Privacy policy

• You visit this website. Then server logs arise. Necessary cookies and a cookie notice (no marketing or analytics scripts).
• You use the software. Then account, uploaded papers and check reports are added.
• You report a fake. Then we process details of the reported carrier and, if you give them, your own.
• You write to us. Then we process your enquiry.

When you retrieve pages, your browser transmits technically necessary data to the server. That usually includes IP address, time, requested address, volume transferred, browser and operating system. Legal basis is our legitimate interest in a secure, stable operation of the website (Art. 6 (1) (f) GDPR).

This website and the software are one application, hosted by Railway (Railway Corporation, San Francisco, USA) in the EU, Amsterdam region. There is no separate World4You site host. The website is delivered and protected by Cloudflare (Cloudflare, Inc., San Francisco, USA; content delivery network), which also processes your IP address. For both, the basis for any transfer to the USA is the EU-US Data Privacy Framework or standard contractual clauses.

Query and system logs are kept for one year.

Encryption

Transmission between your browser and our server is encrypted with TLS. You see that from the lock in the address bar and from https:// before the address.

Fonts

Marketing pages and the signed-in application load Space Grotesk, Inter and JetBrains Mono from this application. They do not contact Google Fonts.

Necessary first-party cookies and local storage run the site and the signed-in product. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) where you have an account, and legitimate interest in a usable, secure service (Art. 6 (1) (f) GDPR).

Other site data (not cookies, but similar):

• Server logs on Railway: IP address, time, requested URL, browser user-agent — needed to operate and secure the site.
• First-visit language default: CDN country header (e.g. CF-IPCountry) or a local IP-to-country table for DE/AT/CH/LI. The address is not sent to a geolocation vendor.
• Signup trial-abuse checks: timezone, language, screen-size class and OS family in the browser. We store an HMAC of the IP and of that device class — not a unique fingerprint.
• Signup IP and user-agent are stored on a server-only record for abuse prevention and GDPR documentation. They are not shown in Settings.
• If you start a paid subscription, Stripe Checkout runs on stripe.com and may set its own cookies there. That happens only when you open Checkout.

The exact Supabase cookie name includes the project reference (sb-…-auth-token). Chunked variants exist when the session value is large.

External media: training videos

Training videos are hosted on YouTube. The YouTube player and its cookies load only after you agree to external media in the cookie banner, or when you press Play on a single video. YouTube runs in privacy-enhanced mode (youtube-nocookie.com). When a video plays, Google receives your IP address, device and browser data and that you watched the video; it may set its own cookies. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 165 (3) TKG 2021). Google may process the data in the USA (third country, Art. 44 et seq. GDPR).

• YouTube — Google Ireland Limited, Dublin, Ireland; Google LLC, USA (Training videos)

You can change or withdraw your choice at any time under Cookie settings: at the bottom of every page of this website and, when signed in, in the account menu at the top right. Withdrawal does not affect what was loaded before.

User account

For the account we process the details you give at sign-up — name, email address, phone number, company, access data, and optionally an EU VAT number — plus usage data such as sign-in times and the number of checks run. We may call the phone number to verify a new account before its first check. Legal basis is performance of the contract of use (Art. 6 (1) (b) GDPR).

When you register we record that you accepted the terms and, if you create the workspace, the data processing agreement — with IP address, time and the version accepted. We keep these records for the life of the account plus three years, to be able to prove the contract (Art. 6 (1) (b) and (f) GDPR).

Logs

We log every sign-in and every check with time, user account, IP address and the checked carrier (name and VAT number). We use these logs for security, support and error analysis and to detect and investigate misuse, such as systematic repeated queries. They are kept for one year; longer only where needed to pursue a specific suspicion of misuse or where the law requires it. For these logs we are the controller ourselves. Legal basis: legitimate interest in a secure service free of misuse (Art. 6 (1) (f) GDPR).

Free-trial abuse checks

To stop people farming extra free scans with throwaway accounts we compute a signup risk score (not the cargo-document score). It can reduce or set to zero the unverified free quota. It does not refuse the account, and a valid unused EU VAT or a paid plan still unlocks scans. Signals we use: whether the sign-up email looks disposable, role-based or free-mail; how many trial workspaces recently appeared from the same network; whether another sandbox on that network already used its free scans; coarse device class (timezone, language, operating-system family, screen-size class); and automated-browser hints from the user-agent. We store an HMAC of the IP address and of that device class — not the raw IP, not a unique device fingerprint (no canvas/WebGL/audio). Sighting hashes are kept about 30 days; the score stays on the workspace until the account is deleted. Legal basis: legitimate interest in preventing trial abuse (Art. 6 (1) (f) GDPR).

If the sign-up mailbox is not on our local free-mail list we may send the address to Bouncer (already a processor for document contact emails) to see if it is disposable or a role/catch-all address.

Uploaded papers

You upload transport offers, freight papers, correspondence or whole emails. Then the following happens:

1. Every file is first checked for malware. Legal basis is our legitimate interest in the security of the system and of all users’ data (Art. 6 (1) (f) GDPR). We use attachmentAV (widdix GmbH, Germany) for that; files are scanned without being stored.
2. OCR reads the data and maps it to check fields. We use Google Cloud Document AI (EU) for that.
3. The extracted text is evaluated with AI support. We use OpenAI (API, not ChatGPT, with European data residency) for that.
4. Individual details are checked with specialist services — domain registration data at WhoisXML, email validity at Bouncer, phone line type at Twilio, VAT existence at VIES (European Commission public API).
5. Details are scored under the rules of the four modules. That produces the check report with the cp-score.

The full list of providers and their tasks is on the subprocessors page.

These papers regularly contain personal data of third parties — for example name and signature of driving staff, extensions of contacts, or particulars of sole traders. What is uploaded is your decision. We process these data solely for the check you requested.

For the data you upload for a check, we act as your processor: you are the controller, and we process the data on your behalf under the data processing agreement (Art. 28 GDPR) that is accepted at registration. We are the controller ourselves for our logs, for misuse prevention and for data we keep after a contract ends.

Check reports and cp-rating

The report stays in your account. Each check is carried out anew; stored check data are not used for checks by other customers. When you check the same carrier again, your own earlier checks of it can be taken into account while they are stored.

Retention

Checks, uploaded documents, OCR and analysis data and results are kept for three and a half years from the respective check, so that you can trace and prove checks within the limitation periods for transport contracts (in particular Art. 32 CMR), and are then deleted. After a contract ends, we keep these data blocked until that period ends, as controller ourselves, and use them only to establish, exercise or defend legal claims.

Hosting of the software

The application runs on Railway (EU, Amsterdam region); database, sign-in and file storage run on Supabase (EU). Some providers that process content of your papers have their seat or parent company outside the EU; see Recipients and third-country transfers.

Payments

Card payments are handled by Stripe (Stripe Payments Europe, Ltd., Dublin, when live). You enter payment data at Stripe — full card numbers do not reach us. From Stripe we receive what we need for invoicing: name, billing address, amount, method and payment status. Legal basis is performance of the contract (Art. 6 (1) (b) GDPR). Stripe processes payment data under its own responsibility and receives no check data.

What is transmitted

• Details of the reported carrier: company, address, country, register and VAT numbers, licence, website, emails, phone, plates and name of driving staff.
• Details of the incident: type, date, route, load, loss amount, platform, account, and whether a police report was filed.
• Evidence, if you attach any. Files are scanned for malware and stored in a private bucket with the report.
• Your own details — name, company, email, phone. These fields are optional. Without them we cannot follow up; we still take the report.

Legal basis is your consent given expressly on send (Art. 6 (1) (a) GDPR) and our legitimate interest and that of other users in preventing further losses (Art. 6 (1) (f) GDPR).

How the report is sent

Submit posts the form to our server over HTTPS. We store the report (and any evidence files) and notify [email protected] by email. If you left an email address, we set it as Reply-To so the desk can answer you. You do not need to send a separate message from your own mail program.

Evidence files we accept: PDF, JPEG, PNG, and saved emails (.eml / .msg), together at most 25 MB. Office or ZIP files are not accepted.

What happens to the report

• We examine it and match it to known patterns.
• What flows into scoring of future enquiries is first anonymised.
• We publish neither the reported name nor your details and do not pass them to third parties for advertising.
• If you ticked the box, we contact you if further reports on the same carrier arrive.

We cannot withdraw a sent report. You can always have your own contact details deleted — write to the address below.

If you contact us by email or phone, we process your details to handle the enquiry. Legal basis is taking steps prior to a contract or performance of a contract (Art. 6 (1) (b) GDPR) or our legitimate interest in answering (Art. 6 (1) (f) GDPR).

Added to that are authorities and courts where we are legally obliged to disclose, our tax advisor and, in a dispute, our legal representation within the statutory frame.

VAT numbers are checked with the EU’s VIES service and domain names with WhoisXML. These are queries of public sources and registers, not processing on our behalf. The payment provider (Stripe) processes payment data under its own responsibility.

Data are stored in data centres in the European Union. A transfer to a country outside the EEA, including remote access by a provider established there, takes place only on a basis under Art. 44 et seq. GDPR:

• Twilio checks phone numbers in the USA, on the basis of binding corporate rules.
• Railway, OpenAI, Resend and Cloudflare: EU-US Data Privacy Framework or standard contractual clauses.
• Supabase and Google Cloud: standard contractual clauses.
• Microsoft 365: EU Data Boundary and standard contractual clauses.

Bouncer and attachmentAV process data in the EU only. The basis for each provider is on the subprocessors page.

The cp-rating scores companies, not persons, and it decides nothing. Whether a job is awarded is decided solely by the person in dispatch — the score is a decision aid that complements their own check and does not replace it. In our view this is not an automated decision under Art. 22 GDPR.

You have the following rights against us:

• Access to personal data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consents with effect for the future (Art. 7 (3) GDPR)

Write to [email protected]. We reply within the statutory one-month period. If your request concerns a check that one of our customers ran, we act as that customer’s processor and forward the request to the customer, who answers it.

Independently of that you may complain to a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

There is no self-serve button to delete a company and its files. Email [email protected] to request deletion of the workspace, accounts and uploaded files. We handle that as an admin GDPR request.

October 2026. We update this statement when processing changes.