Rectangle Privacy Statement
Effective date: November 1, 2026
Responsible entity: Rectangle Labs, Inc., doing business as Rectangle (“Rectangle,” “we,” “us,” or “our”).
1. Scope and our role. Rectangle provides technology for connecting business systems, ingesting and organizing information, synchronizing records, and enabling supply-chain applications, workflows, analytics, and data services.
This Statement describes our handling of information through our websites, APIs, integrations, applications, and related services. It covers customers, users, developers, business contacts, and individuals whose information reaches Rectangle through connected systems or other sources.
Our role depends on the activity. When processing information on a customer’s behalf, we follow the applicable customer agreement, data processing terms, and lawful instructions. When determining our own purposes for processing—including account administration, business development, and separately authorized commercial data services—we are responsible for that processing under applicable law.
This Statement does not override contractual restrictions or authorize uses of customer information that our agreements or applicable law prohibit.
2. Information we collect. The information available to Rectangle depends on the systems connected, permissions granted, services enabled, and information supplied.
We obtain information directly from individuals; from customers and their authorized users; through connected transportation, enterprise, warehouse, accounting, communications, and other systems; and from logistics partners, public sources, and licensed information providers.
We may associate information from different sources to reconcile records, improve accuracy, and support the purposes described here. Connections may retrieve information repeatedly while active, within their authorized scope.
Information about a business may also be personal information when it identifies or can reasonably be linked to an individual.
3. How we use information. Subject to our contractual obligations and applicable law, we use information to:
Establish connections; extract, validate, normalize, enrich, and synchronize records; and deliver information to configured destinations.
Execute workflows, support logistics operations, and provide search, reporting, recommendations, and other requested functionality.
Administer accounts, billing, support, and communications.
Diagnose failures, evaluate data quality, secure systems, prevent misuse, and resolve disputes.
Develop and improve integrations, applications, analytical methods, and other products.
Train, evaluate, and improve machine-learning or AI systems where the relevant information is authorized for that purpose.
Produce benchmarks, forecasts, market intelligence, enriched datasets, and other commercial data products.
Identify business opportunities and communicate about Rectangle’s services, subject to applicable marketing requirements and preferences.
Meet legal obligations and establish, exercise, or defend legal rights.
Uses involving customer-controlled information remain subject to the restrictions described in Section 1. Access to information for synchronization does not, by itself, authorize its use for unrelated product development or commercialization.
4. Commercial data services and disclosures. Where authorized by our agreements and permitted by law, Rectangle may combine, enrich, package, and make information available through datasets, APIs, reports, subscriptions, licensing arrangements, and other commercial services. We may receive monetary payment or other value for providing access to that information.
These services may include business contact and professional information, operational and transaction records, relationship information, location information, and derived profiles or insights. They may contain identifiable personal information as well as business information and de-identified information.
Recipients may include shippers, carriers, brokers, distributors, manufacturers, logistics technology providers, analytics companies, market research organizations, and commercial information providers. They may use information for their own permitted purposes, including business contact discovery, record verification, logistics planning, capacity matching, market analysis, benchmarking, and product development.
Providing personal information under these arrangements may constitute a “sale” under applicable privacy laws. Where that is the case, we provide the required disclosures and honor applicable opt-out rights. Restrictions on sensitive information, required consent, and other legal limitations apply regardless of how an arrangement is described.
Our commercial data services do not include licensing passwords, authentication secrets, or API keys for recipients’ independent use.
5. Other disclosures. We also disclose information:
To configured recipients: customers, connected applications, trading partners, and other destinations selected through authorized workflows.
To service providers: companies supporting hosting, infrastructure, communications, payments, analytics, security, AI functionality, and other operational needs, subject to appropriate contractual restrictions.
Within our corporate group: for the purposes described in this Statement and subject to applicable restrictions.
To advisers and authorities: when reasonably necessary for legal advice, compliance, legal proceedings, fraud investigations, or protection of people, systems, and rights.
In business transactions: in connection with financing, an acquisition, a merger, a restructuring, or a transfer of business assets, subject to applicable protections.
At an individual’s direction or with consent: for an identified additional purpose.
Recipients acting independently may have their own privacy obligations and notices. Their involvement does not remove Rectangle’s obligations concerning its own disclosures.
6. Aggregated and de-identified information. Where permitted, we create information that is aggregated or de-identified so that it meets applicable legal standards for information that cannot reasonably be linked to an individual or household.
We may retain, analyze, publish, license, and otherwise commercialize that information for research, benchmarking, product development, and other lawful purposes, subject to applicable contractual restrictions.
We maintain qualifying de-identified information in that form, do not attempt to re-identify it except for legally permitted testing of de-identification safeguards, and require recipients to comply with applicable restrictions. Removing names or replacing identifiers does not automatically make information de-identified.
7. Sensitive information. Certain records may contain sensitive personal information, including precise geolocation, account-access information, or private communications.
We process sensitive information only for purposes permitted by applicable law and our agreements. Before using or disclosing it for an additional purpose, including a commercial data service, we obtain any required consent and implement applicable restrictions and choices. We do not carry out a prohibited use merely because consent has been obtained.
A customer’s decision to connect a system is not a substitute for an individual’s consent where that consent is legally required.
8. Retention and security. Retention depends on the information and its purpose:
Account and billing records are retained for account administration and applicable accounting, tax, and legal requirements.
Ingested records and documents are retained according to the service configuration, customer agreement, operational needs, and applicable deletion requirements.
Technical and security logs are retained for troubleshooting, reliability, investigation, and security needs.
Information used in commercial data products is retained while relevant to the disclosed purpose, subject to accuracy reviews, contractual limits, and applicable rights requests.
When information is no longer needed, we delete it or place it into a qualifying de-identified form. Backup copies and records subject to legal preservation requirements may follow different deletion schedules, with access and use appropriately restricted.
Disconnecting an integration stops future collection through that connection once the disconnection takes effect. It does not automatically delete previously collected records or information already delivered to another recipient.
We maintain administrative, technical, and organizational safeguards appropriate to the information we handle. No system can guarantee absolute security.
9. Your choices and rights. Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a portable copy of personal information; understand its sources and recipients; object to or restrict processing; withdraw consent; or appeal a decision concerning a privacy request.
You may also have rights to opt out of sales, targeted advertising, or certain profiling, and to limit particular uses or disclosures of sensitive personal information.
To exercise applicable rights, use:
Privacy requests: [email protected]
Do Not Sell or Share My Personal Information: [email protected].
Sensitive information choices: [email protected].
Appeals: [email protected].
We honor recognized opt-out preference signals, including Global Privacy Control, where required. We do not require account creation to submit an opt-out request. For other requests, we may need proportionate information to verify identity or authority. Opt-out requests may require information sufficient to locate the relevant records, rather than identity verification.
We respond within applicable legal deadlines and do not unlawfully discriminate against anyone for exercising privacy rights. If we hold information solely on a customer’s behalf, we may direct the request to that customer and assist as required.
You can unsubscribe from marketing messages using the instructions provided. Service and account communications may continue.
10. Regional disclosures. For California residents, “sharing” has a specific legal meaning involving cross-context behavioral advertising; it does not describe every transfer of information.
Where EEA or UK law applies, our legal basis depends on the activity. It may include performing a contract with the individual, complying with legal obligations, consent, or legitimate interests that are not overridden by the individual’s rights. Relevant interests may include administering business relationships, securing integrations, and improving service reliability.
Individuals may complain to their competent privacy regulator and withdraw consent where processing relies on it.
11. International processing. Information may be processed in Europe, where Rectangle and its providers operate. Where applicable law restricts international transfers, we use an appropriate transfer mechanism and any required supplementary safeguards.
You may contact us for information about the safeguards applicable to your information.
12. Changes and contact. We may revise this Statement as our services and practices evolve. We will identify the effective date and provide additional notice or obtain consent where required. Publishing an updated Statement does not itself authorize a materially different use of previously collected information.
For questions or privacy requests, contact:
Rectangle Labs, Inc.
[email protected]
1101 W Lake St, Chicago, IL 60607
