Privacy Policy

1. Scope

This policy explains what personal data Shipbroker.io collects when you use the site, why we collect it, who we share it with, and what you can ask us to do about it. We are the controller of that data.

2. What we collect

• Account data — name, email address, password (stored hashed, never in plain text), company, country, and phone number, given at signup.
• Listing data — vessel particulars, photos, and documents you upload, together with the account that posted them.
• Messages and inquiries — the content of inquiries and messages you send to other users through the site, and who sent what to whom.
• Notification preferences — whether you want inquiry, message, and product emails.
• Email delivery records — which transactional emails we sent you, when, and whether the provider accepted them. We keep this to debug missing mail and to avoid sending you the same reminder twice.
• Technical and usage data — IP address, browser, pages viewed, and actions taken, collected for security, rate limiting, and product analytics.

3. Why we use it, and on what basis

• To run your account, publish your listings, and deliver inquiries and messages — necessary to perform our contract with you.
• To send transactional email: new inquiry alerts, new message alerts, a one-off reminder when an inquiry on your listing is still unanswered, and a welcome message — necessary to perform our contract with you. These are not marketing and you cannot be charged for them, but you can turn the alert categories off in your profile settings.
• To keep the site secure and prevent abuse, including rate limiting and fraud checks — our legitimate interest.
• To understand how the product is used and improve it — our legitimate interest, using analytics that we keep to the minimum needed.
• To meet legal, tax, and sanctions-compliance obligations where they apply.

4. What other users can see

Your listings are public, including the vessel details and photos you upload. Your name and company are shown to a user you are in a conversation with. Your email address and phone number are not published on the site; a user who contacts you reaches you through our messaging system, and our notification emails are sent from our own address.

5. Processors we use

We do not sell personal data. We share it only with the service providers that run the platform, each acting on our instructions:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and scheduled jobs.
• Resend — delivery of transactional email.
• Cloudflare R2 — storage of listing photos and documents.
• Upstash — rate limiting on authentication and inquiry endpoints.
• PostHog — product analytics.
• Google (Gemini) — generating vessel valuation estimates.

Some of these are based outside the UK and EEA. Where data is transferred internationally we rely on the provider's standard contractual clauses or an equivalent safeguard.

We will also disclose data where we are legally required to.

6. How long we keep it

Account data is kept while your account is open and for a reasonable period afterwards so we can handle disputes and meet legal obligations. Messages and inquiries are kept for the life of the account so both sides retain their correspondence. Email delivery records and security logs are kept for a shorter period. Delete your account and we remove or anonymise your personal data except where we must keep it by law.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. Where we rely on legitimate interest you can object and we will stop unless we have overriding grounds. Email sales@shipbroker.io and we will respond within one month. If you are unhappy with our response you can complain to your national data protection authority.

8. Cookies

We use cookies that are strictly necessary to keep you signed in and to protect the site, plus analytics cookies to measure how the product is used. You can block cookies in your browser, but the necessary ones are required for sign-in to work.

9. Security

Data is encrypted in transit, passwords are hashed, access to listings and messages is enforced at the database level, and administrative access is limited. No system is perfectly secure, and we will notify you and the relevant regulator if a breach puts your data at risk.

10. Changes and contact

We will post any update here and change the date at the top. For anything about this policy or your data, contact sales@shipbroker.io.