Legal ·
Privacy Policy
What personal data bexy collects, what it is used for, and what you can do about it — stated from what the site actually does.
Summary
This policy explains what personal data bexy collects at https://bexy.io, what it is used for and what you can do about it. It describes what the site does today; when that changes, this page changes with it.
You can track shipments and read every page without an account. bexy asks for personal data only when you create an account, send a message through the contact form or subscribe to updates. Browsing uses a session cookie and Google Analytics, as described below.
Who is responsible
The operators of bexy are responsible for the personal data described here.
Questions and requests about your personal data: use the contact page.
Shipment data
Tracking pages show data about cargo, read from Evergreen's public tracking records: Bill of Lading and container numbers, vessels and voyages, ports and places, dates, cargo quantities, weights and container statuses. bexy does not collect shipper, consignee or notify-party details.
When you look up an Evergreen Bill of Lading that bexy does not hold yet, bexy requests Evergreen's public record for that number itself — your IP address and your account are not passed on — and adds the shipment to the site as a public tracking page, which can also be announced to search engines through IndexNow.
bexy does not keep a history of the shipments you look up.
Your account
Creating an account stores your name, email address and password. The password is kept only as a one-way hash, never in readable form. The account also records when it was created and last changed.
If you turn on two-factor authentication, its secret key and recovery codes are stored encrypted, together with the time you confirmed it.
Your email address is used to sign you in. Email delivery is not set up yet: a password-reset or email-verification message you ask for, or a shipment alert, is written to the application log instead of being sent, including your address and its links.
A password-reset request stores your email address, a one-way hash of the reset token and the time. The record is removed when the link is used or a new one is requested; an unused one is not deleted automatically.
Unlock credits
When you unlock a Bill of Lading — on the site or through the MCP server — a record of the unlock is stored: your account, the shipment, its Bill of Lading numbers and the time. It keeps that shipment unlocked for you permanently and counts the credits you have used this month.
Shipment alerts
When you watch a shipment for email alerts, a record is stored: your account, the shipment, a label made of its container numbers and route, when you started watching, the changes waiting for your next email and when you were last emailed. Only an account whose email address is verified can watch a shipment.
bexy re-reads Evergreen's public record of a watched shipment about every 12 hours until the watch ends and emails you when its estimated arrival moves, its vessel or route changes, or a container is discharged at the port of discharge, reaches the place of delivery, is delivered or is returned empty. The email names the shipment by its container numbers and route, never its Bill of Lading number. While your email address is not verified — after you change it, for example — no alert is sent, and the changes found meanwhile are not kept.
A watch ends, and its record is deleted, when you stop it — on the shipment page, in Settings → Alerts or with the links in any alert email, one of which stops all your alerts — or, after a last email, once a status reports the shipment at its final destination, when none does within 30 days of its estimated arrival, after 150 days, when Evergreen's tracking page stops returning the shipment, or when the shipment leaves bexy's records.
API tokens and the MCP server
A personal access token you create in Settings is stored with the name you give it, its permissions, a one-way hash of the token (the token itself is shown to you only once) and the time it was last used.
When an AI assistant uses the MCP server, with or without a token, bexy receives only the tool calls it sends — such as a Bill of Lading or container number, country codes or port names — not your conversation with the assistant. Those calls are not logged. With a token, the token's last-used time is updated, and an unlock is recorded as described above.
The public MCP endpoint involves no account, and it ignores any cookie sent with a request. To apply its rate limits it counts requests in the site's cache per MCP session and address, per address and in total. A counter that names an address is kept under a hash keyed with a secret of the site's, never as the address itself, and counts one minute of requests. Once its minute is over it is no longer used, and it is deleted at the latest when the same counter next counts a request or the cache is cleared.
Contact form
A message sent through the contact form stores your first and last name, email address and message, which are used to reply to you.
Messages are not deleted automatically; ask us if you want yours deleted.
Analytics
bexy uses Google Analytics 4, a Google service. Its script loads with every page and sets its own cookies. When a page first loads, and each time you move to another page on the site, bexy sends Google a page view with the page's title and address, without its query string or any password-reset token. Like any web request, it also gives Google your IP address and browser details. Google processes this data under its own terms.
Google Analytics runs for every visitor whose browser allows it. You can block it with your browser's cookie or content settings, or with Google's opt-out browser add-on.
Crawler visit counts
When a recognised search-engine or AI crawler requests a page, identified by its user-agent, bexy adds one to a daily counter for that crawler. A counter holds the crawler's name and kind, the section of the site, the response format and status, the last path it requested and when. Ordinary visitors are not counted, and no IP address or full user-agent string is stored. Counters are deleted after 120 days.
Error and server logs
When something goes wrong, bexy's application log records the error with technical details and, if you were signed in, your account ID. Until email delivery is set up, it also holds the password-reset, email-verification and alert messages described above.
The web server in front of bexy may also keep standard access logs — IP address, requested address, browser user-agent and time — under its own configuration.
Your choices
Depending on where you live, data-protection law may give you further rights over your personal data, such as access, correction, deletion or objection. Contact us to use them.
- Correct your details
- Change your name and email address in Settings → Profile.
- Delete your account
- Settings → Profile → Delete account removes your account record — name, email address, password hash and two-factor settings — and the shipments you watch. Unlock records and API tokens linked to it are not deleted automatically, nor is an unused password-reset request; ask us to erase them.
- Stop shipment alerts
- Stop a watch on the shipment page, in Settings → Alerts or with the link in any alert email.
- Revoke API tokens
- Delete any token at once in Settings → API tokens.
- Contact messages and newsletter
- Ask us for a copy of what we hold, or to delete it.
- Cookies
- Your browser can block or delete cookies; without the session cookie you cannot sign in.
Changes to this policy
When what bexy does with personal data changes, this page is updated and the date at the top changes with it.