Privacy

Documents you upload

Documents are stored in private storage, are never placed on a public URL, and are served only through short-lived links that re-check your organization membership at the moment of download.

Uploads made without an account are deleted automatically after 24 hours. You can delete your organization's documents and analysis at any time from settings, which removes the stored files as well as the records.

What is kept about you

• Your IP address is never stored. Where rate limiting needs to recognise repeat requests, a salted hash is stored instead of the address.
• Analytics are counts and coarse buckets. No document text, no identifiers, and amounts only as ranges.
• Account details. Your email, name and organization. Passwords are stored only as a scrypt hash and cannot be recovered, only reset.

The benchmark, and your part in it

ChargeBasis can show how a charge compares to what other importers were billed. That is only possible because people contribute, and contributing is optional and off unless you turn it on.

A contributed record contains the charge type, the amount, the destination city and the month. It does not contain your company, your provider's name, your references, or any part of a document. A single record is useless on its own, and comparisons are never shown from fewer than eight of them.

Cookies, and why there is no banner

This site sets three cookies. None is readable by JavaScript, and none is shared with anyone. Two are strictly necessary to make the site work; the third is not, and is described honestly as such below.

• lp_session keeps you signed in. Set only when you sign in, and removed when you sign out.
• lp_scan links you to a check you ran without an account, so the result is still yours when the page reloads. It expires with the check itself.
• lp_ref records which advert or link brought you here, if the address you arrived on said so, and keeps it for 90 days so that a later sign-up can be credited to it. This one is not strictly necessary — it exists so we can tell which advertising is worth paying for. It holds only the campaign labels from the address you arrived on: no identifier, nothing about you, and it is never read by anyone but this site.

There are no third-party scripts of any kind, and no cookie here is set by anyone else. Nothing on these pages contacts another company's server — fonts are served from this domain rather than from a font provider, so loading a page tells nobody but us that you visited.

That is why there is still no consent banner: nothing here is shared, sold, or joined to anything, and the one non-essential cookie carries a campaign label rather than a person. If you would rather not have it, blocking cookies for this domain costs you nothing but staying signed in. If we ever set something that does track you across sites, you will be asked before it happens, not after.

How we count visits

We measure which pages get opened and roughly how long each one stays visible. It is the only way to tell whether a page is being read or bounced off, and we would rather say we do it than leave you to find it.

It runs on this domain and reports only to this domain. It sets no cookie, reads no storage, and creates no identifier of any kind — which means two visits by you are indistinguishable from one visit by each of two people. That is a real cost to us: we cannot tell returning visitors from new ones, and we accept it.

What is recorded is the page path, the site you arrived from (its name only, never the full address you came from), the country the request came from, whether you are on a phone or a computer, and the time on the page as a range such as “15–30 seconds” rather than a precise duration. Exact timings are close to unique to a person; ranges answer the question without being able to.

Where your data is held

Data is stored in Canada. The database and document storage run in a Canadian region with Supabase, and the application is served by Vercel. Those two are our only subprocessors for your data, alongside Stripe for payment (which receives your billing details directly and never routes card data through us) and Resend for transactional email such as password resets.

No analytics provider, advertising network, or data broker receives anything.

Documents are treated as untrusted

Text inside a file you upload is data, never an instruction. It cannot change what the software does, reveal anything, or affect another customer. Where analysis uses a language model, that model is given no tools and its output can only fill in fields that deterministic code then checks.

Your rights

Under Canadian federal privacy law you may ask what personal information is held about you, why, and who it has been given to; ask for it to be corrected; and withdraw consent. You can delete your organization's documents and analysis at any time from settings, without asking anyone.

For anything else, write to support@chargebasis.com. We answer within 30 days, and there is no charge. If you are not satisfied with the answer you may complain to the Office of the Privacy Commissioner of Canada.

What this product is not

ChargeBasis produces document-based assessments of freight charges. It is not a law firm, does not provide legal advice, and does not guarantee that any amount is recoverable. Findings describe what the documents you supplied do and do not support.