last updated: 20 August 2026
Questions: hola@estibra.com · Legal notices: legal@estibra.com
The short version (10 lines)
- You are a courier. We run a robot that works inside your own software, on your instruction.
- To do that we hold your account details, your robot login, and the shipment data the robot reads and types.
- Your shipment data belongs to you. We are the hands, not the owner.
- You forward pre-alert emails to your Estibra address. We read them only to pull out tracking and shipment data.
- We delete those emails 30 days after we process them. We keep activity logs for 90 days.
- Your robot password is encrypted, is a limited user you create, and is rotated daily.
- We do not sell your data. We do not use it for advertising. We do not use it to train AI models.
- Only three kinds of company touch it: our hosting provider, our email provider, and our payment processor.
- You can ask for a copy of your data, ask us to delete it, or turn the robot off, at any time.
- Everything is month-to-month. Cancel any time, and we destroy the credentials and delete the data.
1. Who we are
Estibra LLC (in formation) is a Florida limited liability company based in Miami, Florida.
Estibra sells one thing: a robot that operates courier software you already pay for, plus a small local agent that runs on your own computer. This policy explains what information we handle, why, how long we keep it, and what you can ask us to do with it.
This policy covers estibra.com, your client panel at your own subdomain (for example acme.estibra.com), your forwarding address (for example acme@in.estibra.com), and the local agent.
2. Who this policy is written for
There are three groups of people in this document, and they are treated differently.
- Visitors to our website. People who read the site or fill in the contact form.
- Our clients and their staff. The courier company that pays us, and the people at that company who log in to the panel.
- Your customers — the people on the packages. Senders and consignees whose names, addresses and tracking numbers pass through the robot. We never contact these people. We only handle their information because you told us to, as part of doing your work.
For group 3, you are the one who decides what happens to that data and we simply follow your instructions. In privacy law that makes you the controller and us the processor. In plain words: it is your data, we are staff you hired.
3. What we collect
3.1 Contact form and emails to us
Your name, company name, email address, phone or WhatsApp number if you give it, and whatever you write in the message. We use it to answer you and to keep a record of the conversation.
3.2 Account and panel data
Company name, billing contact, the names and work emails of the people you give panel access to, their passwords in hashed form, and a record of who logged in and when.
3.3 Your robot credentials for CargoTrack and similar systems
You create a robot user inside your own courier software and give it to us through the panel. We store that username and password encrypted, both while it sits on our servers and while it moves across the internet.
We use those credentials for one purpose only: to log into your account and do the work you set up. We never use them to reach any account other than yours, we never share them, and the password is rotated daily.
3.4 Forwarded pre-alert emails and their attachments
You set a forwarding rule in your own mail system so that pre-alert emails arrive at your Estibra address. We receive the message, the sender and subject line, the body, and any attachments such as PDFs, spreadsheets or manifests.
We read those messages only to extract tracking numbers and shipment data and to put that data where it belongs in your system. We do not use the content for advertising. We do not sell it. We do not use it to train AI models. No person at Estibra opens one of your messages except to fix a specific failure you have reported to us, and every one of those openings is logged.
We do not use Gmail sign-in and we do not connect to your mailbox. Forwarding is a rule you set and a rule you can remove.
3.5 Label photos
When someone on your floor photographs a label with a phone, we receive that image and read the tracking number and carrier from it. The image may also show a name and an address because that is what a shipping label is. We keep the reading; we delete the image on the same schedule as forwarded email.
3.6 Dimensioner readings
Weight, length, width, height, the timestamp, and the package the reading belongs to. This comes from your iDimension unit through the local agent. There is no camera feed and no image of a person in this stream.
3.7 Robot activity and dashboard use
Every action the robot takes is written to an activity log: what it did, in which account, at what time, and whether it worked. We also record which pages of the panel your staff open, and errors the browser reports. This is how the guardian agent notices a stuck robot at three in the morning, and how we prove to you what the robot did.
3.8 Billing
If you pay us, our payment processor handles the card. We never see or store full card numbers. We keep the invoice, the amount, the date, and the last four digits.
3.9 Cookies and analytics
Your client panel uses a session cookie so it can keep you logged in. Anything beyond that is described on our cookie policy page, which is the single place we keep that list current.
4. Why we use it
We only use information for the reasons below. If we ever want to use it for something else, we will ask you first.
| What we use | What we use it for |
|---|---|
| Contact form | Reply to you, prepare a quote, keep a record of the conversation |
| Account and panel data | Let you log in, keep your account separate from every other client, support you |
| Robot credentials | Log into your own account and run the automation you set up |
| Forwarded email and attachments | Extract tracking and shipment data and enter it into your system |
| Label photos | Read the tracking number and match the package |
| Dimensioner readings | Enter weight and dimensions without typing |
| Activity logs | Show you what the robot did, detect failures, investigate incidents, prevent abuse |
| Billing data | Charge the monthly fee, keep tax and accounting records |
Legal basis, in plain words. We handle this information because we need it to do the job you are paying us to do, because we have a legitimate interest in keeping the service running and secure, and because some records have to be kept by law, such as tax records. Where the law that applies to you requires the consent of the people on the packages, obtaining that consent is your job as the controller, not ours. We act on your instructions.
5. What we never do
- We do not sell personal data. Not to anyone, not in any form, not for any price.
- We do not share your data with advertisers, data brokers or list vendors.
- We do not use your data, your emails, or your shipment records to train AI models.
- We do not access any account other than the one you gave us access to.
- We do not export your courier software’s database in bulk.
- We do not read your forwarded mail out of curiosity. Access is limited, logged, and only to fix something you asked us to fix.
6. How long we keep it
We keep the least we can while still being able to prove what happened.
| What | How long | Why |
|---|---|---|
| Forwarded pre-alert emails and attachments | 30 days after we finish processing them, then deleted | Long enough to re-run a failed batch or investigate a complaint |
| Label photos | 30 days, then deleted | Same reason |
| Extracted shipment data (tracking numbers, weights, dimensions) | For as long as you are a client, then 30 days after you leave | It is your operating record |
| Robot activity logs and panel access logs | 90 days | Long enough to investigate an incident, short enough to be honest |
| Security and error logs | 90 days | Same |
| Robot credentials | Until you remove them or leave. Destroyed within 24 hours of cancellation | They should not outlive the service |
| Account and contact details | For as long as you are a client, then 12 months | So we can answer questions after you leave |
| Contact form messages from people who never became clients | 24 months | So we do not pester someone twice |
| Invoices and payment records | 7 years | Tax and accounting law |
| Backups | Rolling 90 days | Backups are fully overwritten within this window, so deleted data disappears with them |
If you ask us to delete something sooner, we will, unless we are required to keep it for tax or legal reasons. In that case we will tell you which record we are keeping and why.
7. Who else touches your data
We keep this list short on purpose. Three kinds of vendor, each doing one job.
| Vendor type | What it does | Where it runs |
|---|---|---|
| Hosting provider | Runs the servers where the robot, the panel and the database live | United States |
| Email provider | Receives your forwarded pre-alert mail and sends our notifications | United States |
| Payment processor | Charges your card and stores the card details we never see | United States |
The current names and details of these vendors are not on a public page. Ask at hola@estibra.com and we send you the current list the same day. If we add or change a vendor that touches your data, we will tell you before it happens. If you object, you may cancel — which costs you nothing, because everything is month-to-month.
We do not give your data to anyone else. If a court order, subpoena or law requires us to hand something over, we will tell you before we do it, unless we are legally forbidden from telling you.
8. How we protect it
- Encrypted in transit and at rest. Your credentials and your data are encrypted while stored and while moving between systems.
- A limited robot user. You create it inside your own software. It is never the owner’s login. It has the permissions the work needs and no more.
- Daily password rotation. The robot’s password changes every day automatically.
- Separation between clients. Your data sits in your own space. The robot working for one warehouse cannot see another warehouse.
- Least privilege inside Estibra. Very few people can reach production, access requires a second factor, and every access is logged.
- Audit trail. Every robot action is recorded with a timestamp.
- Monitoring. A guardian process watches the robot around the clock and raises an alert when something stops or behaves oddly.
- Security reviews. Two security audits have been performed on the system. The dates and the scope are not on a public page — ask on a call and we walk you through who ran them and what was in scope.
No system is perfect and we will not tell you otherwise. If your data is involved in a security breach, we will notify you within 72 hours of determining that it happened, tell you what we know, and tell you what to do. That commitment is also written into our data processing terms.
We are not SOC 2 or ISO 27001 certified and we do not claim to be.
9. Where your data lives, and clients outside the United States
We process and store data in the United States.
If your company is established outside the United States — for example in Venezuela, Colombia, the Dominican Republic, Panama, Brazil or Mexico — the following applies. You are the controller of the personal data you send us. You warrant that you have given the notices your own country’s law requires and that you hold a lawful basis, including consent where your law requires consent, for sending that data to the United States. We act only on your documented instructions.
We will sign a country-specific processing addendum on request and at no charge, including for Brazil (LGPD), Colombia (Ley 1581) and Mexico (LFPDPPP). Ask at legal@estibra.com.
10. Your rights
Whoever you are, you can write to hola@estibra.com and ask us to:
- Tell you what we hold. We will describe the categories and give you a copy of your own data.
- Correct something. If a name or an email is wrong, we will fix it.
- Delete something. We will delete it unless the law requires us to keep that specific record, and we will tell you if that is the case.
- Export your data. Clients can request an export of their operating data at any time, in a common format.
- Revoke access. You can remove the robot credentials from the panel yourself, at any time, without asking us. The robot stops immediately. Removing your forwarding rule stops the email stream just as fast.
- Cancel. Month-to-month, cancel any time from the panel. On cancellation we shut down our side of the connection, destroy the credentials, and delete your data on the schedule in section 6. You should also disable the robot user inside your own courier software — it is your system and it takes seconds.
We answer within 30 days. We do not charge for any of this.
If you are one of the people on a package — a sender or a consignee — and you want your information corrected or deleted, please contact the courier you shipped with. They hold the relationship and they decide. Write to us at hola@estibra.com and we will point you to the right company and help them carry out the request.
Depending on where you live, your local law may give you additional rights. We apply the rights above to everyone, wherever you are, because running two standards is how mistakes happen.
11. Children
Estibra is a tool for businesses. It is not for anyone under 18 and we do not knowingly collect information from children. If you believe a child has given us information, write to hola@estibra.com and we will delete it.
12. Changes to this policy
If we change this policy in a way that matters, we will email the notice address on your account at least 30 days before the change takes effect, and we will update the date at the top of this page. Small corrections, like fixing a typo or a broken link, we will just make. You can always cancel instead of accepting a change.
13. How to reach us
Estibra LLC (in formation)
Miami, Florida
- General and privacy questions: hola@estibra.com
- Legal notices and formal requests: legal@estibra.com
This policy is governed by the laws of the State of Florida. Any dispute about it belongs in the state or federal courts located in Miami-Dade County, Florida.
Related pages: cookie policy, security, data processing terms, terms of service.
← Back to estibra.com