Last updated: September 22, 2026
Marsa ("we", "our", "the platform") is a customs clearance and freight forwarding management platform operated by Silk Labs, used by logistics companies ("customers", "tenants") to manage their operations, shipments, quotes, finances, and client relationships. This policy explains what data we collect, why, and how it's protected.
Account & company data: names, emails, phone numbers, and company details you provide when creating an account or being invited to one.
Operational data: customs operations, shipments, quotes, invoices, and client records that your company enters into the platform to run its business.
Connected email accounts: if you choose to connect a Gmail or Outlook account (Settings → Email), we store an encrypted OAuth token so the platform can scan recent inbox metadata (sender, subject, and a short snippet — never full message bodies), automatically once a day or when you press Scan, to flag messages relevant to your operations or clients. Matches are shown only to the person who connected the mailbox. You can disconnect an account at any time: we delete the stored token and the matches immediately, and for Gmail we also ask Google to revoke our access. For Outlook, you can additionally remove Marsa under your Microsoft account's app permissions.
Government portal credentials: for customers using our Nafeza customs-portal integration, credentials are encrypted at rest and only decrypted server-side for authorized automated lookups.
Data is used solely to operate the platform for the account holder: displaying dashboards, generating documents, sending transactional notifications (password resets, invitations, status updates), and — where you've opted in — sending email from your own connected account and surfacing relevant inbox matches. We do not sell personal data, and we do not use connected-email content to train any AI model.
When you connect a Gmail or Outlook account, Marsa requests only the minimum access needed:
Message content is never permanently stored. Only a small pointer record (sender, subject, a short snippet, and which operation or client it appears to relate to) is kept, so re-scanning doesn't duplicate work. OAuth tokens are encrypted at rest with a dedicated encryption key, separate from all other stored secrets, and are deleted immediately if you disconnect the account.
Some features use Claude, an AI model provided by Anthropic, PBC, to read documents and answer questions. Data goes to Anthropic only when you use one of these features, and only what that feature needs:
The mobile app asks for your permission before it sends anything to Anthropic for the first time. Anthropic processes this data only to return a result to us. Under its commercial terms it does not use it to train its models. Nothing is sent to Anthropic in the background, and none of your other data is sent.
We do not share your data with third parties for marketing purposes, and we never sell it. Besides Anthropic (above), data is processed by infrastructure providers strictly to operate the service: hosting (Vercel), database and file storage (Supabase), email delivery, and push notifications (Apple Push Notification service and Google Firebase Cloud Messaging, which receive a device token and the text of the notification). Each works under standard data-processing terms and may not repurpose the data.
Data is encrypted in transit (HTTPS) and sensitive fields (OAuth tokens, government portal credentials) are encrypted at rest. Access to any company's data is scoped to that company's own users; platform administrators access data only for support or security purposes.
You can disconnect a connected email account at any time from Settings → Email. You can request deletion of your account in the mobile app (Settings → Delete Account) or at marsa.silk-labs.net/privacy/delete-account, and request an export of your data by contacting us at the address below.
Questions about this policy or your data: support@silk-labs.net